Privacy Policy — EveryPenny

Last updated: 1 June 2026 Data Controller: ФОП Ольховатий Ігор Васильович, вулиця Максимовича Михайла, буд. 28е, під'їзд 3, кв. 375, м. Київ 01001, Україна. Contact: [email protected]

Summary (the short version)

EveryPenny is a personal finance app. It stores as little about you as possible, and only what's needed to show you your own money. We never sell or share your data with advertisers.

Specifically, we hold:

• An identifier from the sign-in provider you chose (Apple, email, or Google) so we can recognise you across sign-ins. If you signed in with Apple's Hide My Email, all we ever see is a relay address — your real email never reaches us.
• Your email address if you signed in with Apple without Hide-My-Email, with our email magic-link, or with Google. We never see a password — Apple, our magic-link sender (Resend), and Google handle that respectively.
• The manual accounts, balances, and transactions you enter yourself.
• The bank accounts and transactions we sync on your behalf if you connect a bank (we only read; we never move money).
• Encrypted bank access tokens so we can re-sync your data later without asking you to re-log in. Each user's tokens are encrypted with a per-user subkey derived from a master key plus your account id, so they can't be cross-decrypted between users.
• Device tokens so we can send you push notifications (e.g. a reminder that a subscription charge is due tomorrow).

Everything is stored in the European Economic Area (Frankfurt, Germany). You can delete your entire account from inside the app at any time. You can also remove a single bank account or a single sub-account of a connected bank without deleting the rest of your data — see Your rights below.

1. What data we collect

1.1 Data you give us directly

1.2 Data we receive from third parties on your behalf

1.3 Data we derive automatically

• Recurring pattern detection — we cluster your transactions to identify subscriptions and recurring bills. This happens on our servers and the output stays in your account.
• Hashed attribution — when you sign in, we store an HMAC-SHA256 hash of your IP address and User-Agent so we can recognise suspicious logins without storing the raw values.

1.4 Data we do NOT collect

• Raw IP addresses or User-Agent strings (we keep only keyed hashes).
• Advertising identifiers.
• Location.
• Contacts, photos, microphone, or camera access.
• Biometric data. Face ID / Touch ID stay on your device — they never reach our servers.
• Your bank login credentials. You generate a read-only token on Monobank's own site and give it to us directly; we never see your Monobank password.

2. Legal basis (GDPR Art. 6)

• Contract (Art. 6(1)(b)) — everything we need to provide the product you signed up for. Account identity, manual entries, bank sync, push notifications.
• Legitimate interest (Art. 6(1)(f)) — hashed attribution for fraud/abuse detection; Sentry error reports; audit event log.
• Consent (Art. 6(1)(a)) — connecting a bank is explicit consent. You can withdraw consent at any time by disconnecting the bank inside EveryPenny.

3. Where the data lives

All data stays in the European Economic Area except for the Apple Push Notification service, which is handled by Apple globally under their own data-processing addendum, and Resend, which operates from EU and US regions; we use Resend's EU region for the magic-link and bug-report sends.

4. How long we keep it

• Your live data — as long as your account is active.
• Deleted account — your users row and every record tied to it (accounts, transactions, bank connections, device tokens, sessions) are removed from our production database immediately when you tap Delete Account (or when Apple tells us your Apple ID was permanently deleted). Cascade-deleted rows are gone from live Postgres within the request. Neon's point-in-time backup snapshots continue to hold the pre-delete state for up to the retention window of our Neon plan (currently 6 hours) after which they expire naturally.
• Audit events — kept indefinitely with userId set to NULL after deletion, so the system-level trail survives but is no longer tied to you personally.
• Session rows — pruned 90 days after expiry (anonymous data only — no PII).
• Idempotency keys — pruned 30 days after creation (hashes of request bodies, no PII).
• Sync cache (Redis) — 24 hours; nothing permanent.

5. Your rights (GDPR Art. 15-22)

You have the right to:

• Access your data — email us and we'll send you a JSON export of everything we hold.
• Correct inaccurate data — edit in-app, or email [email protected].
• Delete your account — tap Delete Account in Settings. Takes effect immediately and permanently: your data is gone from our live database the moment the request completes.
• Delete a single bank account or sub-account — long-press an account in EveryPenny and choose Disconnect bank (removes the entire connection and every transaction tied to it) or Remove this account (removes one bank-synced sub-account and its transactions while leaving the rest of the connection intact). Both are scoped to that account; nothing else is touched.
• Port your data — the export above is in portable JSON.
• Object to processing — disconnect banks; disable push notifications in iOS Settings.
• Withdraw consent — disconnecting a bank revokes EveryPenny's access immediately.
• Complain — to the data-protection authority of your EU country, or to Ukraine's Office of the Commissioner for the Protection of Personal Data.

We aim to respond to any written request within 30 days.

6. Security

We follow industry best practices for a finance app:

• TLS 1.3 everywhere. HSTS with preload.
• All bank tokens encrypted with per-user HKDF-derived AES-256-GCM subkeys, with the user's identifier bound into the auth tag so a row can't be cross-decrypted between users.
• Identity tokens from Apple and Google are verified against the respective provider's JWKS (JSON Web Key Set) on every sign-in — we never trust an unverified token.
• Email magic-link sign-in nonces are stored as SHA-256 hashes (never plaintext), expire 15 minutes after generation, are single-use, and are rate-limited per email and per IP to deter abuse.
• Refresh tokens stored as SHA-256 hashes, never plaintext; rotated on every use; device-bound.
• Session revocation on logout, on Apple account deletion, on request.
• Rate limiting at both the edge (Cloudflare) and the application tier.
• WAF + DDoS protection via Cloudflare.
• Append-only audit log on every money-touching action.
• Automated CVE scanning and dependency updates on every CI run.

No system is 100 % secure. If we discover a breach that affects you, we'll notify you without undue delay and at the latest within 72 hours, as GDPR requires.

7. Third-party sub-processors

These are the only companies that ever touch your data, and only in the specific roles below:

We'll update this list whenever we add or swap a sub-processor. Material changes trigger an in-app notice.

8. Children

EveryPenny is not directed at anyone under 16. We do not knowingly collect data from minors. If you believe a minor has signed up, contact us and we'll delete the account.

9. Changes to this policy

Significant changes are announced in-app before they take effect, and you'll be asked to re-consent. The change history is available on request.

10. Contact

For any privacy-related question or request: [email protected]

Appendix A — What Sentry actually receives

Sentry is initialised with sendDefaultPii: false and a scrubber that removes every key whose name matches email, phone, password, token, secret, iban, pan, dateOfBirth, address, firstName, lastName, fullName, and many other finance-adjacent terms, recursively, before any event leaves the process.

What Sentry sees:

• Sanitised stack traces
• HTTP route names (e.g. POST /auth/apple) — never path params with ids
• Error class + message (with PII regex-scrubbed)
• Opaque userId (UUID) — never the Apple user id or email

What Sentry never sees:

• Any bank account number, balance, or transaction amount
• Any real or relay email address
• Any authentication token in any form