Last updated 3 October 2026
Talono keeps your receipts. They live on your device and in your own iCloud, and it is built so that we cannot read them.
The short version. Your receipts never reach a Talono server. A receipt photo leaves your device only when you ask the AI reader to read it, when your own iCloud syncs it, when you keep a copy in a cloud drive you chose, or when you share a bill with friends in Slice. A Talono account is optional; it holds a profile so friends can find you, nothing about your receipts. The app has no analytics, no advertising and no tracking.
Talono is made by Islam Eltokhy, its developer, who is the data controller for the little that Talono holds. Write to privacy@talono.uk.
Receipts, their photos, line items, categories, warranties, return dates and notes are saved in a database on your device.
That database is mirrored to the private area of your personal iCloud account so your other devices see the same receipts. We are not a party to it: we cannot query it, export it, or see that it exists. Apple's handling of it is covered by Apple's Privacy Policy.
If you choose to keep an extra copy of each receipt in iCloud Drive, Google Drive, Dropbox or OneDrive, Talono uploads the photo into your own account with that service after you sign in to it. The sign-in token stays in your device's keychain, and you can disconnect in Settings at any time.
Deleting the app removes the local copy. To remove the iCloud copy as well, delete Talono's data from iOS Settings ▸ your name ▸ iCloud ▸ Saved to iCloud.
When you scan a receipt, the photo (cropped to the paper) and your country setting are sent to Talono's scan service, which passes them to Anthropic's Claude API on Talono's business account and returns the structured answer: shop, date, lines, total, tax and categories. Paid API traffic is not used to train models, and Anthropic handles it under its commercial terms.
The scan service exists to keep the AI key off your phone and to count scans honestly. It does not store the photo or the answer. It keeps a log line per read, with a device identifier, the time, the model, whether the read succeeded, how large the request and answer were, and how long it took, for 90 days, to spot abuse and problems.
A receipt can show part of a card number or a loyalty number. If you would rather nothing left the device, type the receipt in by hand; every field can be entered without a scan.
The first time the app needs the scan service, it registers the device with a random identifier and a secret that stays in the keychain, proven genuine with Apple's DeviceCheck. The service keeps the identifier, a hash of the secret, when the device was first and last seen and how many scans it made today. It also counts registrations per internet address per day. This is what stops a stolen key or a script from using the service; it is not tied to your name unless you create an account.
You can use everything in Talono without an account. An account exists so friends can find you, so you can earn free scans by inviting people, and so Slice can notify you. It is created with Sign in with Apple, and we store:
When you pick contacts to invite, the app sends salted hashes of their email addresses or numbers to check who is already on Talono. The hashes are matched and discarded, not stored. Talono uses the system contact picker, which gives it only the contact you pick, never your whole address book.
When a friend you invited subscribes, the app sends the Apple-signed receipt of that purchase to the scan service so the free scans can be credited. It shows the product and the transaction number, never a card or a billing address.
You can delete your account in Settings ▸ Account ▸ Delete account. It removes the profile, username, avatar, hashes, invite code and balance, and signs out every device. The read log and device records above are not linked to it.
When you share a receipt in Slice, it is shared through iCloud with the people you invite, and only with them. Each person sees the receipt's items, who took which item, and each share of the total. The shared copy lives in your iCloud and in theirs; Talono does not see it. You can stop sharing, or remove a person, at any time, and a person can leave.
So that a friend hears about a bill, Talono stores a short notice in its CloudKit database: who invited them, the bill's name and total, and the share link. Signed-in Talono users also leave a presence record with their app version and when they were last seen, so the app knows an invitation can be delivered in Talono rather than by message. Both are held by Apple's iCloud, not on a Talono server.
If the app crashes or hangs, iOS prepares a diagnostic report (stack traces, the app build and device model, no receipt content and no identifiers of yours) and Talono sends it to the scan service, where it is kept for 30 days so the fault can be fixed. There is no other analytics or usage reporting.
| Permission | What it is for |
|---|---|
| Camera | Photographing receipts. |
| Notifications | Reminding you before a return window or a warranty ends, and telling you when a friend adds you to a bill. |
| Face ID | Opening Hidden receipts. The check happens in iOS; Talono is only told yes or no. |
| Photos | Choosing a receipt photo or an avatar uses Apple's picker, which gives Talono only the picture you pick. |
Talono can check for updated consumer-rights rules. That is a plain public file, and no information about you is sent with the request.
To show totals in your home currency, Talono downloads public exchange-rate tables from a free currency service (served through jsDelivr). A request names only a currency and a date.
Subscriptions and scan packs are handled entirely by Apple. We never see your card, your billing address, or your Apple Account. Apple tells the app which products you are entitled to, and nothing else. Your monthly scan count is kept on your device; free scans from invitations are kept with your account.
There are none. Talono contains no analytics or advertising code, does not use the Advertising Identifier, does not build a profile of you, and has nothing to sell or share.
The scan service runs on Cloudflare, with its database in the European Union. Your receipts are in Apple's iCloud. The AI reader is Anthropic's API.
Talono is not directed at children and does not knowingly collect information from them.
Your receipts are on your own device and in your own iCloud, so you already have direct access to all of them. Your account can be deleted from inside the app. If you are in a jurisdiction with statutory data rights and want a copy of, or a correction to, what the scan service holds about your device or account, write to privacy@talono.uk and we will answer within a month.
If this policy changes materially we will update the date at the top and note the change in the app's release notes.