Everything in your pocket.
Nothing on the internet.

Yes. There’s no Brightcard account and no server; the app makes no network requests to us. Your cards, balances and receipts live in the app on your iPhone and leave only when you explicitly share or export something.

Because everything is on-device, keep an encrypted backup. Brightcard can export a backup file only your key can open, and your key is safely held in your iCloud Keychain so your own Apple devices can restore it.

Yes, a Secure Transfer packages a card, group or whole wallet into an encrypted file plus a short code you share separately. It works across different Apple Accounts, with no server in between.

A group chat keeps everything, forever, on everyone’s phone and on a server. A collection asks for named fields instead of “send me a photo of your passport”, and each answer comes back encrypted to you under its own key, so a participant can withdraw and the key is destroyed, which makes their copy unreadable wherever it sits, including in your backups. You also set the date the whole thing is purged, and the app carries it out. There is still no server: a request travels as a file or a QR code, and so does the answer.

No. A request is only opened if it was signed by someone already saved in your Contacts and marked by you as an organiser who may ask, and it’s checked against the key on that saved contact, not the one travelling in the file, so their name can’t be borrowed. Anything else simply doesn’t open; there’s no fingerprint to squint at and no “trust this sender?” button, because judging a stranger in the moment is the step worth removing rather than decorating. Even once someone’s approved, nothing is granted by default: you agree item by item, you can cap what they may ever ask for, and turning them off stops future requests. What it can’t do is reach what they already hold, and the app says so rather than implying otherwise.

Yes. Brightcard Pro is a single $12.99 purchase: no subscription. Owning it unlocks Pro on every device signed in to your Apple Account.

No. Reading a receipt or a business card uses Apple’s on-device Vision framework. The image and the text it extracts never leave your iPhone, and a business-card photo isn’t even kept: it is read, offered to you to check, and discarded with the form.

No. Speech is turned into text by Apple’s on-device recogniser as you speak, and the audio is discarded: nothing is recorded, kept or transmitted, and only the text you end up with is saved. The one piece of network activity is iOS fetching that language’s recognition model the first time you use it; after that dictation works with no connection at all. Brightcard deliberately does not use the older speech API that can send audio to Apple’s servers, so where a language can’t be transcribed locally the button is simply absent.

You can, and it’s a record rather than a means of payment: Brightcard can’t pay for anything, talks to no bank and has no payment integration, so adding a card here doesn’t register it anywhere. The number is stored on your device behind your passkey, masked to the last four digits by default, and uncovering the number, the CVC or a secret detail, or copying the number, asks for Face ID, Touch ID or your passcode first, one at a time. It all re-hides when you leave the card or put the app away. Payment cards are excluded from the Apple Watch and from widgets, not switched off by default, excluded, because a number you can read over someone’s shoulder defeats the masking. The CVC field is optional: leave it blank and nothing is stored. If the card is contactless you can tap it to the phone to copy the number and expiry across instead of typing them, read-only, no bank contacted, nothing authorised, and the CVC can’t be obtained that way by anyone, because it isn’t on the chip in readable form. And as with everything else here, there’s no server to send it to.

Not the parts worth stealing. This is worth being precise about, because a lock screen and encryption are different promises. A passkey gate decides what an app draws, it stops a person holding your phone, but it doesn’t stop code. iOS unlocks an app’s container at first unlock and leaves it unlocked, so anything able to read that container, malware with a sandbox escape, a jailbreak, a backup pulled through a trusted computer, could read whatever sat there as ordinary text.

So the sensitive fields aren’t stored as text. Card numbers, security codes, PINs, note secrets, document scans and receipts are individually encrypted (AES-GCM), and the key lives in the keychain marked so it can only be read on this device, while it is unlocked, never in a backup, never on another phone. Plaintext exists only after you’ve actually authenticated. Pull the database off a jailbroken phone and what you get is ciphertext.

The limits, stated plainly: this protects the data at rest, not a device already compromised while you’re using it: no app can defend against that, and any that claims to is overselling. Names, colours and dates stay readable so lists can draw before anything is revealed. And we don’t detect or block jailbreaks; that’s a check that’s easily defeated. We simply assume the container can be read, and make sure that isn’t enough.

No, and that’s the whole design. The people in a split are names you write down, picked from the contacts you keep in Brightcard or typed in. Nobody is invited, notified or signed up, they don’t need the app, and no request goes anywhere. No money moves either: Brightcard can’t make or ask for a payment, so marking someone as settled up changes a note on your device and nothing in the world. What it does do is keep the lines the split was worked out from, so the person being asked for money can check the sum rather than trust a figure, and when the shares and the actual spend disagree, it says so instead of quietly absorbing the difference. Hand it over as a PDF with the receipts attached, and you pick which expenses go in before it leaves.

Nothing leaves your phone until you decide it does, there is no sync, no upload and no server to sync to, so an expense sits on the device until you personally act on it. Exporting is that act, and it’s deliberate every time: the app never exports on a schedule, in the background, or because a report reached some size. When you do ask for a PDF, it’s drawn on the device from the records you already hold and handed straight to the iOS share sheet, so where it goes is your choice, Mail, Messages, AirDrop, Files. It never passes through us, and we couldn’t read it if it did.

The export asks first which expenses to include, because a report usually holds the pharmacy and last month’s rent alongside the trip someone actually asked about; whether the page says who has settled up is a separate choice, made at the moment of sharing rather than stored on the record. Answering an expense request through Collections works the same way but stricter, every line starts unticked, and only what you tick, with the receipts belonging to it, is sent.

The honest part: a file you’ve sent is someone else’s copy, and no app can take it back. Everything else here can be undone, an item deleted, a reply shredded, but a PDF that has left cannot. That’s exactly why the app asks before it goes rather than after, and why the safe default is to send the least that answers the question.

It’s a place to keep notes and the odd secret alongside them, a Wi-Fi password, a door code, a licence key: not a managed password service. Secrets are stored on your device behind your passkey, with the same protection as your card numbers, and masked until you tap to reveal them. There’s no account, no sync service and no recovery: if you lose the device and your backup, the contents are gone.

Yes, Tickets are their own section, because a ticket isn’t a voucher: it happens at a date and time, at a venue, in a seat. One booking can hold a code per passenger or leg, each marked used on its own, and the whole ticket archives only once every code has been used.

Free covers 12 items across 2 wallets. Reaching the cap only stops you adding a new item, everything already in your wallet stays visible and fully usable. The same is true if you ever restore a backup that’s larger than the free tier.