Privacy policy
Effective September 15, 2026.
HSA Proof is made by Mount Si Labs LLC ("Mount Si Labs", "we"). This policy says what the HSA Proof iPhone app does with your information, where that information is, and who can read it. Every statement here describes something the app's code does; the consumer health data policy covers the same records under Washington's My Health My Data Act and similar laws.
What the app stores
You choose what to capture: photos or files of receipts, explanations of benefits, invoices and proof of payment, and the details you type or confirm for each one (provider, date of service, amount, a patient label, a category, notes). The app also stores, for each record, the text it read from the document, the eligibility category it matched and the version of the rules it used, your HSA establishment date and custodian if you enter them, any reimbursements you record, and an audit history of what changed and when. These records may include health information, such as a pharmacy or provider name or a prescription.
Where it is stored
On this iPhone, in the app's storage. This is the only place records exist unless you choose otherwise.
In your device backup. iCloud Backup or a computer backup of your iPhone includes the app's data. That is governed by your Apple backup settings, not by anything in the app, and it happens whether or not sync is on.
In your private iCloud database, only if you turn on "Sync with my private iCloud". Sync is off until you turn it on, during setup or later in Settings. With it on, records are also stored in your iCloud account so your other devices can see them. This counts against your iCloud storage.
Who can read it
Mount Si Labs cannot. The app makes no network request to Mount Si Labs and there is no Mount Si Labs server that receives records.
Apple can read synced records under standard iCloud data protection, which is the default for an Apple Account: Apple holds the encryption keys and can decrypt the data. If you turn on Advanced Data Protection for your Apple Account, your receipt and document files, provider and patient names, amounts, categories, notes, the text read from each document, document hashes, your custodian label and history details are end-to-end encrypted and Apple cannot read them. Dates, record identifiers, file types and sizes, your HSA establishment date and the eligibility rule version are not end-to-end encrypted. An iPhone still running a version before 1.1 saves details Apple can read until an updated iPhone on the same account syncs them. Advanced Data Protection is an Apple setting; the app cannot turn it on for you.
Turning sync off
Turning sync off stops future changes from going to iCloud. Records already in your iCloud database stay there until you delete them: use Delete all my data with sync on, or remove the app's data in iOS Settings under your name, iCloud, Manage Account Storage.
What Mount Si Labs receives
From the app: nothing. The app contains no analytics, advertising or crash-reporting code, has no account to create, and sends nothing to Mount Si Labs. The App Store privacy label "Data Not Collected" describes this. The items below are outside what that label covers.
If you email us. Writing to support@hsa-proof.com or privacy@hsa-proof.com gives us your address, your message and anything you attach. Please do not include receipts or medical details; we do not need them to help. Support and privacy email is kept for two years after the last message in the thread, then deleted.
If you visit hsa-proof.com. The site is served by Cloudflare. Cloudflare's servers see each request (your IP address, the page, your browser) and keep their standard logs under Cloudflare's own privacy policy. Mount Si Labs does not export, analyse or retain those logs. The site sets no cookies and loads no analytics or advertising scripts.
If you share diagnostics with Apple. If iOS is set to share diagnostics with app developers, Apple may give Mount Si Labs crash reports for the app. These contain technical information about the crash, not your records.
Your choices
Export. The Export tab creates a ZIP of the years you select: the documents, a CSV ledger, JSON files and SHA-256 hashes you can verify independently. The ZIP is not password-protected by the app and it contains the text extracted from your documents. A copy you save or send elsewhere is outside the app's deletion controls.
Delete everything. Settings → Delete all my data removes every expense, document, reimbursement and audit entry from this iPhone and, if sync is on, asks Apple to remove the copy in your iCloud database. The app tells you which of those two steps completed. If the iCloud step fails, for example because you are offline, you can try again or remove the data yourself in iOS Settings.
Delete one expense. Deleting an expense removes it and its documents. The audit history keeps the entries about it, including that it was deleted; those entries hold dates, hashes and, for reimbursements, amounts, but not the documents or their text.
Correct. Edit an expense to change its details. A reimbursement is never edited; a mistaken one is voided, and both the entry and the void stay in the history.
Sync. Turn it off at any time in Settings. See "Turning sync off" above for what stays in iCloud.
Because Mount Si Labs never holds your records, we cannot access, correct, export or delete them for you. The controls above are how those rights are exercised.
Retention
Records stay until you delete them. Files the app writes while building an export are removed the next time the app launches. Support and privacy email is kept as described above. Cloudflare's server logs are kept by Cloudflare under its retention policy, not by Mount Si Labs.
Health data
Medical receipts are consumer health data under Washington law. The consumer health data policy describes those records, the basis on which the app processes them, and how to exercise your rights, and is published at its own address.
Children
HSA Proof is not directed to children under 13.
Changes
We post changes at this address with a new effective date.