1. Introduction

Welcome to Penny. We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and services.

By using Penny, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Personal Information

When you register for Penny, we may collect:

• Email address
• Account credentials
• Profile information

2.2 Financial Information

To provide our expense tracking services, we collect:

• Expense data you manually enter
• Category assignments
• Budget goals and targets
• Spending patterns and habits

2.3 Usage Data

We automatically collect information about how you use Penny:

• App usage statistics
• Device information (type, operating system)
• Log data and analytics

3. How We Use Your Information

We use your information to:

• Provide Core Services: Track expenses, generate insights, and sync with Google Sheets
• AI-Powered Features: Create personalized spending insights and money personality reports
• Improve Our Service: Analyze usage patterns to enhance user experience
• Communication: Send important updates, feature announcements, and support messages
• Security: Protect against unauthorized access and fraudulent activity

4. Google Sheets Integration

Penny offers optional Google Sheets synchronization. When you enable this feature:

• We request limited access to read and write data to your specified Google Sheet
• Your expense data is synced in real-time to your personal Google Sheet
• You maintain full ownership and control of your Google Sheets data
• You can revoke this access at any time through your Google Account settings

5. AI and Data Processing

Our AI-powered features analyze your spending patterns to provide:

• Monthly money personality reports
• Smart savings suggestions
• Goal success predictions
• Personalized spending insights

All AI processing is performed securely, and your financial data is never shared with third parties for advertising or marketing purposes.

6. Data Storage and Security

We implement industry-standard security measures to protect your data:

• Encryption: All data is encrypted in transit (TLS/SSL) and at rest
• Firebase Security: We use Google Firebase's secure infrastructure
• Access Controls: Strict authentication and authorization protocols
• Regular Audits: Continuous monitoring and security assessments

7. Data Sharing and Disclosure

We do not sell your personal information. We may share your data only in the following circumstances:

• With Your Consent: When you explicitly authorize us to share information
• Service Providers: Google Firebase (authentication, database, file storage), Google Sheets API (optional export), Plaid (optional bank connections), RevenueCat (subscription management), Expo (push notifications), and the AI providers named in section 7b
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In the event of a merger, acquisition, or sale of assets

7a. Receipt Images and Camera Access

Penny can read a receipt so you do not have to type it in. This is optional and only happens when you choose to scan one:

• Camera and photo library: Access is requested only when you scan a receipt, and only for that purpose. We do not browse or upload anything else from your device.
• Processing: The image is compressed on your device and sent to our secure server, which extracts the merchant, date, amount and category.
• Storage: If you choose to attach a receipt to a transaction, the image is stored in your own private area of Google Firebase Storage and is visible only to you.
• Deletion: Deleting a transaction or your account removes the attached images.

7b. Artificial Intelligence Features

Receipt scanning, spending insights and the in-app assistant are powered by third-party AI models. We route every request through our own servers, so the AI providers never receive your account credentials and we never embed provider keys in the app.

• Providers: OpenAI, Groq, Mistral and Hugging Face, depending on the feature.
• What is sent: Only the content needed for the task, such as the receipt image you scanned or the transaction figures a given insight is about.
• What is not sent: Your email address, password, bank credentials or full transaction history.
• Training: We use these providers under terms that do not permit your data to be used to train their models.
• Optional: AI features are optional. The app is fully usable without them.

7c. Bank Connections

Connecting a bank account is optional. When you choose to, the connection is handled by Plaid Inc., a regulated financial data provider:

• Your bank credentials go to Plaid, never to us. We never see, receive or store your online banking username or password.
• What we receive: The transaction and balance data you authorise, so it can appear in the app.
• Your control: You can disconnect a bank at any time from the Banks screen, which stops any further data being shared.
• Plaid's own policy: Plaid processes your information under its privacy policy at plaid.com/legal.

7d. Notifications

If you enable reminders for bills, budgets or streaks, your device registers a push notification token with Expo, which delivers the notification on our behalf. The token identifies the device, not you personally, and is deleted when you turn notifications off or delete your account. Notifications are optional and can be turned off at any time in your device settings.

7e. How Long We Keep Your Data

We keep your account and financial records for as long as your account is open, because the app exists to show you your own history. When you delete your account from within the app, your transactions, accounts, budgets, bills, goals and receipt images are deleted from our systems within 30 days. Backups are purged on a rolling 90 day cycle. We retain only what the law requires us to keep, such as records of a purchase for tax purposes.

8. Your Rights and Choices

You have the right to:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and associated data
• Export: Download your data in a portable format
• Opt-Out: Unsubscribe from marketing communications

To exercise these rights, please contact us at hello@kodefoundry.com.

9. Premium Subscriptions

Penny offers optional premium features through in-app subscriptions:

• Subscriptions are processed through Apple's App Store or Google Play Store
• Your payment information is handled securely by Apple/Google, not by us
• Subscription status is managed on our behalf by RevenueCat, which receives an anonymous account identifier and your purchase history, never your payment details
• Subscription data is managed according to Apple's and Google's privacy policies
• You can cancel subscriptions at any time through your device settings

10. Children's Privacy

Penny is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page and updating the "Last Updated" date. We encourage you to review this Privacy Policy periodically.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

14. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to know whether personal information is sold or disclosed
• Right to say no to the sale of personal information
• Right to access your personal information
• Right to equal service and price