BlueAnchor Privacy Policy

Effective date: 30 September 2026 Previous version: [29 September 2026](https://blueanchor.app/privacy-2026-09-29) Provider: Blue Harbour Solutions Inc ("BlueAnchor", "we", "us"), Nova Scotia, Canada Contact: support@blueharboursolutions.com

Summary, in plain language

BlueAnchor reads your receipts and works out what you can claim. Three things matter more than anything else in this document, so they are here rather than buried:

Your records live in your own vault: on your own computer, or on our servers in Canada if we host it for you. Either way it is yours alone, never a shared table with other customers. The app on your phone talks to that vault and nothing else. We do not sell your records or use them for anything but running your vault.
Receipt images are sent to Google for reading. That is how the text comes off the picture. It is the one place your documents leave your control, and section 2 says exactly what happens to them.
Location, if you turn it on, is recorded continuously while you drive. That is the most intrusive thing this app does. It is off until you switch it on, and section 3 says what is kept.

The first time you set up your books, you sign in with Apple. BlueAnchor receives your name and an email address, which can be a private relay address Apple creates for you. Both are stored in your own vault, on your computer or on our server in Canada if we host it.

1. What we process, and where it goes

Data	Why	Where it goes
Receipt and invoice images, and PDFs	To read the supplier, date, amounts and tax	Sent to Google (Gemini) for extraction. The original file is stored in your vault
The extracted text and figures	The books, the claims, the return	Your vault only
Email in the mailboxes you connect	To find receipts you were sent	Read directly from your mail provider by the software holding your vault. Messages that are not receipts are discarded
Mailbox passwords	To read that mail	Stored with your vault only. They are never typed into the phone
Location traces, if enabled	To measure a drive for a vehicle claim	Your phone, then your vault. See section 3
Addresses you type for a trip	To measure the road distance	Sent to Mapbox for that lookup
Bank or card statements you import	To find charges with no receipt	Your vault. If automatic receipt matching is on, the merchant wording on a charge (never its amount, date or account) and the supplier name from the matching receipt are sent to TypeSafe to judge whether they are the same business. See section 5
Purchase status, if you subscribe	To unlock what you paid for	Apple, and RevenueCat

We do not sell anything. We do not run advertising. We do not profile you.

2. The one place your documents leave your control

To read a receipt, the image or PDF is sent to Google's Gemini API. There is no way to extract text from a photograph without something reading the photograph.

It is sent for the purpose of extraction and a result is returned.
Google's terms for the paid API state that content submitted through it is not used to train their models. Confirm this against their current terms before relying on it, because those terms change and this document may lag them.
The original file stays in your vault. Only the image sent for reading travels, and the result comes back to your vault.
A social insurance number is never sent. Before any document leaves, it is read on the machine that holds your vault, and any social insurance number on it (a T4, a pay stub, a letter from the CRA) is blacked out on the copy that is sent. If that check cannot run, the document is not sent at all. A GST/HST registration number is left in place, because the tax credit depends on it.
If this is unacceptable for a particular document, do not capture it. There is no way to have the software read something without sending it.

Your receipts contain what you bought, from whom, when, and for how much. Treat that as the sensitive material it is when deciding what to photograph.

3. Location

Off unless you switch it on. It is the most intrusive permission this app asks for and it is not required to use anything else.

What is recorded. When switched on, iOS reports your position continuously while a drive is being recorded, and the app keeps a point about every 20 metres travelled, or every 30 seconds while you are stopped. Those points are stored on your phone, totalled into a distance, and sent to your vault as a trip. If we host your vault, that is our server in Canada; if not, it is your own computer. Nothing is sent anywhere else.

What it is for. A vehicle claim is refused on the quality of the log, not the arithmetic. The CRA wants the date, the destination, the reason and the distance, and measuring beats remembering.

What is never done with it. It is not used for anything but measuring a drive. It is not shared, sold, or sent to any third party. Switching the feature off stops the recording and discards the journey in progress.

Deleting it. Every recorded drive can be deleted individually in the app.

4. Where your data actually lives

On your own computer, or on our servers in Canada. Never anywhere else.

BlueAnchor runs two ways and you choose which.

On your own computer. The vault is a database file on your machine with the original documents beside it. We cannot recover it, because we do not have it, and we cannot see your books to help you. Back it up: the app writes verified backups to a folder, and to Google Drive if you point it at one.

Hosted by us. Your vault is a separate database file on our servers, not a row in a shared table with other customers in it. One vault, one customer, one file. We hold it, we back it up, and we can restore it.

Either way it stays in Canada. The CRA is explicit, in Information Circular IC78-10: records must be kept at a place of business or residence in Canada, and "books and records kept outside Canada and accessed electronically from Canada are not books and records in Canada." So our servers, our backups and our storage are in Canadian regions. This is not a preference we would trade for a cheaper region; hosting your books in the United States would put you offside with the CRA without you doing anything wrong.

The exceptions, stated plainly: to read a receipt the image is sent to Google to be read, and comes back (section 2); and if automatic receipt matching is on, a supplier name and the merchant wording on a charge are sent to TypeSafe for a yes or no on whether they are the same business (section 5). Both are processing, not record keeping, and the record itself never leaves Canada. If that is unacceptable for a particular document, do not capture it.

Who at BlueAnchor can see a hosted vault. Nobody, routinely. Support cannot browse your books. If you ask for help with something specific and give permission, access is granted for that purpose and recorded in your own audit log, where you can see it.

5. Third parties

Who	What they receive	Why
Google (Gemini API)	Receipt images and PDFs you capture	To read the text off them
TypeSafe	Only if automatic receipt matching is on: the supplier name on a receipt and the merchant wording on a card charge, with long numbers removed. Never amounts, dates, accounts or person-to-person transfers	To tell whether a charge came from the business on the receipt
Cloudflare	If we host your vault: the connection between your phone or browser and our server, while it is in transit	To carry that connection securely and keep attacks off the server
Mapbox	Two addresses, when you ask for a road distance	To measure the trip
Apple	Purchase and subscription status	Billing
RevenueCat	Purchase and subscription status	Entitlements
Sentry	Crash reports: the error, the stack trace and the device model	To find out what broke
Teller	Only if you connect a bank: your bank login, entered at your bank's own page, then your account and transaction data	To read your statement without you exporting it
Plaid	Only if you connect a bank through it: your bank login, entered in Plaid's own window, then your account names and transactions	To bring in your transactions without you exporting a statement
Your mail provider	Nothing from us. The software holding your vault connects to it directly	To find emailed receipts

About receipt matching and TypeSafe. Matching a receipt to the charge that paid for it is done in your vault. The one question it cannot answer well on its own is whether a bank's shorthand ("SQ *HARBOURVI HFX") names the business on the receipt. When matching is on, that question goes to TypeSafe with only the two names. TypeSafe's terms state that it does not use customer data to train its models and does not sell or share it; its terms do not state where it processes data or for how long it keeps a request, so assume it may be outside Canada. Its subprocessors are listed at https://trust.typesafe.ai/subprocessors. Each answer is kept in your vault, so the same pair is never asked twice.

About a bank connection. By default there is none, and statements are files you export and import yourself. If you connect a bank, it is done through Plaid, for banks in Canada and the United States, or Teller, for the United States only. You sign in to your bank in Plaid's or your bank's own window: your login never reaches this app and never reaches us. Your vault then receives your account names and your transactions. You are agreeing to that provider's own terms and privacy policy: Plaid's at https://plaid.com/legal/#end-user-privacy-policy, or Teller's at https://teller.io/legal/user/terms and https://teller.io/legal/user/privacy. Both are United States companies, so your bank data passes through the United States on its way to your vault. You can disconnect a bank at any time. Disconnecting a Plaid bank removes the connection at Plaid, and the transactions already in your vault stay yours.

What the crash reports deliberately leave out. No personal identifiers are attached, console logs are dropped before they are sent, and the request and user objects are removed from every event. A crash report says that a particular line of code failed on a particular model of phone. It does not carry your receipts, your figures or your name. Sentry's servers are in the United States, and you can see exactly what is sent and what is stripped in mobile/src/crash.js.

About Cloudflare. A hosted vault is reached through Cloudflare, which carries the encrypted connection to our server in Canada. Cloudflare decrypts and re-encrypts that traffic at its network edge in order to pass it on, so while it is in transit your data passes through Cloudflare's systems. It is not stored there. Cloudflare is a United States company. A vault on your own computer does not use it unless you have set that up yourself.

What leaves Canada. Receipt images sent to Google to be read, bank data on its way through Plaid or Teller if you connect a bank, crash reports to Sentry, and hosted traffic in transit through Cloudflare. Your records themselves are kept in Canada.

6. Retention

In your vault: everything, until you delete it. Tax records generally have to be kept six years from the end of the year they relate to, and the software is built on that assumption.
With us: if you keep your books on your own computer, nothing, because we do not receive it. If we host them, your vault and its backups, until you delete them. If you stop paying, we tell you before anything is deleted, as the terms say.
With Google: governed by their API terms at the time of the request.
With Sentry: crash reports, on Sentry's own retention schedule. They contain no records and no identifiers.
With Teller: only if you connect a bank, and on their retention schedule. Disconnecting stops the feed and keeps everything already in your vault.
With Plaid: only if you connect a bank through it, and on their retention schedule. Disconnecting removes the connection at Plaid.

7. Your rights

Under PIPEDA and Nova Scotia law you may ask what we hold about you, ask for a copy, and ask for it to be deleted. The honest answer for the current version is that we hold a subscription status through Apple and RevenueCat, and crash reports through Sentry which carry no identifier that could point back to you. Write to support@blueharboursolutions.com and we will say so in writing.

Everything else is already yours, on your own machine, in an open format you can read without us.

8. Children

BlueAnchor is for adults running a business or filing their own return. It is not directed at children and we do not knowingly collect anything from them. A cost recorded as being for a named child is a note you typed about your own household, held on your own machine.

9. Security

On your own computer, your records' security is your machine's security. Use full-disk encryption. If we host them, your vault is its own file on our servers in Canada.
The phone talks to a vault on your own computer over your own network, and to a hosted vault over an encrypted https connection.
Mailbox passwords and API keys are stored with the vault, with restricted file permissions, and are never in the app.
Social insurance numbers and other government identifiers you enter are encrypted inside the vault (AES-256-GCM), with the key kept apart from the database. Screens show only the last three digits.
Accounting sign-in tokens (QuickBooks, Xero) are encrypted the same way.
Nothing sensitive is compiled into the app. Anything shipped inside an app can be extracted from it, so nothing that matters is put there.

10. Changes

If this changes materially you will be told in the app before the change takes effect, and the previous version will be kept alongside this one rather than replaced.

11. Contact

support@blueharboursolutions.com Blue Harbour Solutions Inc, Nova Scotia, Canada