Privacy and how it works

txfacts collects facts about businesses as they appear on statements. It is built so that it cannot learn about the people whose statements they are.

What never reaches the server

• Amounts, dates, account numbers, balances, your own categories, notes or whether something was a business expense.
• Card numbers, personal identity numbers, phone numbers, email addresses, and transfers between people (Swish, bank transfers). Apps scrub these on your device with the open @txfacts/normalize library, and the server scrubs every text again and refuses anything that changes.
• Texts that might be a person's name are only sent when you have looked at them and said they are not. Apps can also ask about a text by a short prefix of its hash, so the server never sees it at all.

What the server keeps

• The scrubbed text and the facts about it: merchant, payment provider, category, merchant category code.
• Votes, as anonymous tags that are only comparable within one claim. Two votes by the same person on two different texts cannot be connected, and no vote can be connected to the key that cast it.
• Dates only to the day or month. Counts on pages are shown in ranges (1-2, 3-9, 10+).

What the server does not keep

• No request logs, IP addresses or browser details. Rate limits use a hash of the address with a salt that lives in memory and changes daily.
• No accounts, cookies or analytics. Write access uses anonymous keys that cost a few seconds of computing to make, instead of a sign-up.

When does a text get a page?

Only when it clearly belongs to a known business, or when at least 3 different contributors have seen it. Anything that looks like a person's name is blocked. Everything else is only available to apps that already have the same text.

Where the facts come from

People using apps that contribute, brand names from the Name Suggestion Index (BSD-3-Clause), and, for texts nobody has explained yet, a language model whose guesses count for least and are easily outvoted.

A few curator keys, held by whoever runs the service, count for more than a single person, so the database is useful before many people use it. Their claims are shown like anyone else's, and several people agreeing still outweigh one.

Licences

Data: CC0, except names imported from the Name Suggestion Index. Server code: AGPL-3.0. The scrubbing library: MIT.