Privacy policy

This Privacy Policy explains how MechCAD Software LLC (“MechCAD”, “we”, “us”) collects, uses and shares information. It covers our website (www.mechcad.net), the AceMoney desktop software (AceMoney Studio and AceMoney Classic), the AceMoney Receipts web app (https://receipts.acemoney.us), and the AceMoney Receipts apps for iOS and Android.

1. Information we collect

Personal information. You may give us your name, email address, phone number and mailing address. Payments on our website are processed by third-party payment providers (Stripe and PayPal); we do not store full payment card details. We also keep your account details, order history and messages you send to support.

Other information. Our website may collect usage patterns, device information and IP addresses, and uses cookies and similar technologies (section 7).

How we collect it. We collect it through forms, our online store, and automated tools.

AceMoney desktop software. Your financial data in the AceMoney desktop software is stored on your own computer. We do not collect it.

Purchases on our website. When you buy on our website, we keep a record of your order: what you bought, the amounts, taxes and currency, your email address and name, the country of your internet connection, of your billing address and of your card or PayPal account (to charge the right taxes and to prevent fraud), and your agreement to our terms, with, for an AceMoney Studio license, your request that it be delivered at once. If you accept analytics, we also keep your Google Analytics identifiers with the order for 30 days, to count the purchase. You buy AceMoney Cloud and the AceMoney Studio-Cloud Bundle signed in to your AceMoney account, and we link the purchase to that account. Stripe or PayPal handle the payment itself. We keep order records for 10 years, as tax rules require. If you ask us to erase your data, we remove your name, email address and any analytics identifiers from your orders and licenses, and keep only what those rules need, such as the amounts, the countries and a one-way code made from your email address.

Which campaign link brought you. If you reached our website through a link from one of our campaigns, the link’s labels (which network, which campaign) are kept on the order you place. They name the campaign, never you: we keep no identifier from the link, and nothing about it is stored in your browser.

Licenses. A license record holds the product, the license key (encrypted, with a one-way code to find it), the order it came from, the purchase email address and, if you link it, your AceMoney account. We email a license key only to the purchase address.

Founder prices for AceMoney Classic owners. When you verify an AceMoney Classic license on our website, we look up the license key and the e-mail address you enter in our order records. If they match, we e-mail a link to the address the license is registered to, and to no other. We keep one-way codes of the key and of the address, and the key's last four characters, for 7 days, so we send at most one link a day. If you buy with the link, the key's one-way code and last four characters stay with your order, to record that the founder price was used.

Activating AceMoney Studio. When you activate AceMoney Studio on a computer, the app sends us the license key, the purchase email address, a random identifier it created for that computer, the operating system, a device name (your Mac’s model name, a generic name, or a name you choose, never the computer’s network name) and a one-way code made from its hardware identifier with a secret that never leaves the computer; Studio needs it to activate, and your license then works on that computer only. To move it to another computer you activate again. We keep them as one of the license’s seats. After that, the app checks its license on your computer, so it keeps working offline.

When AceMoney Studio starts. If your copy is activated and your computer is online, the app checks in with us: it sends the credential it received when you activated, the one-way code for that computer if it has one, and the app’s version, and our server sees your IP address, as it does for any request. The check-in lets us tell the app when a license has been withdrawn, for example after a refund or because its key was published online for anyone to use. The app never waits for it and keeps working when it can’t reach us; if its license is withdrawn, it keeps working for 30 days before it returns to Studio Free. Studio Free, which isn’t activated, doesn’t check in. We keep check-ins for 30 days, with a one-way code made from your IP address instead of the address itself, and our server logs keep the address for up to 30 days too. After that we keep only a monthly count for each license, with no IP address and nothing that identifies a computer. We keep a license’s activation records while the license exists, and delete them 12 months after it ends, for example after a refund.

Online services AceMoney Studio uses. The app checks our update server (updates.mechcad.net) for new versions. If you sign in to AceMoney Studio with your AceMoney account, it uses Google Firebase to sign you in and to check what your account includes. It gets exchange rates from Frankfurter (api.frankfurter.app), sending only currency codes. If you track investments, it gets prices from the quote service you choose (Yahoo Finance unless you pick another), sending the symbols you ask about. Maps of mileage trips are drawn with OpenStreetMap’s map tiles. Like any web request, each of these shows the service your IP address.

Crash reports from AceMoney Studio. The app sends crash and error reports to Sentry only if you turn them on in its settings. They are off until you do. Sentry (Functional Software, Inc.) stores these reports in the United States and deletes them after 30 days.

AceMoney Classic’s license check. When AceMoney Classic checks its license with us, it sends the license details it holds, including the name the license is registered to, with the app’s version, its program file name and your computer’s name, and our server sees your IP address. We record these, with the time, to tell the app whether its license is valid. We keep the license record with its most recent 100 checks, including their IP addresses; older checks are deleted as new ones arrive. If you ask, we delete them, but a copy of AceMoney Classic that is still installed records them again at its next check.

2. AceMoney Receipts

This section describes the AceMoney Receipts apps and web app. Some features exist only in certain versions or plans; where that matters, we say so.

Receipt data. When you save a receipt, we store the merchant, amount, date, category, a photo of the receipt and, if you allow location access, the place where it was captured. This is stored in our cloud database and storage (Google Firebase). Today our servers can read this data. We are building end-to-end encryption for a future release; until it ships, treat receipts you store in the cloud as readable by our servers, as with any server application’s own database.

Mileage. If you use mileage tracking and allow location access, the app records the route and distance of your trips to create mileage records.

Reading your receipts.

• Free plan: receipts you scan are read on your device (Google ML Kit). They are not sent to our servers for automatic reading.
• Sharpen with Cloud: if on-device reading misses or misreads details on a saved receipt, you can choose to tap Sharpen with Cloud, up to 3 times a day on the free plan. Our servers then send that receipt’s image, and the details already read on your device, to Google’s Gemini AI (through Google Vertex AI) to fill in or correct them.
• Pro plan: receipt images you scan may be read by Google’s Gemini AI, either directly from the app (Google Firebase AI Logic) or through our servers (Google Vertex AI), to extract the merchant, amount and line items.

Email receipts.

• Version 2.0 and later (Pro): you get a personal receipt address. Email you forward or copy to that address is received by our email provider (Amazon Web Services) and read by our servers, using Google’s Gemini AI to recognize receipts and extract their details from attachments and email text. We never access your mailbox; only messages you send to that address reach us.
• Versions 1.0.x: if you chose to sign in with Google and turn on receipt import, the app used read-only Gmail access (the gmail.readonly scope) only to find receipt emails. Its use of that data complies with Google’s API Services User Data Policy, including the Limited Use requirements. Version 2.0 replaces it with email forwarding.

Voice commands (Pro). If you use voice commands, the app records your voice and sends the audio to our servers. Our servers send it to Google’s Speech-to-Text and Gemini (Google Vertex AI) services to understand the command. The app does not send your voice directly to Google.

Bill splitting. If you share a bill split, the people you share it with can see that split’s details and their share.

Crash and diagnostic reports. To find and fix bugs, the app can send technical crash and error reports (device model, operating-system and app version, and what happened) to Google Firebase Crashlytics and, from version 2.0, to Sentry. Sentry (Functional Software, Inc.) stores these reports in the United States and deletes them after 30 days. From version 2.0 this is off unless you turn it on in Settings, and you can turn it off again at any time. Versions 1.0.x send crash reports to Firebase Crashlytics automatically.

Advertising (free plan only). The free plan shows ads from Google AdMob. To show ads, measure them and prevent fraud, Google’s ads software collects your device’s advertising identifier, your IP address (which can indicate your approximate location), how you interact with ads and the app, and diagnostic information, and shares it with Google. Where the law requires it (for example in the EU, the UK and the EEA), you choose whether ads may be personalized when you first open the app, and you can change that choice in Settings. We do not ask for permission to track you across other companies’ apps and websites, and we do not use your data to do so. On Android you can reset or delete your advertising ID in your device settings. If you have any paid plan, you see no ads, and the ads software does not run.

Purchases. If you buy a subscription or an in-app purchase, Apple or Google processes the payment. Our subscription provider (RevenueCat) receives your purchase history and an account identifier to manage your subscription. A subscription bought on the web is sold through RevenueCat’s web billing, and Stripe processes the payment. We do not receive your full payment details.

Account, sign-in and notifications. We use Firebase Authentication, Sign in with Google, Sign in with Apple, Sign in with Microsoft and Firebase Cloud Messaging to run your account and send notifications. Firebase App Check helps confirm that requests come from our genuine app.

The web app. AceMoney Receipts on the web (receipts.acemoney.us) is meant for desktop and laptop computers. Receipts and images you add there are stored in the same cloud database and storage as in the app. On the Pro plan, our servers may read a receipt image you upload, using Google Vertex AI, to fill in missing details. On the free plan, images you upload on the web are not read automatically.

Android backup. On Android, your phone’s built-in backup includes the app’s data on your device, your receipts included. The backup goes to your own Google account, is encrypted with your device’s screen-lock PIN, pattern or password, and is managed by Google, not by us. You can turn it off in your phone’s backup settings.

How long we keep it, and deleting it. We keep your receipts, images and account data until you delete them. You can delete any receipt in the app. Delete Account in the app’s Settings deletes your receipts, their images and your account from our cloud, and clears the app’s data on your device. Without the app, you can ask us by email: see Delete your AceMoney Receipts data. Crash reports, and data collected by Google’s ads software, are kept by those services under their own retention rules.

Who processes this data for us. Google (Firebase, Google Cloud, Vertex AI and Gemini, Speech-to-Text, ML Kit, Crashlytics, AdMob), Amazon Web Services (email receipt delivery), RevenueCat (subscriptions), Sentry (error reports, version 2.0 and later), and Apple and Google (app stores and purchases).

3. AceMoney Cloud

Sync. AceMoney Cloud syncs your data between your devices end to end encrypted: it’s encrypted on your device before it’s sent, with keys we don’t hold, so we store it but can’t read it.

Bank feeds. You connect a bank account through Plaid, our bank-feed provider. You sign in to your bank in Plaid’s window, and Plaid, not us, receives your bank sign-in details. Plaid gives us an access token for the connection, which stays on our servers, encrypted with a key held in Google Cloud’s key management service, and never reaches your devices. With it we fetch your new transactions, and we hold them only until your device picks them up. Plaid also handles this data under its own end-user privacy policy, which it shows you when you connect.

How long we keep it. If your AceMoney Cloud subscription ends, we keep your end-to-end-encrypted synced copy, including your Filing Cabinet, for 12 months and then delete it; we e-mail you a month before. We disconnect your bank connections when the subscription ends: we ask our bank-feed provider, Plaid, to remove them, and we delete their access tokens and any transactions not yet delivered to your devices.

4. How we use your information

We use it to:

• process and fulfil orders;
• deliver, activate and manage your licenses;
• provide our apps and services, including the Receipts features in section 2;
• give customer support;
• improve our website and apps;
• send marketing messages, with your consent;
• show ads on the free plan of AceMoney Receipts;
• meet legal obligations and prevent fraud.

5. Sharing your information

We share information:

• with service providers that work for us, including payment processors (Stripe, PayPal), email delivery (Amazon Web Services), hosting and security (Cloudflare, Google Cloud), analytics (Google Analytics, Cloudflare Web Analytics), support (Atlassian’s Jira Service Management, and IONOS for our mailboxes), bank connections for AceMoney Cloud (Plaid), and the processors named in section 2. The full list is on our sub-processors page;
• with Google, for advertising on the free plan of AceMoney Receipts, as described in section 2;
• when the law requires it, or to answer lawful requests from public authorities;
• in a merger, acquisition or sale of assets;
• with your consent.

We do not sell your personal information to third parties for their own marketing.

6. International data transfers

We are based in the United States, and our website and services are hosted in the United States. Google and our other providers may process your information in the United States and other countries, under their own standard contractual terms. Data protection laws there may differ from those where you live. Sentry, which receives crash reports, is certified under the EU-U.S. Data Privacy Framework and its UK Extension, and our agreement with Sentry includes the European Commission’s standard contractual clauses as a fallback.

7. Cookies and similar technologies

Our website uses:

• cookies and similar technologies it needs to work;
• Google Analytics, with your permission where the law requires it. Visitors in the European Economic Area, the United Kingdom and Switzerland are asked first. Elsewhere you can decline at any time, and a Global Privacy Control signal from your browser counts as declining. Google Analytics data is also kept in our own Google Cloud project (BigQuery).

It uses no advertising cookies. Our cookies page lists them all, and lets you change your choice.

You can manage cookies in your browser settings.

8. Data security

We use reasonable security measures, including encryption in transit (SSL/TLS) and secure servers. No method of transmission over the internet or of storage is 100% secure.

9. Your rights and choices

Depending on where you live (for example under the GDPR or the CCPA), you may have the right to:

• access a copy of your personal information;
• correct inaccurate information;
• delete your data. In AceMoney Receipts, Delete Account in Settings does this directly; for purchases on our website, we erase it as section 1 describes;
• opt out of marketing messages and non-essential cookies (our website also treats a Global Privacy Control signal as an opt-out);
• change your advertising-personalization choice in AceMoney Receipts’ Settings, where offered.

To exercise these rights, email support@mechcad.net, or write to us through support.mechcad.net (opens in a new tab).

10. Children’s privacy

Our website, software and apps are not intended for children under 13 (or under 16 where the law sets that age). We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this policy. When we make material changes, we will post the new version here with a new effective date. Continuing to use our website, software or apps after a change means you accept it.

12. Contact us

For questions about this policy, email support@mechcad.net, or write to us through support.mechcad.net (opens in a new tab). Our address: MechCAD Software LLC, 14531 Gainesborough Dr, Orlando, FL 32826, United States.

This policy is governed by the laws of the State of Florida.