Last updated: 13 October 2026
Stapel has no account, no server and no analytics. Your receipts, the recognised line items and the categories stay on your iPhone. We receive no data from you. The app connects to the App Store for buying Stapel Plus. If you set it up, the app also files PDFs into a folder you choose in the Files app, for example in iCloud Drive, or directly into your OneDrive if you connect your Microsoft account. That folder is yours, not ours.
nxtChange Consulting FlexCo Neugasse 9/1 8045 Graz, Austria Company register: FN 648962g, Regional Court for Civil Matters Graz VAT ID: ATU81922038 Contact: Karl Maier apps@nxtchange-consulting.com
The app stores on your iPhone:
This data lives only in the app’s protected storage on your device. It is not sent to us or to anyone else. If you delete a receipt, it is gone; if you delete the app, all receipts are gone. PDFs you filed into your cloud folder stay there.
Receipts can contain details about other people, such as the name of a tradesperson or a doctor, and bills from doctors or pharmacies say something about your health. You decide which receipts you photograph. The app processes them only on your device and passes nothing on.
If iCloud Backup is turned on on your iPhone, Apple backs up the app’s data together with the rest of your device. Apple’s privacy policy applies to that.
Stapel uses the camera only when you photograph a receipt, through the document scanner of iOS. The app takes no pictures in the background.
From your photo library the app receives only the pictures you tap in the iOS picker. It does not see the rest of the library. Location data that photos may contain is not carried into the PDF.
Files from the Files app, from Mail or from the share sheet of other apps are read only when you hand them to the app. What you send to Stapel through the share sheet is placed by the share extension into an inbox on your device; the app reads it the next time it opens and empties it.
The app reads the text of a receipt with the text recognition of iOS (Vision), on your iPhone. On iPhones with Apple Intelligence (iOS 26 or later), Apple’s on-device language model additionally helps to structure line items and total. Both happen without an internet connection. No image and no text leaves your device for this, not even to Apple.
With Stapel Plus you can choose a folder into which the app files receipts as PDFs. You choose it in the Files app of iOS; the folder can be in iCloud Drive, in OneDrive, in Google Drive or with another provider whose app you have installed. Stapel only writes into this folder and reads nothing from it. The file name follows a template you set in the app, for example from the receipt’s date, issuer, subject and total, such as “2026-10-12 Billa 47.80.pdf”.
What happens to the file in the folder is governed by the respective provider under its contract with you and its privacy policy: Apple for iCloud Drive (https://www.apple.com/legal/privacy/), Microsoft for OneDrive (https://privacy.microsoft.com), Google for Google Drive (https://policies.google.com/privacy). We have no influence on it and no access. You can remove the folder in the app at any time; the app then files nothing more.
Instead of using the Files app, you can connect your Microsoft account under More › Filing (“Sign in with Microsoft”). This is voluntary; the app works fully without a Microsoft account.
You sign in in a sign-in window from Microsoft (OAuth 2.0 with PKCE). You enter your password only at Microsoft; Stapel never sees it. Stapel asks for these permissions: reading and writing files in your OneDrive (Files.ReadWrite), the name and e-mail address of your account (User.Read) and lasting access, so that you do not have to sign in every time (offline_access).
For this, Stapel stores on your iPhone an access token and a refresh token in the iOS keychain, and the account name and the folder you choose as the target in the app’s settings.
Stapel uploads receipts as PDFs into this folder. The app also reads the list of your folders so that you can choose the target, and the name of your account to show it to you. Stapel reads no other files in your OneDrive.
The data goes directly from your iPhone to Microsoft (Microsoft Graph at graph.microsoft.com, sign-in at login.microsoftonline.com). We run no server for this and receive nothing, neither the sign-in data nor the receipts. Microsoft’s privacy statement applies to Microsoft’s processing: https://privacy.microsoft.com/privacystatement
You can disconnect at any time in the app by signing out under More › Filing. Stapel then deletes the tokens, the account name and the target folder from your iPhone. PDFs already in your OneDrive stay there. You revoke the permission itself at Microsoft: for a personal account at https://account.live.com/consent/Manage, for a work or school account at https://myapps.microsoft.com
The legal basis is the performance of the contract with you (Art. 6 (1) (b) GDPR), since you set up the filing yourself.
If you enter a warranty or a payment deadline for a receipt, the app offers to remind you in advance: 30 days before the warranty ends, 3 days before payment is due. iOS schedules these reminders on your device; there is no server sending them. The first time, iOS asks whether the app may show notifications. You can turn them off at any time under iPhone Settings › Notifications › Stapel.
You buy Stapel Plus through the App Store. Apple handles the payment. We receive no payment details, no address and no name. The app only asks the App Store whether a valid subscription belongs to your Apple Account and remembers the answer on your device. Apple’s privacy policy applies to Apple’s processing: https://www.apple.com/legal/privacy/
The legal basis is the performance of the contract with you (Art. 6 (1) (b) GDPR).
If you have allowed sharing analytics with app developers in the iOS Settings, Apple may pass anonymised crash reports of the app on to us. They contain technical details about the crash and the device, but nothing from your receipts. You control this under iPhone Settings › Privacy & Security › Analytics & Improvements.
This policy and the other texts about Stapel are hosted on GitHub Pages, a service of GitHub, Inc. (USA). When you open a page, GitHub processes technically necessary data such as your IP address in order to deliver it. We ourselves use no cookies, no analytics and no third-party scripts here. GitHub’s privacy statement applies to GitHub’s processing: https://docs.github.com/site-policy/privacy-policies/github-general-privacy-statement
The legal basis is our legitimate interest in keeping these texts available (Art. 6 (1) (f) GDPR).
Since we do not process any personal data of yours, there is nothing with us that we could disclose, correct or delete. You delete your data in the app yourself by removing receipts or deleting the app; PDFs in your cloud folder you delete there.
Should we ever process personal data, for example because you e-mail us, you have the rights under the GDPR: access, rectification, erasure, restriction, data portability and objection. We keep e-mails you send us for as long as answering them requires. Complaints can be lodged with the Austrian Data Protection Authority: https://www.dsb.gv.at
If the app changes in a way that affects this policy, we update it. The current version is always available at this address.