YET

Each amount, date and reference is stored with the characters it was read from and their position in the page text. Tapping a fact scrolls the original to that line and washes colour behind those exact characters, using rectangles recorded once while the page was read, so no recognition runs while your finger is down. Where nothing was stored there is no tap offered, rather than a tap that does nothing.

The highlight is proved by test and has not been seen on a phone yet, because the text recogniser does not start on the simulator.

The app and both its extensions contain no URLSession, no URLRequest, no web view and no connection of any kind, so there is no route for a picture, for the text read off it, or for a name or an amount found in that text. A test opens every Swift file of all three and fails the run if one of those words appears. The privacy manifest declares no collected data types, no tracking and no tracking domains, and the archive is marked to stay out of iCloud backups.

The app asks for two permissions, the camera and Face ID, and holds no photo library permission at all, because picking a page runs outside the app and hands over only the file you chose.

Every invoice legally issued in Portugal carries the AT QR code, and YET reads the document out of the code rather than off the photograph. Portaria 195/2020 fixes what is in it: the issuer and buyer tax numbers, the document type, the date, the number, the ATCUD, the VAT base and amount at each rate, the total, stamp duty and tax withheld at source. Before a single money value is kept, two arithmetic identities have to close as whole cents with no tolerance.

Where the sums do not close, only the money is dropped. The issuer, the date, the ATCUD and the payment line survive, because those are what one document is matched to another by.

The entity, the reference and the amount are read together and checked against each other with the ISO 7064 MOD 97-10 arithmetic the reference carries: five entity digits, seven reference digits, and the amount in cents padded to eight, checked by the last two digits. Because the amount is inside the calculation, a reference that closes says all three belong to each other. Four printed layouts are read, including the block an ATM slip comes back as, where the recogniser read the labels down one side and the values down the other.

The check corroborates and never vetoes. Some large billers run their own reference scheme, so a pair that does not close is still kept, at a weaker rung, and can still be matched.

Seven matching rules are written, numbered and versioned, and every one of them ships in the band that asks. A rule is allowed to link on its own only after thirty hand-labelled correct pairs; the test corpus holds one for the Multibanco rule, one for the bank transfer rule and none for the rest, so today nothing is linked without somebody tapping. A test re-measures the corpus and fails if a count is raised without the fixtures behind it.

Answering writes a line on Today in an ordinary sentence with the quote underneath it, and undoing that line rejects the link, reopens the bill and puts its reminders back, all in one write.

Hold a fact and the app offers the other readings it found for that field first, then a keyboard, so somebody who can point at the right answer never has to type it. What a person types stands over every later automatic reading of that field, and every automatic writer asks permission before writing: the column, the fact, the party, the lifecycle and the record of what the app did. A biller's name typed by hand renames it on every screen.

The guard is a list of field names rather than one edited flag, so fixing a total does not freeze the date beside it. A typed name that folds to nothing, and an amount with letters beside it that name no currency, are refused before anything is written.

The reminder is set by reading the bill rather than by asking you to type a date, and its body is the bill's own due line with the amount beside it, so it is complete on a lock screen to somebody who never taps it. A bill collected by direct debit arms nothing and the screen says why. A document that prints its own expiry date warns at sixty, thirty and seven days, and again on the day, which is roughly what it takes to get an appointment at a Portuguese registry office.

Where notifications are refused, nothing is armed, nothing claims to have been armed, and Today says so in words. A switch in Settings replaces both lines with a pair naming no party, no amount and no date.

A tax number, a bank account and a social security number are recognised by their own arithmetic rather than by looking right. A NIF is nine digits whose ninth is computed from the first eight, behind the prefix blocks the tax authority actually issues, the 70 block included, which is what a landlord's rent receipt prints. An IBAN is checked the way the standard checks it: the first four characters move to the end, letters become digits, and the whole value modulo 97 must be 1.

Every amount is a whole number of cents and no floating-point value touches money anywhere in the app. 1.234,56 and 1,234.56 both read correctly, decided by the rightmost separator rather than by a locale setting.

Documents are gathered under one biller by tax number first, then bank account, then Multibanco entity code, then the folded name, rather than by the name printed on the page. One company prints its name three ways across a bill, a direct debit notice and a receipt, and all three carry the same tax number. Nothing is merged and nothing is deleted: a document that turns out to belong to a party already on the phone joins it.

The legal form is deliberately kept when a name is folded, because ÁGUAS DO VALE DO SADO, S.A. and ÁGUAS DO VALE DO SADO, E.M. are two different taxpayers.

A search field sits in the bar of all three screens, and a question typed into it can return one line quoted straight off one of your documents, with a sentence naming which document it came from. The line is characters from the page rather than a sentence the app wrote: the answer cannot be built at all unless that text is literally present in the stored page. Four printed things can answer: how much, when, how to pay, and the document's own number.

Where the best match does not clear the second by a set margin, or where the top two are the same biller and the same kind, nothing is answered and the ordinary result list stands. A search that matches nothing shows the closest documents you kept rather than the word none.

A page carrying a bank account, a personal identity number, a social security number or a date of birth sits behind a solid tile until the owner of the phone proves it is theirs. Solid rather than blurred, for three reasons: a blurred account number is still a shape and a length, blurs at usable radii can be undone, and a blur reads as a loading state. The tile shows no party, no amount, no date and no pixel of the page, which is never decoded on that branch.

On a bill, a document number and a tax number are ordinary and show. On an identity card the same numbers shield, because there the document number is the person.

Months shows one cycle at a time, with what is due, what still needs a total typed in, and what is settled. Each section carries a total labelled "Computed from N documents", and tapping the label lists exactly those N. A total that cannot be broken down does not render at all, so a section holding one bill nobody could price shows no figure rather than a figure that quietly leaves it out.

Two currencies are never added together: each gets its own line, its own list, and a sentence saying they are kept apart.

Everything ever kept sits in one grid, newest first, cut into months, with each tile cropped to the part of the page that was actually read. There is nothing to file, so nothing can be filed wrong: you look by biller, by year or by kind, and the same document answers to all three at once without belonging to any of them. Correcting who a bill is from moves it on the next read, with no membership to update.

It shows six months and adds six more on a tap, and then it ends and says so. A view with nothing behind it is not offered at all.

Any document becomes a PDF laid out for the paper it will come out on. An identity card prints at 85.60 by 53.98 millimetres, which is ISO/IEC 7810 ID-1, and a passport data page at 125 by 88 millimetres, with both faces on one A4 sheet, which is how an office asks for it. Which layout to use is decided by measuring the page's proportions rather than by matching words on it, so a licence printed abroad comes out at life size too.

A sheet fills the paper corner to corner with no margin. A page that is genuinely some other shape, a till receipt for instance, is fitted and the space left, and nothing is ever stretched.

One control writes a zip holding every page image, a readable index, a spreadsheet of every table, and the complete data as JSON with money as whole cents. Every file is named after the SHA-256 of its own bytes, so anybody can run shasum on a file in the folder and read the first half of its own name back, and a manifest says which document each file is a page of. The list of tables comes from the database's own catalogue, so a table added in a later version is in the export the day it exists.

It is free on every plan, and anything the export could not do is written into a problems file rather than passed over.

One control empties every table in a single write, then reclaims the freed pages so they do not keep the text they held, then asks the file and the container again. Anything still holding a row or still sitting on disk comes back by name, and the screen says some of it is still here instead of dismissing. A single document can also be thrown away from its own sheet, immediately, with no bin and no way back except photographing the paper again.

The search index is emptied through its own table rather than through the private tables it keeps beside it, which is what once left an erase looking finished with every document still on the phone.