Last updated: 21 July 2026
Bachat is operated by Morphera Labs (“we”, “us”, “the app”), based in Pakistan. Bachat helps you record the tax you pay on everyday spending and produce a year-end report for your tax consultant.
This document explains what data the app collects, why, who processes it, and what rights you have over it. It reflects what the app actually does — it is regenerated from the source code whenever the app’s data handling changes.
| Category | What exactly | Source | Why |
|---|---|---|---|
| Account details | Email address; authentication tokens | You, at sign-up | To create and secure your account |
| Profile details | Name and profile photo URL | Google Sign-In, if you use it | To show who is signed in |
| Financial records | Merchant name, amount paid, tax amount, date, category | You, when you add or scan an entry | The core function of the app |
| Receipt images | Photographs of receipts you scan or upload | Your camera or gallery, at your choice | Proof of tax paid, attached to a record and included in your report |
| Receipt integrity data | File name, upload time, SHA-256 checksum, a device identifier | Generated when a receipt is stored | So a receipt can be shown to be unaltered since upload |
| Subscription status | Purchase history, subscription state, an anonymous purchase ID | Google Play and RevenueCat | To unlock premium features you have paid for |
| Usage analytics | In-app events, device identifiers, IP address, and the approximate location derived from it | Automatic — you can switch this off | To understand which features are used and where the app fails |
| Crash diagnostics | Crash traces, device model, OS version, app build | Automatic, on a crash | To find and fix crashes |
| Push token | A notification token for this install | Automatic | To deliver reminders you have enabled |
We do not collect your precise GPS location, contacts, calendar, microphone audio, health data, or your CNIC/national identification number.
When you scan a receipt, the cropping, perspective correction and text recognition run entirely on your device using Google’s ML Kit. The receipt text is not sent anywhere for reading — only the resulting image is stored, and only if you save the entry.
We do not use your data for advertising, and we do not build advertising profiles.
We do not sell your personal data. We do not share it with third parties for their own purposes. The following services process data on our behalf as sub-processors:
| Service | Role | Their privacy policy |
|---|---|---|
| Supabase | Account authentication and database hosting | supabase.com/privacy |
| Amazon Web Services (S3) | Encrypted storage of your receipt images | aws.amazon.com/privacy |
| Google Play Billing | Payment processing for subscriptions | policies.google.com/privacy |
| RevenueCat | Subscription status management | revenuecat.com/privacy |
| Google Firebase | Usage analytics, crash reporting, push delivery | firebase.google.com/support/privacy |
| PostHog | Product analytics | posthog.com/privacy |
| Resend / Amazon SES | Delivery of transactional email | resend.com/legal/privacy-policy |
Payments are handled entirely by Google Play. We never see or store your card details.
Delete everything. In the app: Profile → Delete account. This permanently erases your account, every tax record, and every receipt image. Deletion is immediate and irreversible — we do not keep a copy, and there is no recovery window.
Turn off analytics. In the app: Settings → Analytics. Turning it off stops usage-event collection. Crash reporting continues, because it is what tells us the app is broken.
Export your data. In the app: Profile → Export all data produces a CSV of your records. For a copy of anything else we hold, email us.
Access, correct, or object. You can edit or delete any individual entry in the app. For anything else, email team@morpheralabs.com and we will respond within 30 days.
Withdraw consent. You can revoke camera and notification permissions at any time in Android Settings; the app continues to work without them, with the corresponding features disabled.
Your data is stored in the Asia-Pacific region on Supabase (database) and Amazon Web Services (receipt images).
No system is perfectly secure, but we design so that a failure in one place does not expose your records.
We keep your data for as long as your account exists. When you delete your account, your records and receipt images are erased immediately.
Anonymous, aggregated analytics that cannot be linked back to you may be retained for product analysis.
Bachat is a personal-finance tool intended for adults and is not directed at children under 13 (or the equivalent minimum age in your country). We do not knowingly collect personal data from children. If you believe a child has provided us data, email team@morpheralabs.com and we will delete it.
Bachat is available worldwide, and your data is stored in the Asia-Pacific region. If you use the app from outside that region — including from the European Economic Area or the United Kingdom — your data will be transferred and processed outside your home country.
Where such transfers are subject to European law, we rely on the European Commission’s Standard Contractual Clauses as implemented by our sub-processors, together with the technical safeguards described in Section 5.
| Purpose | Legal basis |
|---|---|
| Creating your account, storing your records, delivering the service | Performance of a contract (Art. 6(1)(b)) |
| Transactional email such as password resets | Performance of a contract (Art. 6(1)(b)) |
| Usage analytics | Your consent (Art. 6(1)(a)) — withdrawable in Settings |
| Crash diagnostics and security | Legitimate interests (Art. 6(1)(f)) |
| Subscription management | Performance of a contract (Art. 6(1)(b)) |
Your rights: access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. You may exercise these in the app, or by emailing team@morpheralabs.com. We respond within 30 days.
You also have the right to lodge a complaint with your national data protection authority.
In the twelve months preceding the date above, we collect the categories of personal information described in Section 1: identifiers, commercial information, internet activity, and — where you choose to upload receipts — the images you provide.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done so.
You have the right to know what we collect, to request deletion, to request correction, and not to be discriminated against for exercising these rights. Deletion is available immediately in the app under Profile → Delete account, or by emailing team@morpheralabs.com.
We will update this page when our practices change, and revise the “Last updated” date above. If a change materially affects how we handle your data, we will notify you in the app before it takes effect.
Privacy questions, data requests, or complaints:
Morphera Labs
Email: team@morpheralabs.com
Pakistan