Privacy Policy

1. At a glance

• No account and no bank login. We never see your name, email or bank details.
• Your spends, places, categories and settings are stored on your iPhone and synced through your private iCloud database. We cannot read them.
• Only when you import a bank statement whose layout Pennypot doesn't know yet, and only after you agree, the app sends the statement's column names and a few scrambled sample lines to our server, which asks an AI model what each column means. Real amounts and shop names are not sent.
• No ads, no analytics, no tracking across apps or websites.

2. On your devices and in iCloud

Pennypot stores what you add to it: spends (amount, date, place or category, and where the spend came from: statement, Apple Pay or typed by hand), which places count as little extras, categories, your usual amount for extras, your Worth it / Regret marks and your settings (including which categories you show on the home screen).

This data is kept in the app's storage on your iPhone and synced with Apple's CloudKit to the private database of your iCloud account, so it can reach your other devices signed in to the same Apple Account. Only your Apple Account can read that database; we have no access to it. If iCloud is off, the data stays on your iPhone only.

Widgets, the Live Activity and the Apple Watch app show a snapshot of your number and pot. The snapshot is shared between the app and its widgets on your iPhone and sent to your paired Apple Watch directly by iOS. It does not pass through our servers.

3. Bank statements

When you share or pick a CSV statement, Pennypot reads the file on your iPhone, finds your spends, and deletes its temporary copy of the file afterwards. The spends it finds are stored as described above.

To read a statement, Pennypot needs to know its layout: which column is the date, which is the amount, which is the shop. Layouts it has already learned are remembered on your iPhone and need nothing from the internet. For a layout it hasn't seen before, it asks for your permission first. If you say no, nothing is sent; you can pick another file or add spends yourself.

4. What reaches our server

With your permission, for a new statement layout only, the app sends one request to our server at cashful.anapps.store (we share it with our other apps). The request contains:

• The header line with the column names, as in the file.
• A few sample lines (up to about 20), scrambled on your iPhone before sending: every digit is replaced with a random one, and every word longer than two letters is replaced with x's. Only dates, currency codes, month names and the words debit and credit are left as they are, because the layout can't be read without them. Your real amounts and shop names never leave the device.
• A random installation ID (X-Device-ID), created by the app on first use. It is not your device's advertising or vendor identifier and it is not linked to you. The server uses it to limit how many requests one installation can make and to remember, for up to 24 hours, that this installation passed Apple's App Attest check.
• Security signatures: an HMAC signature that proves the request comes from the Pennypot app, and, when the server asks for it, an Apple App Attest assertion that proves it comes from a genuine copy of the app on a real Apple device.

Our server passes the header and the scrambled lines to an AI model through OpenRouter (currently Google's Gemini models), receives a description of the layout (which column is which, date and number format) and returns it to the app. The installation ID is not passed on. Our server does not store the lines it receives; it logs only how many lines a request had and how long they were. As on any web server, connection logs (IP address and time of the request) are kept for security and troubleshooting and then deleted.

You can withdraw your permission at any time: turn off Read bank files online in the Pennypot menu. The app then sends nothing to our server and asks again before the next new statement layout. Layouts it has already learned stay on your iPhone and keep working offline.

5. Apple Pay and Shortcuts

If you set up the Shortcuts automation, iOS passes the amount and merchant name of each Apple Pay payment to Pennypot on your iPhone, and Pennypot saves it as a spend. Pennypot has no access to Apple Wallet, your cards or your bank. You can turn the automation off at any time in the Shortcuts app.

6. Categories

To suggest a category for a place, Pennypot uses Apple's on-device language model (Apple Intelligence) where your iPhone supports it. This runs entirely on your iPhone; the place names are not sent anywhere.

7. Purchases

Pennypot has no in-app purchases and sends nothing to RevenueCat or any other purchase service.

8. Notifications

If you allow notifications, Pennypot schedules them on your iPhone (an evening note with what you kept today, a note when an Apple Pay spend arrives). They are created locally; we don't run a push notification service.

9. Ads, analytics, tracking

Pennypot shows no ads and contains no analytics or advertising SDKs. It does not use your advertising identifier, does not track you across other apps or websites, and does not sell or share your data. If you choose to share crash reports with developers in iOS Settings, Apple may pass us anonymous crash and performance reports; they contain no spends.

10. Keeping and deleting data

• Your spends stay until you delete them. Deleting a spend in the app removes it from your iPhone and from iCloud at the next sync.
• Everything at once: delete the app, then remove Pennypot's iCloud data in Settings → [your name] → iCloud → Manage Storage (deleting the app alone leaves the iCloud copy, as with every iOS app).
• Our server keeps no statement lines. The installation ID is held in memory for the rate limit (about a minute) and the App Attest check (up to 24 hours).

11. Children

Pennypot is meant for a general audience and is not directed at children under 13. It collects no personal information from anyone, children included.

12. Your rights

Depending on where you live (for example under the GDPR in the EU or the CCPA in California), you can ask to access, correct or delete personal data about you. Because we hold no account and no spends, we hold no personal data about you beyond the short-lived installation ID described in section 4; write to us and we will help. You can also complain to your local data protection authority.

13. Changes

If Pennypot starts handling data differently, we will update this page before that version is released and move the "Last updated" date forward. The current version is always at pennypot.anapps.store/privacy.

14. Contact

A&N Apps, the developer of Pennypot. Privacy questions and requests:

anapps.team@gmail.com