Pennypair Privacy Policy
Effective October 2026 · Pennypair is made by Ji'an Wangdong Technology Co., Ltd., China.
The short version
- Pennypair never connects to your bank, shows no ads, and never sells your data.
- We store what you add to the app (amounts, categories, notes, dates and receipt photos) so you and the people you share a ledger with can see it.
- Receipts are read on your iPhone. Notifications never include amounts. Searches aren't saved.
- You can delete your account in the app at any time: Me › Delete account.
What we collect
| Data | Why |
|---|---|
| Signing in. With Apple: your Sign in with Apple identifier, and the name you choose to share. With Google: your Google Account ID and the name on your Google Account (see Signing in with Google). | To create your account, recognize you when you sign in again, and show your name to people you share with. We don't ask Apple or Google for your email. |
| Ledger and savings jar content you enter: amounts, currency, categories, notes, dates, who paid and how it was split, budgets, recurring bills, and for foreign-currency expenses the original amount and exchange rate | That's the app. Members of a shared ledger or jar see its contents. |
| Receipt photos you add to an expense | To show them to the members of that ledger. See Receipt photos. |
| Purchase records from Apple (product, dates, price, App Store country) | To unlock Pro. Apple handles payment; we never see your card. |
| Notifications: the push token Apple gives Pennypair on your iPhone, your phone's language, your choices in Me › Notifications, and a record of the notifications and reminders we've sent | To send the notifications you've turned on. See Notifications. |
| Invites: which invite a new member joined with, when, and any extra days of Pro it earned | To give invite rewards and apply their limits. See Invite rewards. |
| View-only links: who created a link, for which ledger or jar, and when it expires or was stopped | To make the link work and show members that it's on. See View-only links. |
| Face ID lock: a public key created on your iPhone, and the device name iOS gives the app (on current iOS just “iPhone”) | To check it's you when revealing private ledgers, and to tell your devices apart. Your face data never leaves your iPhone and we never receive it. Other members never see this. |
| Technical: time zone, language, App Store country, IP address in server logs | To show the right dates and currency and to keep the service secure. Logs are kept for a short time. |
| Usage: which days you used the app (one record per day), and roughly when you last used it | To count how many people use Pennypair each day and how many come back. These records hold only dates and times, nothing about what you did or entered. |
We don't collect your contacts, location, bank details, or advertising identifiers, and we don't use third-party analytics, advertising or tracking SDKs.
Signing in with Google
If you choose Continue with Google, you sign in on Google's own page. We ask Google only for basic sign-in (the “openid” and “profile” permissions), and we keep just two things:
- your Google Account ID, a number that tells us it's the same Google Account next time you sign in; and
- the name on your Google Account, which becomes your display name when you first sign in. You can change it in the app at any time.
We don't ask for your email address, we don't keep your profile photo, and we can't see your password, contacts, files or anything else in your Google Account. We use what Google sends us only to sign you in to Pennypair. We never use it for ads and never share it with anyone. Google's side of signing in is covered by the Google Privacy Policy.
An account you create with Google and one you create with Apple are separate Pennypair accounts. To stop using your Google Account with Pennypair, delete your Pennypair account in the app (Me › Delete account). You can also remove Pennypair's access in your Google Account settings, but that doesn't delete your Pennypair account or its data.
Receipt photos and scanning
- When you add a receipt photo to an expense, we store the photo and a small preview on our servers. Before it's uploaded, your iPhone removes the photo's hidden details, such as location and camera information, and our server removes them again.
- Only members of that ledger can see it. Members who can edit the ledger can delete it. Like the rest of the ledger, members can share it on, for example in a PDF report. View-only links never include photos.
- Reading a receipt (amount, date and store) happens on your iPhone, using Apple's built-in text recognition. The text it reads isn't sent to us. Only what you choose to save in the expense is.
- A deleted photo is removed from our servers within an hour. If you delete an expense, its photos are removed 30 days later, once it can no longer be restored. A small record without the image (its size and upload date) stays until the end of the month it was uploaded, so monthly upload limits keep working. Backup copies are overwritten within 14 days.
- If someone taps Report this photo, they email us the photo's number, and we may look at that photo to deal with the report.
Exchange rates
For foreign-currency expenses, our server downloads the public daily reference rates published by the European Central Bank and the monthly InforEuro rates published by the European Commission. If their sites can't be reached, we use a public mirror of the same data. These downloads don't include any information about you. Your iPhone gets the rates from our server, and the rate you use is saved with the expense.
Notifications
Notifications are optional. Turn each type on or off in Me › Notifications, or turn them all off in your iPhone's Settings. If you allow them, we store the push token Apple gives Pennypair on your iPhone (it lets Apple deliver notifications to that iPhone), your phone's language and your notification choices. Notifications are delivered through Apple Push Notification service. They never include amounts, and for ledgers you've hidden with Face ID they only say “New activity in Pennypair”.
When you tap Remind, we record who reminded whom and when, so a reminder can be sent at most once a day. We also keep a record of the notifications we send: their type, when they were sent, and the names they showed. Signing out removes that iPhone's push token from your account.
Invite rewards
When someone new joins one of your ledgers or jars with your invite, we record that they joined with your invite, when, and whether it earned you extra days of Pro. We use this only to give the reward and apply its limits. In the app you see how many rewards you've had this year and the name of the most recent friend who joined. If either of you deletes your account, that person is removed from the record, and only the count stays.
View-only links
- A view-only link lets anyone who has it see, for 7 days and without an account: for a ledger, its name, total spending, each person's name and totals, and the 20 most recent entries with their categories and notes; for a jar, its goal, progress and who has saved what (if the jar's owner shows that). They can't change anything and never see receipt photos.
- Everyone in the ledger or jar sees a notice in the app while a link is on.
- The person who created the link, or the ledger's or jar's owner, can stop it at any time. Links also stop working after 7 days, or when the person who created them leaves or deletes their account.
- If anyone in the ledger or jar has hidden it with Face ID, the link shows no amounts at all.
- We don't log who opens a link, and the page asks search engines not to index it. Records of expired or stopped links are deleted after 30 days.
Search
When you search, your iPhone sends the search to our server, which uses it only to find matching expenses. Searches aren't saved or written to our logs, and the app doesn't keep a search history on your iPhone.
On your iPhone
Some data is kept on your iPhone: changes you make while offline wait there until they sync, recent data and photos are cached so the app opens quickly, and widgets show a summary the app saves for them. Nothing from ledgers you've hidden with Face ID is saved on your iPhone: not in the offline queue, the cache or widgets. Deleting the app removes this data from your iPhone.
Where it's stored
All Pennypair accounts and their data are stored on servers in Singapore (Alibaba Cloud Singapore), wherever you live, including mainland China. Everyone in a shared ledger uses the same servers. If you live outside Singapore, for example in the EU, the UK or the US, this means your data is transferred to Singapore, whose data protection laws may differ from yours. We protect it as this policy describes.
Who can see it
- People you invite to a ledger or jar see its contents, its receipt photos and your display name.
- Anyone a member sends a view-only link to, for 7 days and only what's described above.
- Our staff can see aggregate statistics (for example, how many people signed up today) and basic account facts needed for support. We do not browse your entries or photos, except to deal with a photo someone has reported.
- Service providers that run the service for us: Alibaba Cloud (hosting), Apple (Sign in with Apple, payments and push notifications) and Google (only if you choose to sign in with Google). The European Central Bank and the European Commission receive nothing about you.
- Authorities, only when required by law.
How long we keep it, and deleting it
We keep your data while you have an account. Delete it any time in the app (Me › Delete account). Your personal ledgers and jars are deleted immediately, and their photos within an hour. In ledgers you shared with others, entries you made stay so their balances don't change, but they show as “Deleted user” and are no longer linked to you. Receipt photos you added are deleted too, including in shared ledgers. Your push tokens and notification choices are deleted, view-only links you created stop working, and you're removed from invite reward records. Backups are overwritten within 14 days.
To stop the 30 days of Pro on us from being claimed again and to let you restore past purchases, we keep a one-way hash of your Sign in with Apple identifier or Google Account ID, and your Apple purchase records; neither contains your name or any entries. The records of which days the account was used also stay, likewise without your name or entries, so past usage counts don't change. If you have a subscription, cancel it in your iPhone's Settings: tap your name, then Subscriptions. Deleting your account doesn't cancel it.
Why we're allowed to use it
If you're in the EU, the UK or another place with similar laws, we rely on these legal bases:
- To provide Pennypair to you (your account, ledgers and jars, sharing, receipt photos, exchange rates, view-only links, invite rewards and Pro): because it's necessary to perform our agreement with you, our Terms of Use.
- To keep the service secure, prevent abuse (such as claiming free Pro again with a new account) and count how many people use the app: our legitimate interests. We keep this to a minimum; for example, usage records hold only dates.
- Notifications: your permission, which you can withdraw at any time in Me › Notifications or your iPhone's Settings.
- To comply with the law, when it requires us to keep or share information.
Your rights
Depending on where you live (for example under the GDPR or CCPA), you can ask to access, correct, export or delete your data, object to how we use it, or withdraw your permission. Most of this you can do in the app; for anything else, contact us below. You can also complain to your local data protection authority.
Children
Pennypair isn't directed at children under 13 and we don't knowingly collect their data.
Changes and contact
If we change this policy in a meaningful way, we'll tell you in the app. Questions: support@pennypair.app.