Privacy Policy

• Without an account, your ledger stays on your iPhone. The app sends us nothing.
• With Penny Diary Pro, your ledger is copied to our server so it can sync to your other devices and to the web app.
• For Penny Diary Pro, we keep a record of your App Store subscription, to give your account Pro and to prevent fraud. It holds no name, email address or payment details.
• No ads, no third-party analytics or tracking, and we never sell your data.
• You can export your ledger at any time, and delete your account from the iPhone app or the web.

Zhiheng Gan (“we”) offers Penny Diary and is responsible for the data this policy describes.

Penny Diary keeps your ledger in one of two ways, and you choose.

On your iPhone, with no account

The iPhone app works without an account. Your entries, adjustments, categories, repeating rules, saved reports, ledger currency and settings are stored only on your iPhone. They are never sent to us, and we have no way to see them. Without an account the app sends us nothing at all: no ledger, no identifiers and no usage data.

Synced, with Penny Diary Pro

Penny Diary Pro adds an account, a copy of your ledger on our server, sync across your devices and the web app. You turn it on from the iPhone app’s Settings, by subscribing and signing in. Your iPhone keeps the whole ledger and sends each change to our server as you make it, or as soon as it is back online. The web app reads and changes the same copy.

While your account has Pro, our server stores:

• Entries: each one’s amount, as entered and after any adjustments; its type (expense or income), date, category, title, note and currency; whether it was typed in, dictated, added by the Apple Pay automation, or written by a repeating schedule; and, for an Apple Pay automation entry, a merchant name kept apart from its title: the merchant name as Wallet gave it, cleaned of store numbers and cities, which stays the same when you rename the entry. For an entry you had already renamed before this was kept, it is the title you had given it.
• Adjustments to an entry, such as a refund or cashback: which entry, the amount, date and note, and whether it was deleted along with its entry.
• Categories: name, type, color, icon, place in the list, and whether it is built in and can be deleted.
• Repeating rules: type, amount, currency, category, title, note, schedule (how often it repeats, when it starts and when it ends), the date of the last entry it wrote, and whether the rule is paused.
• Saved reports: the name, and which kind of entries and which categories the report includes.
• One setting: the ledger currency.

Each of these also holds the ID of your account and, where it applies, an ID of its own and when it was created, last changed and deleted. An entry, adjustment, category, repeating rule or saved report last saved in the web app also holds a random code made for that save, so that a save delayed on its way can’t undo a newer one. The code says nothing about you, and the next change clears or replaces it. An entry your iPhone deleted before it had sent a change to it also holds a code made from the entry’s ID and the time your iPhone deleted it, so that the delete, sent again because its answer was lost, is known as the same one. That code stays with the entry until another such delete replaces it.

When the web app can’t confirm that a new entry, adjustment or repeating rule was saved, and then finds it wasn’t, our server keeps the ID the web app made for it, so that a save delayed on its way can’t add it after you were told it wasn’t saved. It also keeps the ID of an entry once it is deleted for good, whether you asked for that or 30 days have passed since you deleted it, so that such a save can’t bring it back, and so that an iPhone that was away when you deleted it takes the entry off rather than bringing it back, however long it was away. It keeps the ID of a repeating rule, and of an adjustment you deleted on its own, once the 30 days have passed too, for the same reason. With each, it keeps the ID of your account, when it kept it and, so that an entry you recovered on an iPhone in the meantime comes back, whether the 30 days had passed or you deleted it, and nothing else, until you delete your account.

If Pro ends, sync stops. Your iPhone keeps the whole ledger and goes on working, and the changes you make wait on it. A web app page that is open when Pro ends goes on saving your changes, and any repeating entries that come due, until it shows the Pro page: within a few minutes, once you close anything you are editing. Otherwise the copy on our server stays as it was until Pro returns or you delete your account.

On your iPhone, the ledger is a file in Penny Diary’s private storage. When iCloud Backup is on, or when you back up your iPhone to a computer, that backup includes the file, and restoring the backup restores your ledger.

Those backups are made and kept by Apple, or by your computer, under Apple’s terms, not by us. Penny Diary can’t read them, and they are not a Penny Diary backup or sync. Whether to back up is your choice, in your iPhone’s Settings. Deleting the app removes the file from your iPhone but not from backups already made.

For a copy of your own, export your ledger as a CSV file at any time.

You need an account only for Penny Diary Pro. You sign in with an account you already have, so Penny Diary has no passwords of its own.

• Sign in with Apple, in the iPhone app. Apple shares your email address with us, and your name if you choose to share it. If you choose Hide My Email, Apple gives us a private relay address that forwards to your inbox, and we never see your real address. Apple shares your name only the first time you sign in, and we store it with your account.
• Google, in the iPhone app and on the web. Google shares your email address, your name and a link to your profile picture with our sign-in service, which stores them with your account.

We use your email address to identify your account and to show you which account is signed in, and, masked, to tell whoever is signed in on the Apple Account that pays for your Penny Diary Pro subscription that your account uses it (see Penny Diary Pro and your subscription below). The iPhone app also shows your name in Settings, with your email address, for the same reason. Penny Diary does not use your name otherwise, or your picture. Signing in with Apple with the same verified email address as an existing Google sign-in opens that same account; with Hide My Email it creates a separate one.

Our sign-in service keeps your account’s ID, which is a random identifier, your email address, and when you signed up and last signed in. For each way you sign in, it also keeps the ID that Apple or Google uses for you, the email address it shared, whether that address is verified, and, from Apple, whether it is a private relay address. Apple’s ID for you is one it makes for our apps alone; Google’s is your Google Account’s ID.

To keep you signed in, the sign-in service gives your device a session token, which the iPhone app keeps in the iPhone’s keychain and the web app keeps in a cookie. With each session it keeps the IP address and the device or browser type the session is used from, until the session ends. Signing out ends it when your device reaches our server. If it doesn’t, for example because your device is offline, the app is closed first or you sign in again before then, the session can stay there until you delete your account, as can the session of a sign-in you cancel after it reached our server. Should that sign-in finish before or after you sign in again, the app signs out of whichever of the two sessions it no longer holds, and, if that sign-in finished last with a different account, of its session too: each ends, or stays, as when you sign out.

If you signed in with Apple, deleting your account in the iPhone app also asks Apple to revoke Penny Diary’s access to your Apple sign-in. If that can’t be done, for example because you deleted the account on the web, you can remove Penny Diary yourself in your iPhone’s Settings, under your name, Sign-In & Security, Sign in with Apple.

Penny Diary Pro is an auto-renewing subscription sold by the App Store. Apple takes the payment, so we never see your card, your billing details or your Apple Account.

When you subscribe in the app, the purchase carries your Penny Diary account’s ID, a random identifier with no name or email address in it, so that the App Store and our server know which account it is for. Apple then sends our server signed information about the subscription, and so does the app: after you buy, when it opens, when you sign in and when you restore purchases.

When the screen that offers the plans opens after you sign in to an account without Penny Diary Pro, and when you choose a plan, before the App Store asks you to pay, the app also sends our server the signed information of any Penny Diary Pro subscription already on your Apple Account, to ask whether another Penny Diary account holds it, since a subscription gives Pro to one account at a time. It asks again when you restore purchases. Asking changes no record.

If our record links that subscription to another Penny Diary account, which holds it until Apple tells us it ended, whether or not that account has Penny Diary Pro from it right now, our server answers with how that account is named, so the app can offer to move Penny Diary Pro to the account you’re signed in to: the first character of its email address, then *** and the address’s domain, such as j***@gmail.com, or only that it uses Hide My Email, or that it has no email address. So whoever is signed in on the Apple Account that pays for a subscription can see that much of the email address of the account that uses it. Our server answers only an app that sends the subscription’s information signed by Apple, which only a device signed in to that Apple Account has, and the answer is not kept. For a subscription it has no record of, it names no account, whichever account the subscription’s information says it was bought for.

If one of your account’s subscriptions may still charge you but gives no Penny Diary Pro, because our server hasn’t heard from Apple about it since its paid period ended, or because Apple is retrying a failed payment, our server asks Apple for that subscription’s current status, using Apple’s subscription ID: when you choose a plan, before the App Store asks you to pay and once you have paid; when you restore purchases from the screen that offers the plans; when you sign in on your iPhone and the app needs Penny Diary Pro to go on: before it moves the ledger on your iPhone into your account or replaces another account’s ledger on it, or when your iPhone has none of your account’s ledger yet; and when you choose Check again on the web app’s page for an account without Penny Diary Pro. It updates the record with the signed information Apple returns, as it would have if Apple had sent it. When Apple says the subscription has ended, or that Apple has no such subscription, it records the subscription as ended and not set to renew, and when Apple says it isn’t set to renew, it records that, each time with when Apple signed its answer, or, when Apple has no such subscription, when our server recorded that. If the record already holds information Apple signed at that time or later, it records one millisecond after Apple signed that information instead. It sends Apple nothing else.

For each App Store subscription, our server keeps this record:

Productproduct_id

Which plan it is: monthly or yearly.

Statusstatus

Active, in a billing grace period, in billing retry, expired, or refunded or revoked.

Environmentenvironment

Whether it is a real purchase, or a test purchase in Apple’s sandbox.

Renewal stateauto_renews

Whether it is set to renew, once Apple has said.

Apple’s subscription IDoriginal_transaction_id

Apple’s identifier for the subscription, the same across every renewal.

Apple’s transaction IDtransaction_id

Apple’s identifier for the subscription’s latest transaction.

Purchase datepurchased_at

When the latest transaction was bought or renewed.

Expiry dateexpires_at

When the paid period ends.

Grace period endgrace_period_expires_at

When a billing grace period ends, while Apple retries a failed payment.

Account it was bought forapp_account_token

The ID of the account the subscription’s latest transaction was bought for, as Apple’s signed information names it, or none, so that a purchase made for another account after the subscription ended goes to that account. After a move, it can name the account the subscription moved from, until a later transaction names another.

Holder codeholder_ref

A random code that changes whenever the subscription goes to another account, so that a move goes ahead only from the account the person confirmed. It says nothing about any account.

Signed datesigned_at

When Apple signed the latest information we have, including its answer that the subscription has ended or isn’t set to renew, or when our server recorded Apple’s answer that it has no such subscription, though never earlier than one millisecond after Apple signed the information before such an answer.

Record datescreated_at, updated_at

When our record was created and when it last changed.

The record holds no name, email address, payment details or Apple Account, and no account ID but those above.

With the record, our server keeps when it last asked Apple about the subscription and whether Apple answered, including whether the answer could be used and whether it said the subscription may still renew when the record could not take that in, under the subscription’s environment and Apple’s subscription ID, and a random code made for the request that asked, so that only that request records what came of it. It keeps them so that it asks Apple about the subscription at most once a quarter of an hour, or a minute after Apple could not be reached or had no answer yet, and so that the app sells you no second subscription while Apple has not answered about the first, or says it may still renew. All are kept as long as the record, and deleted with it.

Why we keep it

To give your account Pro, and to prevent fraud, such as a refunded subscription being restored to another Penny Diary account.

How it is linked to your account

A subscription gives Pro to one Penny Diary account at a time. While an account holds the subscription, the record is linked to that account, and Apple’s information about it, renewals included, goes to that account, even when it names the account the subscription was bought for. Only a purchase made after the subscription ended, for an account other than the one its latest transaction was bought for, goes to that other account.

Whoever is signed in on the Apple Account that pays for the subscription can move it to the Penny Diary account they’re signed in to. While another account holds the subscription, the app names that account as above and asks first. It moves without asking in two cases, since the other account then loses nothing: once Apple has told us the subscription ended, and when you buy the subscription again in the app after the App Store shows it has ended, even if Apple hasn’t told us yet. The record is then linked to the account it moved to, and the account it moved from loses Penny Diary Pro on every device and on the web, and isn’t told.

After you delete your account

The record is kept without a link to the account, a name or an email address, though it may still hold your account’s ID as the account its latest transaction was bought for, which no longer leads to anyone. If the subscription is later restored to a Penny Diary account, whichever account it was bought for, the record is linked to that account.

While the subscription renews, Apple keeps sending our server its status, such as a renewal, a billing problem, a refund or the end of the subscription, and we keep it in the same record in the same way. We do the same for a subscription bought outside the app, such as with an offer code, that no Penny Diary account has restored.

How long we keep it

While an account holds the subscription, we keep the record as long as the account exists. Once no account holds it, we keep it only until the subscription’s paid period and any billing grace period have ended, and then delete it within a day. So a subscription that keeps renewing is kept until it stops.

Deleting your account does not cancel your subscription

Only the App Store can cancel it, and it renews until you do. Cancel it in your iPhone’s Settings, under your name, Subscriptions, or on Apple’s subscriptions page.

We may also give an account Pro by hand, for example for testing. That record holds only the account and the date it was made, and is deleted with the account.

These features do their work on your iPhone. What they produce becomes part of your ledger, which reaches us only if you sync.

• Voice entry. Your speech is turned into text on your iPhone by Apple’s on-device speech recognition. The audio is never saved to a file or sent to us, and what you said is used only to fill in the entry form, not saved with the entry. The first time, your iPhone may download a speech model for your language from Apple.
• On-device AI. If you turn it on and Apple Intelligence is available, Apple’s on-device model reads your words to suggest a title and a category. It runs on your iPhone; Penny Diary uses no cloud AI service.
• Siri and Shortcuts. Add Transaction saves an entry on your iPhone without opening the app. If you speak to Siri, Apple handles your request under its own privacy policy, and Penny Diary receives only the details of the entry.
• Apple Pay automation. If you set up the Shortcuts automation, Wallet hands Penny Diary the merchant name and the amount of each Apple Pay payment, which Penny Diary saves as an entry. Penny Diary gets no card number or other payment details. A payment in another currency waits on your iPhone, and is never sent anywhere, until you enter what it cost. To catch a payment reported twice, your iPhone remembers each one for two minutes.
• Logging reminder. Your iPhone schedules it itself. We send no push notifications, and the reminder names nothing from your ledger.
• App Lock. Face ID, Touch ID and your passcode are checked by iOS. Penny Diary learns only whether you unlocked it, never your face or fingerprint data.

Apart from the ledger currency, your settings stay on your iPhone and are never synced: the appearance, the reminder and its time, App Lock, the voice language and the AI setting among them.

The web app is part of Penny Diary Pro and shows the ledger synced to your account. You sign in to it with Google.

It keeps only what it needs in your browser: a sign-in cookie that keeps you signed in, and, for an hour after you sign out or delete your account, a cookie with the ID of the session you ended, so that nothing still on its way can sign you back in to it; your appearance and three display choices, in the browser’s local storage; and, while the tab is open, the period you are looking at. The ledger itself is held in the page’s memory while it is open, not stored in your browser. The web app sets no advertising or analytics cookies.

• We don’t show ads, and neither the app nor the web app contains advertising code.
• We don’t use third-party analytics, tracking or crash-reporting tools.
• We don’t track you across other companies’ apps and websites, and we don’t share your data with data brokers.
• We don’t sell your personal data, and we don’t share it for advertising.
• We don’t connect to your bank or your cards. Everything in your ledger is what you, or your own automation, entered.

Apple gives app developers crash reports and summary statistics about how an app is used, from people who choose to share them in their iPhone’s Settings, under Privacy & Security, Analytics & Improvements. Apple collects these under its own privacy policy, and they don’t include your ledger. We use them to fix problems and to understand, in aggregate, how Penny Diary is used.

A few companies help us run Penny Diary. Supabase and Vercel handle data only to provide their service to us.

Supabase

Hosts our database, our sign-in service and our server functions. The database holds your synced ledger, your account and the subscription records, and is in the United States.

Vercel

Hosts the web app and delivers its pages.

Apple

Distributes the app, sells the subscription, tells our server about it and answers our server’s questions about it, and provides Sign in with Apple, on-device speech recognition, Apple Intelligence, Siri, Shortcuts, Wallet and iCloud Backup.

Google

Provides Sign in with Google.

When you use Apple’s or Google’s own services, such as your Apple Account, the App Store, iCloud or your Google Account, they handle your data under their own privacy policies.

Like any server on the internet, Supabase and Vercel receive the technical details every request carries, such as your IP address, your device or browser type and the time. They keep them in their logs for a limited time, as How long we keep it says, and our sign-in service keeps them with each of your sessions, as Signing in says. We don’t use them to locate or profile you. Our server functions that receive or ask for App Store information log only what kind of message arrived and what came of it, never an account, transaction or subscription ID.

These providers may handle data in the United States and in other countries where they operate.

• Without an account: on your iPhone until you reset the ledger or delete the app, and in your iPhone’s backups for as long as you keep them.
• Your synced ledger: as long as you keep your account, including while Pro has ended. Anything you delete is removed for good 30 days later, counted by our server’s clock and from the last change to it if one of your devices changed it after you deleted it, except that a category you delete stays until no entry or repeating rule uses it any more, deleted ones still kept included. An entry you delete for good from Recently deleted goes at once. Either way an entry’s ID stays after the entry is gone, as does the ID of a repeating rule or an adjustment removed after 30 days and of a save the web app found wasn’t saved, until you delete your account.
• Your account: until you delete it. Deleting it removes, at once, every entry, adjustment, category, repeating rule and saved report, the IDs kept so that something deleted or never saved stays gone, your settings, any Pro given by hand, and the sign-in account itself, with the ways you sign in and your sessions. After that, our database holds nothing about you apart from any subscription record, with when our server last asked Apple about it and whether Apple answered, which is kept without the account, and any Google sign-in you left unfinished, which our sign-in service deletes after a day.
• Subscription records: as described under Penny Diary Pro and your subscription.
• Service logs: Supabase keeps logs of the requests to our database, our sign-in service and our server functions, and Vercel keeps logs of the requests to the web app. A logged request can include your IP address, your device or browser type and your account’s ID, and a logged sign-in can include your email address. Supabase and Vercel keep these logs in their own logging services, not in our database, for a limited time that our plan with each of them sets, and then delete them. We use them only to run, secure and fix the service. Deleting your account doesn’t remove what they already hold; it is deleted on the same schedule.
• Backups of our database: Supabase keeps them so the service can recover from a failure. Data you delete leaves them as they expire on Supabase’s schedule, and they are used for nothing else.

• Take a copy. Export your entries as a CSV file: in the iPhone app under Settings, Sync & data, Export entries, or on the web with Export all in Activity. The file leaves out the merchant name kept behind an Apple Pay automation entry; write to us, as below, if you want it.
• Correct it. Edit any entry, category or rule in the app. The merchant name kept behind an Apple Pay automation entry can’t be edited; deleting the entry removes it.
• Delete it. Delete entries, reset all data, or delete your account: in the iPhone app under Settings, Account, Delete account, or, for an account you signed in to without Penny Diary Pro, with Delete this account on the Penny Diary Pro screen; or on the web under Settings, Account, Delete account. Without an account, Reset all data or deleting the app removes the ledger from your iPhone.
• Stop syncing. Cancel Penny Diary Pro. When it ends, sync stops, and your iPhone keeps the whole ledger.

Depending on where you live, for example in the European Economic Area, the United Kingdom, California or Canada, you may have the right to access, correct or delete your personal data, to receive a copy of it, to object to or restrict how we use it, and to withdraw consent. To use any of these rights, or if the tools above don’t do what you need, write to support@rystudio.app. We will answer within the time the law where you live requires, and we won’t treat you differently for asking. You can also complain to your local data protection authority.

Where the law asks for a legal basis, we use your data to provide the service you asked for (your account, sync and Pro), for our legitimate interest in keeping Penny Diary secure and preventing fraud, and to meet our legal obligations.

We don’t sell or share personal information, as California law defines those terms.

Penny Diary is not meant for children under 13, or under the age of digital consent where they live, and we don’t knowingly collect their personal data. If you believe a child has given us personal data, write to us and we will delete it.

• Data traveling between the apps and our server is encrypted.
• Our database lets each account read and change only its own data.
• Only our server can write subscription records, and only from information Apple has signed.
• Supabase encrypts the data it stores.
• On your iPhone, iOS keeps the ledger file encrypted until the iPhone is first unlocked after a restart, and App Lock can ask for Face ID, Touch ID or your passcode to open Penny Diary.

No system is perfectly secure. If we learn of a breach that affects your data, we will tell you as the law requires.

When we change this policy, we will post the new version here with a new effective date. If a change matters for data you have already given us, we will tell you in the app or by email before it takes effect.

Zhiheng Gan is responsible for your data under this policy. For questions, requests or complaints about privacy, write to support@rystudio.app. If you email us, we use your message and your address only to answer you.