Privacy Policy — EveryPenny

Last updated: 21 June 2026 Data Controller: LLC "Natural Intelligence" (ТОВ «Природній інтелект»), a limited liability company incorporated in Ukraine, company registration number (ЄДРПОУ) 46203933. Registered address: 28e Mykhaila Maksymovycha Street, building 3, apt. 275, Kyiv 03195, Ukraine (вулиця Максимовича Михайла, буд. 28е, корпус 3, кв. 275, м. Київ 03195, Україна). Contact: [email protected]

EU Representative (Art. 27 GDPR) As the controller is established outside the EU/EEA, we have appointed an EU representative under Art. 27 GDPR for individuals in the EU/EEA. Our representative is the company Data Protection Representative Limited (trading as DataRep). You may contact DataRep, in addition to or instead of us, on any matter relating to the processing of your personal data and the exercise of your GDPR rights.

You can reach our representative:

• By email: [email protected] — please quote <EveryPenny> in the subject line.
• By webform: www.datarep.com/data-request
• By post: to DataRep, at the address below for your country. Please mark your correspondence to "DataRep" (not to EveryPenny) — otherwise it may not reach the representative.

This representative is appointed for the EU/EEA only. DataRep is not appointed as our representative in the United Kingdom or in Switzerland. DataRep handles your data as set out in its own privacy notice at www.datarep.com/privacy-policy.

For general or product questions (anything that is not a data-protection request), please write to EveryPenny directly at [email protected] rather than to our representative.

Summary (the short version)

EveryPenny is a personal finance app. It stores as little about you as possible, and only what's needed to show you your own money. We never sell or share your data with advertisers.

Specifically, we hold:

• An identifier from the sign-in provider you chose (Apple, email, or Google) so we can recognise you across sign-ins. If you signed in with Apple's Hide My Email, all we ever see is a relay address — your real email never reaches us.
• Your email address if you signed in with Apple without Hide-My-Email, with our email magic-link, or with Google. We never see a password — Apple, our magic-link sender (Resend), and Google handle that respectively.
• The manual accounts, balances, and transactions you enter yourself.
• The bank accounts and transactions we sync on your behalf if you connect a bank (we only read; we never move money).
• Encrypted bank access tokens so we can re-sync your data later without asking you to re-log in. Each user's tokens are encrypted with a per-user subkey derived from a master key plus your account id, so they can't be cross-decrypted between users.
• Device tokens so we can send you push notifications (e.g. a reminder that a subscription charge is due tomorrow).

Everything is stored in the European Economic Area (Frankfurt, Germany). You can delete your entire account from inside the app at any time. You can also remove a single bank account or a single sub-account of a connected bank without deleting the rest of your data — see Your rights below.

1. What data we collect

1.1 Data you give us directly

1.2 Data we receive from third parties on your behalf

1.3 Data we derive automatically

• Recurring pattern detection — we cluster your transactions to identify subscriptions and recurring bills. This happens on our servers and the output stays in your account.
• Hashed attribution — when you sign in, we store an HMAC-SHA256 hash of your IP address and User-Agent so we can recognise suspicious logins without storing the raw values.
• Privacy-preserving product analytics — to understand whether the app is useful (did people who signed up come back? did they create their first budget?), we record a small set of pseudonymous, predefined events: sign-up, sign-in, app-opened, and "key action" beats (a budget/goal created, a bank connected, a transaction added, a recurring subscription confirmed). These events carry only the event name and a coarse, hard-coded type — never amounts, merchant names, account names, categories, or any free text. The only identifier attached is your opaque account ID (the same UUID used internally), set only after you sign in and cleared when you sign out. Because that ID could in principle be linked back to you, we treat these events as pseudonymous (GDPR Recital 26), not anonymous; events fired before you sign in carry no identifier at all. See Appendix B for exactly what our analytics processor receives.

1.4 Data we do NOT collect

• Raw IP addresses or User-Agent strings (we keep only keyed hashes for fraud/abuse detection).
• Advertising identifiers.
• Location data. We never request GPS, Wi-Fi, or CoreLocation access. PostHog's server-side IP-to-location lookup is disabled at the project level, and the client IP address is discarded at ingestion, so no IP-derived country, city, postal code, or coordinates are derived or stored.
• Contacts, photos, microphone, or camera access.
• Biometric data. Face ID / Touch ID stay on your device — they never reach our servers.
• Your bank login credentials. You generate a read-only token on Monobank's own site and give it to us directly; we never see your Monobank password.

2. Legal basis (GDPR Art. 6)

• Contract (Art. 6(1)(b)) — everything we need to provide the product you signed up for. Account identity, manual entries, bank sync, push notifications.
• Legitimate interest (Art. 6(1)(f)) — hashed attribution for fraud/abuse detection; Sentry error reports; audit event log; privacy-preserving product analytics (pseudonymous, no directly-identifying PII, EU-hosted) to improve the app. The analytics signal is opt-out at any time from Settings → Privacy → Share Product Analytics; turning it off drops any in-flight events and stops further collection immediately.
• Consent (Art. 6(1)(a)) — connecting a bank is explicit consent. You can withdraw consent at any time by disconnecting the bank inside EveryPenny.

3. Where the data lives

All data stays in the European Economic Area except for these transfers, for which we rely on the safeguards in Chapter V of the GDPR: the Apple Push Notification service (Apple, global, under its own data-processing addendum); Sentry (US company — we use its EU region, under the EU-US Data Privacy Framework, with EU Standard Contractual Clauses as a fallback); Resend (US company — we use its EU region, under the EU-US Data Privacy Framework, with EU Standard Contractual Clauses as a fallback); RevenueCat (US, under Standard Contractual Clauses); and Paddle (our website payment merchant of record, under SCCs / the Data Privacy Framework).

4. How long we keep it

• Your live data — as long as your account is active.
• Deleted account — your users row and every record tied to it (accounts, transactions, bank connections, device tokens, sessions) are removed from our production database immediately when you tap Delete Account (or when Apple tells us your Apple ID was permanently deleted). Cascade-deleted rows are gone from live Postgres within the request. Neon's point-in-time backup snapshots continue to hold the pre-delete state for up to the retention window of our Neon plan (currently 6 hours) after which they expire naturally.
• Bank & transaction data — transactions, balances, and derived insights (categories, recurring charges) are kept on a 24-month rolling window from each transaction's date; older entries age out automatically. On account deletion everything is cascade-deleted immediately (see above).
• Audit / security events — kept for up to 24 months, then deleted or irreversibly anonymised. On account deletion the userId is set to NULL immediately, so any record still inside that window is no longer tied to you personally.
• Product analytics (PostHog) — pseudonymous event data is retained for 12 months, then deleted. No financial content or PII is ever sent (see §7 and Appendix B).
• Error monitoring (Sentry) — PII-scrubbed error events are kept for 90 days, then deleted.
• Session rows — pruned 90 days after expiry (anonymous data only — no PII).
• Idempotency keys — pruned 30 days after creation (hashes of request bodies, no PII).
• Sync cache (Redis) — 24 hours; nothing permanent.

5. Your rights (GDPR Art. 15-22)

You have the right to:

• Access your data — email us and we'll send you a JSON export of everything we hold.
• Correct inaccurate data — edit in-app, or email [email protected].
• Delete your account — tap Delete Account in Settings. Your data is removed from our live production database the moment the request completes. Two narrow exceptions, detailed in §4: encrypted database backups hold the pre-deletion state for up to ~6 hours before expiring naturally, and security/audit-log entries are retained for the period stated in §4 with your identifier removed so they no longer identify you.
• Delete a single bank account or sub-account — long-press an account in EveryPenny and choose Disconnect bank (removes the entire connection and every transaction tied to it) or Remove this account (removes one bank-synced sub-account and its transactions while leaving the rest of the connection intact). Both are scoped to that account; nothing else is touched.
• Port your data — the export above is in portable JSON.
• Object to processing — disconnect banks; disable push notifications in iOS Settings.
• Withdraw consent — disconnecting a bank revokes EveryPenny's access immediately.
• Complain — to the data-protection authority of your EU country, or to Ukraine's Office of the Commissioner for the Protection of Personal Data.

We respond to any request within one month of receipt. For complex or numerous requests we may extend this by up to two further months, and will tell you within the first month if we do (GDPR Art. 12(3)).

6. Security

We follow industry best practices for a finance app:

• TLS 1.3 everywhere. HSTS with preload.
• All bank tokens encrypted with per-user HKDF-derived AES-256-GCM subkeys, with the user's identifier bound into the auth tag so a row can't be cross-decrypted between users.
• Identity tokens from Apple and Google are verified against the respective provider's JWKS (JSON Web Key Set) on every sign-in — we never trust an unverified token.
• Email magic-link sign-in nonces are stored as SHA-256 hashes (never plaintext), expire 15 minutes after generation, are single-use, and are rate-limited per email and per IP to deter abuse.
• Refresh tokens stored as SHA-256 hashes, never plaintext; rotated on every use; device-bound.
• Session revocation on logout, on Apple account deletion, on request.
• Rate limiting at both the edge (Cloudflare) and the application tier.
• WAF + DDoS protection via Cloudflare.
• Append-only audit log on every money-touching action.
• Automated CVE scanning and dependency updates on every CI run.

No system is 100 % secure. If we discover a personal-data breach, we'll notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours, and we'll tell affected users without undue delay where the breach is likely to put their rights at high risk — as GDPR requires.

7. Who else processes your data

These are the only companies that ever touch your data, in the specific roles below. GDPR distinguishes two kinds of recipient, so we list them separately: processors that act only on our instructions under a data-processing agreement (DPA), and independent controllers that decide their own purposes and have their own privacy notices.

7.1 Processors (act only on our instructions, under a DPA)

7.2 Independent controllers (they set their own purposes; their own notices apply)

FX rates come from public sources (Frankfurter and fawazahmed0/exchange-api, via jsDelivr / Cloudflare); only currency codes are sent — no personal data, so no DPA is needed.

We'll update these lists whenever we add or swap a recipient. Material changes trigger an in-app notice.

8. Children

EveryPenny is not directed at anyone under 16. We do not knowingly collect data from minors. If you believe a minor has signed up, contact us and we'll delete the account.

9. Changes to this policy

Significant changes are announced in-app before they take effect, and you'll be asked to re-consent. The change history is available on request.

10. Contact

For any privacy-related question or request: [email protected]

Appendix A — What Sentry actually receives

Sentry is initialised with sendDefaultPii: false and a scrubber that removes every key whose name matches email, phone, password, token, secret, iban, pan, dateOfBirth, address, firstName, lastName, fullName, and many other finance-adjacent terms, recursively, before any event leaves the process.

What Sentry sees:

• Sanitised stack traces
• HTTP route names (e.g. POST /auth/apple) — never path params with ids
• Error class + message (with PII regex-scrubbed)
• Opaque userId (UUID) — never the Apple user id or email

What Sentry never sees:

• Any bank account number, balance, or transaction amount
• Any real or relay email address
• Any authentication token in any form

Appendix B — What PostHog actually receives

PostHog is configured for the EU Cloud (eu.i.posthog.com) with autocapture, session replay, screen-view capture, and application-lifecycle autocapture all disabled. PostHog's server-side GeoIP enrichment is disabled at the project level, and the client IP address is discarded at ingestion — so no country, city, latitude/longitude, or postal code is ever derived or stored from your IP. (As an additional safeguard, the SDK also registers $geoip_disable: true on every event.) Person profiles are created only for identified users (personProfiles = .identifiedOnly), so events fired before sign-in carry no identifier (anonymous); events after sign-in are pseudonymous — tied to the opaque account ID below, not to your name or email. Every event in the app is fired explicitly from code — there is no automatic data collection.

The complete set of events we ever send:

• signup / signin — that an account was created or a returning user signed in
• app_opened — the app came to the foreground (powers retention reporting)
• activated — the user completed their first meaningful action on this install
• key_action with a type of one of: bank_connected, transaction_added, budget_created, goal_created, recurring_confirmed

What PostHog sees:

• The event names above and their hard-coded type value
• An opaque account ID (UUID), attached only after sign-in and cleared on sign-out
• Standard SDK metadata (app version, OS version, device model, coarse library context)

What PostHog never sees:

• Any amount, balance, merchant name, account name, or category name
• Any transaction content or free-form text you typed
• Your email address, display name, or any other PII
• Any advertising identifier (we collect none)

This feature is key-gated: with no PostHog project key configured, the SDK is never initialised and nothing is sent at all.