Privacy Policy

For the PennyPilot app for iPhone and iPad.
Effective 1 August 2026. Last updated 1 August 2026.

1. Who this policy is from

PennyPilot is an independent app developed by Efe Havza ("we", "us"). This policy explains how the app handles information. It covers the PennyPilot iPhone and iPad app and its widgets. It does not cover Apple's own services, or any other app or website you may use alongside it.

2. What PennyPilot stores, and where

Everything you enter in PennyPilot is written to a database inside the app's own storage area on your device. That includes:

• Transactions — amounts, dates, descriptions, categories and accounts.
• Accounts and their balances, and net-worth snapshots you take.
• Categories, budgets and savings goals.
• Recurring rules such as salary, rent and subscriptions.
• Split groups, the expenses in them, and who owes what.
• Your preferences — currency, default cadence, theme, wallpaper, home layout and privacy toggles.

You are not asked for identifying information. PennyPilot never asks for your name, email address, phone number, date of birth, address, government ID, bank credentials, card numbers or account numbers. Whatever you type into a description or a category name is up to you, and it is stored exactly as you typed it.

None of this is transmitted to the developer. PennyPilot contains no code that sends your data to any server we operate, because we do not operate one.

3. iCloud Sync

PennyPilot can keep your data in step across your own devices using Apple's CloudKit. When the setting is on and your device is signed in to iCloud, your PennyPilot database is mirrored to the private database of your own iCloud account. That storage belongs to you, sits under your Apple Account, counts against your iCloud storage, and is governed by Apple's Privacy Policy.

The developer has no access to that database, receives no copy of it, and cannot read, export or delete anything in it.

iCloud Sync is on by default when your device is signed in to iCloud. You can turn it off at any time in Settings → iCloud Sync inside the app, which stops further syncing and keeps your data local to the device. If your device is not signed in to iCloud, PennyPilot stores everything locally and nothing leaves the device.

4. Shared splits

If you invite someone to a shared split group, that group and its expenses are shared through Apple's iCloud sharing. The people you invite can see and — depending on the access you give them — change the contents of that group: its expenses, amounts, dates, notes, and the participants' names as shown in iCloud.

Sharing is limited to the group you share. The rest of your PennyPilot data — your accounts, balances, net worth, other transactions, budgets and goals — is not part of a share and is not visible to participants. You can stop sharing, or remove a participant, from the sharing screen in the app. Once again, the developer is not a party to any of this and cannot see shared groups.

5. Features that stay on your device

• AI insights. On devices that support Apple Intelligence, PennyPilot can turn a summary of your spending into plain-language observations using Apple's on-device foundation model. The model runs locally on your iPhone or iPad; your figures are not sent to Apple's servers, to us, or to any AI provider. Where the feature is unavailable, the app falls back to insights calculated with ordinary arithmetic.
• Bill reminders. Reminders are local notifications, scheduled on your device by the app. No notification is sent through any server, and nothing about your bills leaves the device to produce them. Notification permission is requested only if you turn reminders on, and you can revoke it in iOS Settings.
• Importing a bank CSV. PennyPilot does not connect to banks and does not use an aggregator such as Plaid — deliberately, since those route your credentials and transactions through a third party. Instead you export a CSV statement from your bank yourself and choose the file. It is parsed on your device, shown to you for review, and only saved if you confirm. The file is not uploaded anywhere.
• Exporting. CSV and backup exports are produced on the device and handed to the iOS share sheet. Where the file goes next is your choice, and outside this app's control.
• Face ID and Touch ID. App Lock is handled by iOS. The app is told only whether authentication succeeded; it never receives your biometric data.
• Widgets. Home Screen widgets read a small summary from the app's own shared storage on the device. Nothing is fetched over a network.

6. What Apple sees

Because PennyPilot is distributed through the App Store and can use iCloud, Apple is involved in ways we do not control:

• Apple handles the download and any purchase, under its own privacy policy.
• If you use iCloud Sync or shared splits, your data is stored in your iCloud account as described above.
• Apple gives developers aggregate, anonymised App Store statistics — for example how many people downloaded the app in a country, or overall crash counts. These cannot be tied to an individual and contain none of your financial data.
• If you have chosen in iOS Settings to share crash and analytics data with developers, Apple may pass us a crash report. Crash reports describe the state of the program — not the contents of your ledger.

7. What PennyPilot never does

• No advertising, and no ad networks.
• No analytics or telemetry SDK of any kind.
• No tracking across apps or websites, and no advertising identifier. The app's privacy manifest declares no tracking and no collected data types.
• No selling or sharing of personal information, under any definition, to anyone.
• No third-party servers. The app makes no network requests to any service other than Apple's iCloud on your behalf.
• No profiling, and no automated decision-making about you.

8. Your controls

• Turn off syncing — Settings → iCloud Sync in the app.
• Stop sharing a split — open the group's sharing screen and stop sharing or remove a participant.
• Export your data — Settings → Export writes your data out as CSV.
• Erase everything — Settings → Erase All Data permanently wipes the app's data from the device. If iCloud Sync is on, the deletion propagates to your iCloud copy as well.
• Delete the app — removing PennyPilot deletes its on-device data. To also clear the iCloud copy, either erase your data in the app first, or manage the app's iCloud storage in iOS Settings under your Apple Account.
• Revoke permissions — notifications and Face ID access can be turned off for PennyPilot in iOS Settings at any time.

9. Your rights under privacy law

Privacy laws such as the GDPR, UK GDPR, PIPEDA and the CCPA/CPRA give you rights to access, correct, delete, or receive a copy of personal information a company holds about you, and to object to its sale.

We hold no personal information about you, so there is nothing for us to look up, correct, export or delete on your behalf, and nothing to sell. The equivalent of every one of those rights is available directly in the app: your data is on your device, exportable as CSV, and erasable in one action. If you believe we nonetheless hold something about you, write to the address below and we will respond.

Where a legal basis is required for the limited processing that happens on your device, it is the performance of the service you asked for — the app doing what you installed it to do.

10. Children

PennyPilot is a general-audience budgeting tool and is not directed at children under 13. We do not knowingly collect personal information from anyone, children included. There is no account to create, no profile, and no way for a child to disclose information to us through the app.

11. Security

Your data sits in the app's private storage area, protected by iOS app sandboxing and by your device's own encryption when you use a passcode. You can add App Lock so that Face ID, Touch ID or your passcode is required to open the app, hide amounts on screen, and blur the app in the app switcher. Data synced through iCloud is protected by Apple's transport and storage encryption, and can be end-to-end encrypted if you enable Advanced Data Protection for your Apple Account.

Because your data is not held on our servers, it cannot be exposed by a breach of ours. The trade-off is real and worth stating plainly: if you lose your device and have no iCloud sync or export, that data is gone, and we cannot recover it for you.

12. Changes to this policy

If this policy changes, the updated version will be posted on this page with a new "last updated" date. Material changes — anything that alters what leaves your device — will be described in the app's release notes as well.

13. Contact

Questions about privacy, or about anything in this policy:
efehavza@gmail.com

We aim to reply within a few business days.