Privacy in the current beta

Last updated: 11 September 2026.

Who runs BillLighter

BillLighter is a Hammant Labs project operated by Jon Hammant. Contact jon@hammant.io about your information or this beta.

Try an audit without an account

The anonymous audit on the home page processes the bill entries and usage answers in your browser tab. Those entries are not sent to our server or an AI provider. Export the report to keep it; refreshing or closing the tab clears it.

Choose to save your audits

When account access is available and you choose to create a household, we store your sign-in identifier, household currency, consent record, normalised bill entries and usage answers. The pasted import text is processed to create your bill entries and is not retained. Saved audits stay in your account until you delete the audit or account. We use this information to provide the saved-audit service you request.

Reviewing provider support

Service names from manually entered saved bills also enter a private support review queue, together with a market hint from your household currency. Authorised operators can review those labels and counts of distinct households to decide which services to support. We do not copy bill amounts, usage answers or email and chat content into this queue. Labels may contain personal information if you enter it, so use service names without account numbers or personal details. An unrecognised label is not automatically published in the shared provider catalogue or sent to an AI model. Deleting the saved bill or account removes its queue entry and its contribution to future counts.

Import selected email files

You can choose downloaded .eml files to look for recurring bills. The files are read in your browser; we do not upload or retain the original messages, attachments, subjects, sender addresses or file names. Remote images and links in the messages are not opened. You review and select the provider name, amount, currency and billing period before saving those details to your household. Usage remains unknown and an imported bill is not independently verified savings. Email-file findings do not enter shared provider discovery, outcome learning or AI training. Clear the results or leave the page to discard the local review; saved bills use the account's normal export and deletion controls.

Free provider guides

A guide uses the bills you select and records your permission and disclosure choices. Including your current bill amount is optional. The guide is saved with your case and can be stopped or deleted with your account. It does not contact a provider, send data to an AI model, change your service or create a fee.

Sign-in and processors

Clerk provides email-code sign-in and processes your email address, verification and session information. BillLighter does not ask you to create a password. Railway hosts the website, saved data and background worker. These providers process ordinary connection and security information to operate their services and may process information outside your country under their applicable data protection terms. Their information is available at Clerk privacy and Railway privacy.

Negotiation walkthrough

If you try a saved example case, we store its fictional bills, case timeline, example offers and your approval decisions so you can leave and return. The walkthrough does not contact a real provider, use a provider password, submit data to an AI model or take a payment.

Optional learning from outcomes

The results page separates offers, approvals and savings verified against subsequent bills. You may explicitly choose to let your real results contribute to grouped provider estimates and reviewed negotiation improvements. This analytical record uses prices, terms, provider/product/country, outcomes and execution cost where known. It excludes raw emails, chats, names and account numbers. The source record remains linked to your household for access, withdrawal and deletion; it is not an anonymous source record. Grouped estimates require at least 20 distinct participating households and are internal in this beta. Fictional examples never qualify. Withdrawing excludes your results from future calculations, while previously reviewed strategy versions are not automatically reversed.

Optional Gmail private beta

Gmail access is invitation-only and requires approval in both Google and BillLighter. Your account page shows whether a connection is available to you. Beta fee codes do not grant Gmail access. Email-file import and manual audits are also available without a Gmail connection.

Invited testers can choose a one-off read-only scan of billing-related Gmail messages from the past 13 months, limited to 500 matching messages. Google handles your password and consent. An isolated service holds an encrypted short-lived access token, requests its revocation after the scan or disconnection, and removes it at expiry if revocation is delayed. We do not request ongoing offline access or save a refresh token. If a connection is interrupted, temporary Google access may remain until it expires; we retain a cleanup checkpoint for that period.

Message bodies are processed temporarily to detect recurring bills; attachments and remote images are not downloaded. We retain candidate provider names, sender domains, prices, billing periods, dates, message identifiers and reasons for review for up to 24 hours. Bodies and subjects are not saved unless you separately choose private previews before the scan. Email content is never sent to an AI model. Selected findings become saved household bills with minimal evidence references. Usage is unknown. Mailbox-derived information does not enter shared provider discovery or model-training datasets. Our use and transfer of Google data follows the Google Workspace API User Data and Developer Policy, including its Limited Use requirements.

Optional readable previews include a shortened subject, sender, date and message text. They are encrypted separately from Google access tokens, available only to the signed-in person who connected the mailbox, and expire with the findings after 24 hours. Previews contain no attachments, remote images or active email links. Saving the scan, disconnecting it or deleting your account removes its previews. Old scans are not fetched again to create previews without this additional consent. The original message remains in Gmail.

You can say whether a finding is a bill and, separately, whether you still pay for it. These review decisions expire with unconfirmed findings. If you choose “Remember for my future scans”, we retain your decisions and private matching fingerprints for up to 13 months, with at most 1,000 remembered decisions. Fingerprints are derived from the email reference and limited billing evidence; they contain no message text or subject. This data remains linked to your account. It is used only to suggest your previous classification when you review future scans, and cannot automatically confirm a charge or current use. Remembered reviews are included in your account export. You can forget them without deleting saved bills; disconnecting a scan removes its remembered reviews. We do not pool Gmail messages, previews or feedback to train a shared AI model.

While reviewing Gmail findings, you can open the source email directly in Gmail. The link includes the connected mailbox address and message identifier to select the right Google account. Gmail handles any sign-in needed to view it. Opening the link does not save or accept a bill.

Disconnecting a scan deletes its findings, previews, remembered reviews and the audit saved from it. You can also remove BillLighter access in your Google account permissions. Scan metadata and consent records remain until account deletion. Google authorisation state expires after ten minutes; access tokens ordinarily expire within one hour. Account deletion waits for token cleanup as well as identity and payment cleanup. Infrastructure backups age out separately.

Beta codes, provider accounts and payments

We store beta-code redemptions, access expiry and the price agreed for a run. Invitation codes are stored as cryptographic hashes. Live provider browsers, AI negotiations and charging are not enabled in this release. We do not sell your data or use bill entries to train a general AI model.

Export and deletion

Your account has export and deletion controls protected by fresh sign-in verification. Deleting your account removes active household bills, examples and approvals and starts deletion of your Clerk identity. A minimal deletion record and opaque sign-in identifier are retained to prevent an old session recreating the account and to track processor cleanup. Infrastructure backups and provider security logs may age out separately under the providers’ retention terms; we do not promise instantaneous removal from every backup.

Website requests

No session replay or behavioural analytics is installed. Authentication uses necessary cookies. Fonts are currently requested from Google Fonts, which receives ordinary network request information. Avoid putting personal details in URLs.

Your choices

You can use the anonymous audit, correct usage answers, export saved information, delete an audit or request account deletion. Contact us for access, correction or deletion help. You may also contact your local data protection authority, including the UK Information Commissioner’s Office.