Penny
This is a draft that is still being reviewed before Penny launches. Items marked like this will be filled in before it takes effect.
Effective date: to be set at launch
Applies to: the Penny: Your Budgeting Pet app for iPhone ("Penny", "we", "us") and its home-screen widget.
Who we are: Daniel Yang, an individual developer. Legal entity and mailing address to be added before launch
Penny is a budgeting app where you log spending by chatting with a pet. We designed it to collect as little as possible. We don't sell your personal information, share it for advertising, show ads, or ask for your bank password, Social Security number or SIN, location or contacts.
Penny is offered only in the United States and Canada, and only to people 18 or older.
1. Information we collect
1.1 Information you give us
| What | Examples | Where it's kept |
|---|---|---|
| Money entries | Expenses (amount, currency, merchant, note, category, date, which account paid), income, monthly assignments and targets, budgets, savings goals, custom categories | On your iPhone. If you're signed in (including the automatic anonymous account), a copy is synced to our database. |
| Accounts you describe | Names, types (checking, savings, cash, credit card, other) and starting balances you type in. These are labels, not connections to your bank. | On your iPhone and synced |
| Chat messages | What you type or say to your pet, and the pet's replies | On your iPhone. If you let Penny's cloud helper read a message (see §2.2), that message is also stored on our servers for 90 days, then deleted automatically. Penny says this in the Details of the in-chat card where you choose, and in Settings → Privacy. |
| Things your pet remembers | Short notes such as your goals ("saving for Japan") and preferences | On your iPhone. Used by the on-device model on your iPhone, and sent with cloud helper messages so the pet stays consistent; not stored separately on our servers. You can view and delete them in Settings. |
| Pet and game data | Pet name, species, personality, coins, streaks, Pals, items, island and room | On your iPhone and synced |
| Onboarding answers | Confirmation that you're 18+, home currency (USD/CAD), region (US/CA), time zone | On your iPhone and synced |
| Age check | Where the law requires it (for example Texas, Utah or Louisiana), Penny asks Apple to confirm you're 18+ (Apple's Declared Age Range). Penny learns only yes or no, never your birthday or age range, and keeps only whether you're 18+, how it was confirmed (Apple or your own answer) and when. If you say you're under 18, your iPhone remembers that so setup stays closed. | On your iPhone |
| Privacy choices | Whether you allowed Penny's cloud helper (always, never, or not asked yet, and when you said yes), and whether you share usage events (§2.4) | On your iPhone. Change them any time in Settings → Privacy. |
| Friends (optional) | Your friend code, who you're friends with (and anyone you blocked), vibes you send and receive, Pal gifts you send and receive (sender, recipient, which Pal, whether it's shiny, when it was sent and when it was claimed), friend reports, and your island as data: pet name, species, growth stage, colour, flower, tree and Pal counts, and which days this week you logged. No amounts, merchants, chats or pictures; your friends' phones draw the island from these numbers. | On our servers, visible only to the friends you add. Removing a friend stops sharing; deleting your account deletes all of it. |
| Invite and creator codes | A friend code you share or redeem; a creator code you enter, which records which creator referred you (attribution) | On our servers, linked to your account ID. We don't tell creators who you are. |
| Moderation records | If an account breaks the Terms, we may pause it: its account ID, the reason and the date. A paused account can't add friends, send vibes or Pal gifts, or use the cloud helper. | On our servers, readable only by us. Deleted when we lift the pause or when the account is deleted. |
| Reply reports | When you report a pet reply: the message ID, the reason you picked, an optional note, and the reply's text only if you choose to include it | On our servers, so we can review and fix bad replies. |
1.2 Information collected automatically
- Account identifier. When you finish setup (not before), Penny creates an anonymous account with a random ID so your data can sync and be restored. Nothing about you is attached to it. If you leave during setup, nothing is created on our servers.
- Sign in with Apple (optional). If you sign in with Apple, we get a stable Apple user identifier. We don't request your name or email address.
- AI usage counters. How many cloud helper messages you sent per day, used to apply the free daily limit. Deleted after 60 days.
- Subscription status. Whether you have Premium, from which product, and when it expires. This comes from Apple through RevenueCat (§3). We never see your payment card.
- Safety referral counts. If a message suggests you may be in crisis, Penny shows crisis resources (988) and records a count with only the day and whether it came from your iPhone or our server. It contains no message text and no account identifier, and is kept 13 months for the yearly reports California SB 243 and Washington law require.
- Purchase consent record. When you start a purchase, we keep the paywall version, the exact price and renewal text shown, the product, the price and the time, as a record of what you agreed to. It's stored with our subscription provider RevenueCat (attached to your anonymous Penny ID), or only on your iPhone if RevenueCat isn't used. It's a legal record, so the "Share usage events" setting doesn't turn it off.
- Technical logs. Our hosting providers keep short-lived server logs (such as IP address, time, and which function was called) for security and debugging. We don't put chat text, receipt text or bank descriptions in our logs.
- Usage events (you can turn these off). Which setup screens you reached, which version of setup you saw (an A/B test), and milestones such as finishing setup, your first log, coming back on day 2 or 7, viewing the Premium screen, starting a trial and buying. Only event names and the setup version: never amounts, merchants, chat text or receipts. They're held on your iPhone until you finish setup and sent only if Share usage events is on. It's on by default in the US and off by default in Canada; change it in setup or Settings → Privacy. See §2.4.
- No advertising identifiers, no tracking. Penny doesn't use the IDFA, ask to track you, or include advertising or data-broker SDKs. Version 1.0 includes no third-party analytics SDK.
1.3 Information processed on your iPhone only
- Voice. When you hold the mic, Apple's speech recognition turns your voice into text on your device. We never receive audio.
- Receipts and screenshots. Text is read from the photo on your device. The image itself is never uploaded. Penny first looks for the total on your device (its own parser, then Apple's on-device model when available). If that fails, Penny asks in chat before sending the extracted text to its cloud helper, unless you already chose "Yes, always".
- Messages. Simple messages like "coffee 5.50" are understood by Penny's on-device parser. Trickier ones are understood on your iPhone by Apple's on-device model (Apple Intelligence, on iPhones that support it and have it turned on). Neither sends your message anywhere (your confirmed entries still sync, as above).
- Widget. The home-screen widget reads a small summary (pet, streak, month totals) that the app saves on your device.
1.4 Bank and card files you import
- CSV import. If you import a file exported from your bank, the file is read on your iPhone. The transactions become expenses and income in Penny and sync like any other entry. We don't keep the file.
- Bank connection (Canada, not yet available). We're preparing an optional, read-only connection through our provider Flinks. If you use it, you sign in to your bank inside Flinks' screen. We never see or store your bank username or password. We store a Flinks connection ID (readable only by our server) and the last 90 days of transactions you choose to import. Penny can't move money.
1.5 What we don't collect
Bank credentials, SSN/SIN or other government IDs, precise or coarse location, contacts, photos you don't choose to scan, health data, browsing history, advertising IDs.
2. How we use your information
2.1 To run Penny
- Save and sync your entries, plan, goals and pet across your devices, and restore them on a new phone if you sign in with Apple.
- Show your plan, reports, weekly recap, widget and seasonal events.
- Apply the free daily AI limit and unlock Premium features.
- Send the local notifications you allow (e.g. a streak reminder, or the reminder 3 days before a free trial ends, a renewal reminder about 35 days before a yearly plan renews, and a yearly reminder for monthly plans; if notifications are off, the same reminder appears as a message in Penny's chat). Notifications are scheduled on your device.
2.2 AI processing: on your iPhone first, the cloud helper only if you say yes
Penny's pet is an AI, not a person. Messages are understood on your iPhone: first by Penny's own parser, then, on iPhones with Apple Intelligence, by Apple's on-device model (Apple's Foundation Models framework). On-device processing doesn't send your message to us, to Anthropic or to Apple.
When a message is too tricky for your phone (for example a planning question like "can I afford concert tickets?", receipt text the phone couldn't read, or any message on an iPhone without Apple Intelligence), Penny asks in chat, at that moment, whether it may use its cloud helper, Anthropic's Claude. You can answer Yes, always, Just this once (only that message is sent), or No, keep it on my phone (nothing is sent, and Penny won't ask again). The card's Details link lists what is sent, and you can change your choice any time in Settings → Privacy → Cloud helper.
When you say yes, our server sends the following to Anthropic, which provides the Claude AI models:
- your message (and receipt text, if you scanned one);
- up to 7 earlier chat lines, your 20 most recent expenses (title, amount, category, date and an internal ID so the helper can fix one), the things your pet remembers (up to 30 notes), the names of your own categories (including card and goal envelopes), and your pet's name, species and personality;
- today's date, your time zone and your home currency.
Our server also receives your anonymous account ID with the message, to apply the daily limit; it isn't sent to Anthropic. The message and the pet's reply are kept on our server for up to 90 days, then deleted automatically. The in-chat card's Details list exactly these items.
Anthropic processes this only to return a reply and suggested entries to us. Under Anthropic's commercial terms, your messages are not used to train AI models. Anthropic may keep API data for a limited period for safety and abuse monitoring. Anything the AI suggests, on your iPhone or from the cloud helper, appears as a pending card, and nothing is saved until you confirm it.
Messages that look like a crisis, a romantic request, or a request for investment, credit or loan advice get a fixed safety reply on your iPhone (and again on our server) without being sent to any AI.
2.3 Safety, security and the law
Detecting crisis messages and pointing you to 988; preventing abuse (such as bypassing limits); keeping our systems secure; meeting legal obligations, including companion-chatbot reporting (counts only).
2.4 Improving Penny
We look at aggregate numbers (such as AI messages per day, error rates and subscription conversion) to fix bugs and improve features. We don't read your chats to do this, and we don't build advertising profiles.
If Share usage events is on, the usage events in §1.2 are stored in our database (Supabase) with your account ID, so we can compare versions of the setup screens and see whether people come back. They're stored once per event, can't be changed by the app, and are deleted with your account. Turning the setting off stops all new events; events from before you turned it off stay until you delete your account. Creator-code attribution (§1.1) lets us count how many people each creator referred and how many stayed or subscribed.
We don't use your information for advertising, sell it, or use it to make decisions with legal effects about you (such as credit). Penny doesn't provide financial advice.
3. How we share your information
We share personal information only with service providers that process it for us under contract, and only as needed:
| Provider | What they process | Why | Location |
|---|---|---|---|
| Supabase | Your account ID, synced entries, chat messages (90 days, cloud helper messages only), AI usage counts, subscription status, safety counts, Friends data (including Pal gifts), codes, reply and friend reports, moderation records, usage events (if on) | Database, sign-in, server functions | United States (us-east-2) |
| Anthropic | The cloud helper request described in §2.2, only after you say yes | Understanding messages and receipts, writing the pet's replies | United States |
| RevenueCat | Your Penny account ID, purchase and subscription events from Apple, device and app version info | Managing Premium subscriptions | United States |
| Apple | Sign in with Apple, App Store payments, on-device speech and text recognition, the on-device language model (runs on your iPhone; nothing is sent to Apple), notifications | Platform services (Apple's own privacy policy applies) | United States / your device |
| Flinks (Canada, when bank import launches) | Your bank sign-in (entered directly with Flinks) and account transactions | Read-only bank import | Canada |
We may also disclose information if the law requires it (for example a valid court order). We'll tell you unless we're legally barred from doing so. We may also share it to protect someone's safety, or as part of a merger or acquisition, in which case this policy continues to apply to your data.
We don't sell or "share" personal information as California law defines those terms (sharing for cross-context behavioral advertising), and we haven't done so in the past 12 months.
Cross-border transfers (Canada and Québec)
Our providers store and process data in the United States. Your information may be subject to US law and accessible to US authorities. Before transferring personal information of Québec residents outside Québec, we carry out a privacy impact assessment, as Law 25 requires. Assessment to be completed before launch
4. Your choices and rights
4.1 Controls in the app
- See and correct any entry, goal, category, account or memory directly in Penny.
- Forget memories: Settings → What your pet remembers → swipe to delete.
- Export: Settings → Export expenses (CSV). Free for everyone, always.
- Delete your account and data: Settings → Delete account and data. This deletes the data on your iPhone right away and asks our server to permanently delete your account and every related record. Deletion from our live systems is immediate; copies in backups are overwritten within 30 days. Deleting your account doesn't cancel a Premium subscription. Cancel it in iPhone Settings → Apple ID → Subscriptions.
- Cloud helper: Settings → Privacy → Cloud helper (Anthropic's Claude). Off means everything stays on your phone and nothing is sent to Anthropic.
- Usage events: Settings → Privacy → Share usage events.
- Use Penny without our servers: simple logging, planning and the pet all work offline. The cloud helper and Friends need our server.
- Notifications: turn them off in Penny or in iOS Settings.
- Microphone, camera, speech recognition: optional. Turn them off in iOS Settings at any time.
4.2 Automatic deletion
| Data | Deleted after |
|---|---|
| Chat messages on our servers | 90 days |
| Expenses you deleted (kept briefly so you can undo) | 30 days |
| Daily AI usage counters | 60 days |
| Vibes | 30 days |
| Everything linked to your account, after you delete it | Immediately from live systems; backups within 30 days |
| Safety referral counts | 13 months. Never linked to your account (day and source only). |
| Data on your iPhone | Until you delete it or delete the app |
4.3 Your privacy rights
Wherever you live in the US or Canada, you can ask us to access, correct, delete or port your personal information, or ask questions about how it's handled, by contacting us (§6). We'll respond within 30 days (45 days where California law allows an extension). We won't treat you differently for exercising your rights.
- California residents (CCPA/CPRA): you have the right to know, delete, correct and opt out of sale/sharing (we don't sell or share), and to limit use of sensitive personal information. We use only what's needed to provide Penny, so there's nothing to limit. Categories collected in the last 12 months: identifiers (account ID), commercial information (subscription status), financial information you enter, and user content (chat). These are described in §1 and come from you, your device and Apple/RevenueCat. Each is kept as described in §4.2 and used for the purposes in §2. You can use an authorized agent.
- Other US states with privacy laws (e.g. Virginia, Colorado, Connecticut, Texas, Oregon): you have similar rights to access, correct, delete and port your data, and to appeal our decision by replying to our response. If your appeal is denied, you can contact your state attorney general.
- Canada (PIPEDA): you can access and correct your information and withdraw consent: turn off the cloud helper or usage events in Settings → Privacy, or delete your account to withdraw all of it. You can complain to the Office of the Privacy Commissioner of Canada.
- Québec (Law 25): our person in charge of the protection of personal information is to be named before launch (contact in §6). Privacy-protective settings are the default, and Penny doesn't profile you or use location. You can ask for your computerized data in a structured, commonly used format (CSV export today). You can complain to the Commission d'accès à l'information du Québec.
4.4 Analytics
Version 1.0 has no third-party analytics SDK. Its only analytics are the first-party usage events in §1.2 and §2.4, which are off by default in Canada (opt-in), on by default in the US, and switchable in Settings → Privacy everywhere. If we add a third-party analytics provider later, it will follow the same setting, never include chat text, receipt text, merchant names or amounts, and we'll update this policy and the App Store privacy labels before it ships.
5. Data security
- Encryption in transit (HTTPS/TLS) and at rest (our database provider encrypts stored data). On your iPhone, Penny's data is protected by iOS data protection when your phone is locked.
- Row-level security: every table in our database is locked so an account can only read its own rows. Server-only tables (safety counts, bank connection IDs) can't be read by any app user.
- Secrets stay on the server. The app never holds our AI provider key. AI suggestions are checked twice (on our server and in the app) before anything changes your data, and the AI can only touch your own records.
- Least data: voice, receipt images and simple messages are processed on your device. No bank passwords, government IDs or location.
- Breaches: we keep a register of privacy incidents. If an incident creates a real risk of significant harm, we'll notify affected users and the relevant regulators (OPC, CAI Québec, US state authorities) as the law requires.
No system is perfectly secure. Keep your iPhone protected with a passcode and Face ID.
6. Contact us
Questions, requests or complaints about privacy:
- Email: support@domain coming before launch
- Mail: address to be added before launch
- Privacy officer / person in charge of the protection of personal information (Québec): to be named before launch
We'll verify requests by asking you to send them from inside the app or to confirm details only the account holder would know, because we don't collect your email address.
7. Children
Penny is for adults 18 and older. Before you start, the app asks you to confirm you're 18 or older. We don't knowingly collect information from anyone under 18. If you believe a minor is using Penny, contact us and we'll delete the account.
8. AI companion disclosures
- Your pet is an artificial intelligence, not a person, and Penny says so during setup, in Settings, whenever you ask, and with a reminder in chat at least every 3 hours.
- It isn't a therapist or financial, tax, legal or investment advisor.
- If you mention self-harm or suicide, Penny shows crisis resources (call or text 988 in the US and Canada; text HOME to 741741 in the US; in Canada you can also text 686868 for Kids Help Phone; call 911 in an emergency) and records only that a referral happened.
- Companion chatbots may not be suitable for some minors.
9. Changes to this policy
We'll post updates here and change the effective date. For material changes (such as a new type of data or a new provider that receives chat text), we'll tell you in the app before the change applies.