Effective date: September 17, 2026 · Last updated: October 3, 2026
1. Who we are
TurnNet Labs LLC (“TurnNet,” “we,” “us”) operates ExpenseAll,
an expense tracking and expense-report service (website and mobile apps). Contact:
turnnetprotocol@proton.me.
2. Data we collect
Account data: your name, email address, role, and password (stored only as a secure hash), plus your company’s settings.
Receipts and photos: receipt images you take or upload.
Expense data: merchants, amounts, currencies, categories, dates, notes, attendees, projects, tax/GL codes, payment type (personal vs company card), report status and approvals.
Location: precise GPS location only while a mileage trip you start is running, plus start/end addresses you type for a trip. We do not track location in the background or at any other time.
Device data: a push-notification token for your device if you turn notifications on, and app preferences such as biometric unlock (the biometric check itself happens on your device; we never receive fingerprints or face data).
Billing (website only): Stripe customer and subscription identifiers. We never see or store full card numbers.
Technical logs: security and audit events (for example sign-ins and approvals) needed to run and protect the Service.
3. How we use data
Provide ExpenseAll: capture, reports, approvals, reminders, tax packets and exports
Keep accounts secure and prevent abuse
Billing and service emails (for example password resets, invites and reminders)
Legal compliance
We do not sell personal information and do not use your expense data for advertising.
4. Service providers we use
We share data only with these providers, and only as needed to run ExpenseAll:
Supabase — database and receipt file storage.
Vercel — website and API hosting.
Stripe — subscription billing on our website (the mobile apps do not take payments).
OpenAI — reading receipt photos to fill in the merchant, date and amount, only when receipt reading is used. The app asks before sending your first photo, and you can choose to type details yourself. OpenAI’s API terms state that API data is not used to train their models.
OpenStreetMap services (Nominatim and OSRM) or Mapbox — turning trip addresses into locations and calculating driving distance for mileage. Only the addresses or coordinates for that trip are sent.
Google Fonts — the website loads fonts from Google, which receives your IP address when fonts load.
Firebase Cloud Messaging (Google) and Apple Push Notification service — delivering push notifications, only if notifications are enabled.
Company owners and admins can export their company’s data (tax packets, accounting CSV files).
We may disclose information if required by law or to protect rights, safety, and the Service.
5. Retention and security
We keep account and expense data while the company account is active. Company expense and tax records
may be kept for up to 7 years where tax rules require, unless the company owner deletes them sooner.
Billing records are kept as required for accounting and tax law. Security logs are kept for up to 24 months.
When an account is deleted, sign-in data, sessions and push tokens are deleted right away; an owner’s deletion
also removes the company’s records and receipt files.
Data is encrypted in transit (HTTPS) and at rest by our providers. No system is 100% secure.
6. Customer (company) responsibility
The company that buys or administers ExpenseAll is responsible for its users, for lawful collection of
employee expense data, and for configuring policy, retention, and exports appropriately.
7. Your choices and requests
Delete your account in the app: sign in, open Account, and tap Delete my account.
If you can’t sign in, follow the steps on our Delete account page.
Contact turnnetprotocol@proton.me to request access,
correction, or deletion of specific data without closing your account.
Company owners/admins can often manage seats and data in-product.
Device permissions (camera, location, notifications) are controlled in your OS settings.
8. Children
ExpenseAll is a business product and is not directed to children under 16.
9. International transfers
We may process data in the United States and other countries where our providers operate.
If you require a specific data-processing agreement, contact us before purchasing enterprise use.
10. Changes
We may update this Privacy Policy by posting a revised version with a new “Last updated” date.
Material changes will be communicated when practical.