What Béa keeps, and what only you can read.

When you create an account Béa stores your email address, and anything you choose to add to your profile: your name, your home city and the interests you tick. Signing in with Google or Apple shares only your email address and name with Béa — never your password.

Everything is stored in a private, encrypted-at-rest database. Each row is locked to your account, so no other user of Béa can read your data, and the app itself only ever queries as you.

Photos stay on your device until you pick them and confirm the upload. Béa asks for your agreement before every import unless you tell it to stop asking, and asks a second time before the selected photos are actually saved.

From each photo Béa reads the date it was taken and, if the photo carries it, the location recorded by your camera. That is used to name the city, place your pins and build your statistics. Nothing else is read from the image.

Photos are kept in private storage. They are shown to you through links that expire after an hour, so a copied link cannot be reused. Photos are never shared, never sold, never used to train anything, and never shown to another user. Delete a photo and both the file and its record are removed.

Receipt pictures and the amounts, shops, dates and notes you type alongside them are stored privately in your own account. Only you can see them, and the pictures are shown to you through links that expire after an hour.

Béa does not send your receipts anywhere. The spreadsheet download is built on your own device from your own records — where you send it afterwards is entirely your choice. Delete a receipt and both the picture and its record are gone.

Passports, visas, insurance and boarding passes are treated differently to everything else, because they are the most sensitive things you own.

When you add a document it is encrypted on your own device, in your browser, before anything leaves it — AES-256-GCM, with the key derived from your passcode using PBKDF2 at 210,000 iterations. Only the scrambled result is uploaded. Your passcode is never uploaded and never stored on our side, which means nobody at Béa, and nobody with access to the database, can read your documents. If you forget your passcode, those documents cannot be recovered by anyone, including us.

One honest caveat: if you turn on Face ID or fingerprint unlock, a copy of the key is kept in that device's local browser storage so it can open without typing. That is a convenience trade-off. For maximum security, use the passcode only.

Béa asks for your location only when you open Near or save a place with “I'm here now”. Before the first request you're told exactly what it's used for and you choose how long to share it for — just this once, an hour, the rest of the day, or until you turn it off. Your position is used on the spot to measure distances and is not stored as a history of where you have been. You can stop sharing at any time from the Near screen.

When you invite someone to a trip with a code, that person can see and edit that trip's itinerary and see when you are viewing it. They cannot see your photos, your recommendations, your notes or your document vault. Remove them and their access ends.

To turn a saved link or an address into a point on the map, Béa sends just that text or those coordinates to public map services (OpenStreetMap's geocoder, OSRM for directions, BigDataCloud for city lookup). Your identity is not sent with those requests.

You can edit or delete any photo, recommendation, note, trip or document at any time, and deletion is permanent rather than hidden. Ask us to close your account and everything attached to it is removed.

Béa does not sell data, does not run advertising and does not track you across the web.