Privacy Policy

Who is responsible

MissingLayer B.V., registered in the Netherlands, provides BackYet and is the controller for personal data described in this policy. Contact us at support@missinglayer.com.

Information kept on your device

BackYet stores the items you create, including amounts, currencies, counterparties, statuses, dates, notes, reminder choices, and saved evidence derivatives, locally on your device. We do not receive this information during ordinary manual use. Apple may separately process purchase and notification information under its own policies.

Optional Smart Capture

If you explicitly allow AI suggestions, BackYet processes your selected photos (up to three) or PDF locally before upload. It removes file metadata, normalizes orientation, limits the material to three image pages, scales each page to a maximum 1,600-pixel edge, and limits the combined image payload. The original photos or PDF are not uploaded.

Before you consent, the app says: “To fill in the company, amount, currency, date and reference, BackYet sends a copy. Any visible information may be included.” That copy is metadata-free, resized, and limited to the first three pages, and it includes any visible names, amounts, account details, or reference numbers they contain. Cloudflare additionally receives a random app ID and your IP address for security and rate limiting, and these are not forwarded to the AI services.

BackYet sends that processed copy to a service operated by MissingLayer B.V. on Cloudflare Workers. The request also contains a random opaque installation identifier, and Cloudflare necessarily processes network information such as the IP address. MissingLayer and Cloudflare use the identifier and network information only for security, rate limiting, and abuse prevention. The installation identifier and user IP address are not forwarded to the AI services.

Our service sends the processed image pages to OpenRouter, an AI routing service, which sends them only to Alibaba Cloud International for its Qwen AI models. The AI services receive the visible content in those processed pages and use it only to suggest the company, amount, currency, date, and reference. The request does not ask them to make decisions or take actions for you.

Our Worker does not persist evidence or extracted fields and has application observability disabled. Every AI request denies provider data collection and training, pins routing to Alibaba Cloud, and disables fallback to any other model provider. OpenRouter and Alibaba Cloud use the pages to return the result and do not use them to train models. The Alibaba endpoint is not classified by OpenRouter as Zero Data Retention, so processors may retain limited request or security logs under their policies or legal obligations.

Why we process information

Smart Capture processing is performed only after an in-app disclosure names the data and recipients and you tap Allow & scan. The purpose is to provide editable field suggestions. Installation and network signals are used only for security, rate limiting, and fraud prevention. You can decline, use manual entry without any upload, or withdraw Smart Capture permission in BackYet settings so that the disclosure appears before the next upload.

Purchases and sharing

Purchases are processed by Apple through StoreKit. We do not receive your payment-card details. If you use the share feature, Apple’s system share sheet sends the result only to the destination you choose; BackYet does not operate a sharing service or receive the shared content.

Retention and deletion

Local records remain until you delete an item or remove the app. Our Worker does not store Smart Capture documents or extracted fields. Cloudflare, OpenRouter, and Alibaba Cloud may retain limited request, security, or network logs under their policies or legal obligations. Smart Capture content is not used for model training. Support emails are retained only as reasonably needed to answer the request and meet legal obligations.

Processors and international transfers

Smart Capture uses Cloudflare for network delivery and rate limiting, OpenRouter for AI request routing, and Alibaba Cloud International to run its Qwen AI models. We require each processor to protect the data to the same or an equal standard as this policy, limit processing to the purposes above, apply appropriate security, and use transfer safeguards where required. These services may process information outside the European Economic Area.

Your rights

Depending on where you live, you may request access, correction, deletion, restriction, portability, or objection, and may withdraw consent at any time. Contact support@missinglayer.com. You may also complain to your local supervisory authority; our lead authority is the Dutch Data Protection Authority.

Children

BackYet is a general-audience utility and is not directed to children. We do not knowingly operate accounts or behavioral profiles for children.

Changes

We may update this policy when BackYet or its processors change. The effective date above will identify the latest version.