Official Policy

Privacy Policy — RigourLedger: Tax Records

1. Overview & Local-First Architectural Boundary

Rigour Consulting develops RigourLedger: Tax Records ("RigourLedger" or the "App") with a fundamental privacy-by-design architecture: your financial data belongs to you and remains on your physical personal device.

Crucial Architectural Boundary

Zero Rigour Financial Backend: Rigour Consulting operates no application servers, cloud databases, user-tracking infrastructure, or remote ledgers that receive, aggregate, monitor, or store your financial transactions, merchant names, receipt images, or bank statements. Financial records are stored in RigourLedger's encrypted local database. Receipt and document files are stored in the application's private sandboxed storage on your personal device.

Platform Store Services: When purchasing or managing a RigourLedger Pro subscription, your device communicates directly with the platform store (Google Play Billing on Android or Apple StoreKit on iOS) to process transactions, manage subscriptions, and verify licensing.

2. Information Processed Locally on Your Device

When you use RigourLedger, the App locally processes only the information you choose to enter or import:

  • Profile Details: Optional record-owner name, business or trading names, Australian Business Numbers (ABN) for sole-trader activities, and employer/activity names.
  • Expense & Tax Records: Transaction dates, merchant names, expenditure amounts, work/business-use apportionment percentages, and notes.
  • Receipt Images & Attachments: Photographs captured via the device camera or files selected via the native system document picker, stored in sandboxed internal storage.
  • Bank Statement Data: Transactions imported from user-selected bank CSV files for reconciliation.
  • Evidence Check Assessments: Completeness evaluations performed strictly on-device.

3. Tax File Numbers (TFN) Policy

RigourLedger does not request a Tax File Number (TFN) and does not provide a dedicated TFN field.

In accordance with Australian privacy guidance and the Privacy (Tax File Number) Rule 2015, users should never enter a Tax File Number into notes, merchant names, or free-text fields.

4. Device Permissions & On-Device Processing

RigourLedger requests only permissions strictly necessary for user-initiated actions:

  1. Camera (android.permission.CAMERA / iOS NSCameraUsageDescription):

    Requested only when you tap "Take Photo" to capture receipt evidence. Captured images are saved directly into the App's private internal storage (files/receipts/).

  2. On-Device Optical Character Recognition (OCR):

    Text recognition is executed on your physical device using on-device machine learning (Apple Vision framework on iOS; Google ML Kit on Android). On iOS, text recognition uses Apple's native Vision framework (VNRecognizeTextRequest) with zero third-party ML SDKs. On Android, Google ML Kit operates on-device. Receipt images and recognised financial text are processed locally and never transmitted to external OCR servers or Rigour Consulting.

    Pursuant to Google's official ML Kit Android Data Disclosure, the bundled Google ML Kit SDK on Android may transmit technical operational diagnostics (latency, API configuration, feature versions, error codes, event types) and device/installation identifiers (device model, OS version, per-installation app instance IDs) directly to Google for SDK stability and usage analytics. User financial records, receipt images, and recognised receipt text are never included.

  3. System Document & Photo Pickers:

    RigourLedger utilizes native Android Photo Picker and iOS Document Picker interfaces. The App does not request broad external storage access (READ_EXTERNAL_STORAGE and READ_MEDIA_IMAGES are intentionally omitted).

  4. Zero Location / Zero Advertising ID:

    The App requests no location permissions and omits the Google Advertising ID (AD_ID) permission.

5. Platform Billing & Subscription Metadata

Upgrades to RigourLedger Pro are processed directly by Google Play or Apple App Store:

  • What the Platform Processes: Google or Apple processes payment methods, account billing identities, and country tax settings under the Google Privacy Policy or Apple Privacy Policy.
  • What RigourLedger Receives: The App receives only store-returned licensing metadata necessary to verify Pro entitlement: for Google Play, product identifier rigourledger_pro_annual, purchase token, purchase state, and localized pricing; for Apple StoreKit, verified transaction status, product identifier, expiration date, and localized pricing.
  • Zero Payment Card Storage: Rigour Consulting never collects, receives, or stores credit card, debit card, or banking credentials.

6. On-Device Security & Encryption Architecture

RigourLedger incorporates local security and cryptographic safeguards on your physical device:

  1. SQLCipher Database Encryption: Local records are encrypted at rest with SQLCipher 256-bit AES in CBC mode (AES-256-CBC) with per-page HMAC-SHA512 integrity verification and PBKDF2 key derivation.
  2. System Key Storage: Master encryption keys and user PIN credentials are protected by the Android Keystore (with hardware backing where supported) or Apple Keychain (configured with kSecAttrAccessibleWhenUnlockedThisDeviceOnly). Cached Pro subscription entitlement metadata is signed with HMAC-SHA256 anchored to the local Keystore or Keychain.
  3. Encrypted Backup Container (.rlbackup): Backups are encrypted using AES-256-GCM authenticated encryption with a user-supplied passphrase, unique 96-bit random IV, authenticated additional data (AAD) header, and PBKDF2-HMAC-SHA256 (600,000 iterations).

7. Data Exports & Operating System Backups

Financial records, receipts, and user documents leave the App's private local sandboxed storage only through deliberate user action or standard operating system backup mechanisms:

  • Operating System Cloud Backups: Depending on your personal device settings, standard operating system backup mechanisms (such as Apple iCloud Backup on iOS or Google Android Backup) may include the application's private sandboxed data within your personal cloud account backup. You can manage or disable app-specific cloud backups at any time within your device's operating system settings.
  • User-Initiated Exports: Data leaves the application when you explicitly export records:
    • Standard CSV Export: Free, plain CSV export of financial-year records.
    • Accountant Pack (Pro): Encapsulated ZIP bundle containing CSV ledgers, receipt images, executive summary PDF, and SHA-256 integrity manifest.
    • Encrypted Backup (Pro): Password-protected .rlbackup archive.

    You choose the destination (email, local folder, private cloud storage) via the operating system sharesheet. The subsequent transmission and storage of exported files are governed by the privacy policy of the destination service provider you choose.

8. Third-Party Analytics, Vendor SDK Communications & Tracking

Zero first-party analytics, advertising and user-tracking SDKs:

  • No Google Analytics / Firebase Analytics
  • No Meta / Facebook SDK
  • No Mixpanel, Segment, or Amplitude
  • No remote crash-reporting SDKs (e.g., Crashlytics, Sentry)

Disclosed vendor/platform communications:

  • Google ML Kit (Android): Bundled text recognition processes receipt images 100% locally on-device. Operational telemetry (technical diagnostics and device/instance identifiers) may be transmitted directly to Google by the SDK for performance and stability monitoring pursuant to Google's official ML Kit Android Data Disclosure. Zero receipt images or recognised text are transmitted.
  • Apple Vision (iOS): Native Apple Vision framework executes entirely on-device with zero third-party ML SDKs. It transmits no receipt images or financial data to external servers.
  • Google Play Billing & Apple StoreKit: Communicates directly with Google Play or Apple App Store servers to process subscriptions, validate purchases, and maintain entitlement states.
  • Developer-Received Information: Rigour Consulting operates no central user databases or application telemetry services. Voluntary communications (such as support emails or technical error inquiries sent to rigour.consulting@gmail.com) are the only user information Rigour Consulting directly receives from users. Standard platform developer consoles (Google Play Console and Apple App Store Connect) provide developers with aggregate, anonymised download counts, crash reports (where users have opted in to share diagnostics with developers), and financial settlement reports in accordance with each platform's developer terms.
  • Static Portal Hosting: This public legal and support portal is statically hosted via GitHub Pages with zero external CDN dependencies, zero tracking cookies, zero analytics scripts, and zero third-party fonts.

9. Data Retention, Sovereign Deletion & Privacy Principles

  • Data Sovereignty: Because records reside exclusively on your phone, you have complete sovereignty over retention and deletion.
  • Local Deletion: You can permanently erase all local records at any time via Settings > Data Management > Reset / Delete Local Data, or by uninstalling the application.
  • App Uninstallation: Uninstalling RigourLedger through Android or iOS Settings removes the application-internal database, files, and sandboxed storage.
  • Subscription Notice: Deleting local application data or uninstalling the app does not cancel an active Google Play or Apple App Store subscription. Subscriptions must be managed directly in the platform store settings.
  • Privacy Alignment: RigourLedger is designed to align with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) and international data protection standards through data minimization, purpose limitation, and sovereign user control.

10. Contact Information & Governing Law

For questions regarding this Privacy Policy or technical data practices: