Privacy Policy

The short version

Penniva has no accounts and no servers. Your budgeting data stays on your device unless you turn on Cloud Sync or choose to export or share it. Cloud Sync keeps its copy in your own iCloud account, in a form we never receive. We do not sell your data, show ads, or track you.

What Penniva stores on your device

Your accounts, transactions, budgets, categories, tags, rules, recurring items, and anything you import live in a database on your iPhone or iPad. That database is yours. We never receive a copy of it.

No account required

You do not need an account to use Penniva. There is no sign up and no login, because there is nothing to sign in to.

Optional Cloud Sync

If you turn on Cloud Sync, Penniva copies your budgeting data into the private database of your own iCloud account, using Apple's CloudKit. It does not pass through a Penniva server, because there is no Penniva server. The copy lives in your iCloud storage, under your Apple Account, and counts toward your iCloud storage rather than ours.

Cloud Sync is off until you turn it on

Cloud Sync sends no budgeting data until you enable it yourself. Files you export or share are separate choices. If you never turn it on, Penniva works exactly as it always has, entirely offline.

How synced data is protected

Your amounts, payees, notes, account names, and categories travel as encrypted fields: Penniva encrypts them on your device before they are uploaded, and they are never stored in readable form. They are never visible to us under any setting, because they never reach us — there is no Penniva server for them to arrive at. How strongly they are protected inside iCloud depends on one setting in your Apple Account, which is worth knowing about.

Advanced Data Protection

If you turn on Advanced Data Protection for iCloud in your Apple Account settings, the keys to these records never leave your trusted devices and Apple cannot read them. Without it, Apple keeps keys for iCloud data in its own data centers, as it does for most iCloud services, and can access them after authentication. We would rather tell you where that line falls than imply a guarantee that depends on a setting you may not have turned on.

What is not encrypted

Each synced record carries exactly one value in the clear: a format version number, which lets a device recognize a record written by a newer version of Penniva rather than misreading it. It describes the shape of the record, not you. Apple can also see the ordinary facts any storage provider sees — that records exist, how many, and when they changed.

Turning Cloud Sync off

You can turn Cloud Sync off at any time in Data & Privacy. That stops the device you are using from sending or receiving further changes. Anything already stored in iCloud stays there until you delete it.

Deleting the iCloud copy

Data & Privacy offers Delete iCloud Copy, which removes everything Penniva stores in iCloud. Every device syncing to that copy loses it as well. The data on the device you are holding is not touched, Cloud Sync turns off, and the deletion cannot be undone.

Imports

You can import transactions from CSV and QIF files. Every part of that — reading the file, matching categories, applying your rules — happens on your device. Imported files are not transmitted to us.

Backups and exports you make yourself

Full backups contain your financial data. CSV exports and unencrypted backups can be read by anyone who gets the file. Where those files go is your choice; if you save or share them through iCloud Drive, email, or another service, that service processes them under its own terms.

In versions that offer password-protected backups, protection is on by default when you create a full backup. You can choose an unencrypted backup for compatibility with older versions. Penniva does not store or recover your backup passphrase: losing it means losing access to that protected file. Keep the passphrase and file somewhere safe. Older backups remain unencrypted unless you make a new protected backup, and CSV exports remain unencrypted.

Purchases

If you buy a Penniva upgrade, the App Store handles the purchase. Apple processes the payment; we never see your card number, billing address, or Apple Account details. Apple gives us aggregated sales reports, which say how many purchases were made, not who made them.

No analytics and no tracking

Penniva contains no analytics, advertising, or tracking code. The only third-party component in the app is an open-source database library that runs entirely on your device. If you have chosen in iOS Settings to share diagnostics with app developers, Apple may pass us crash reports; those describe where our code failed, and carry no budgeting data.

No selling or advertising

We do not sell your data. We do not show ads. Penniva is designed to be a calm, private tool for your personal finances.

Support emails

When you email us at support@penniva.app, your email provider may process your message. We only use your email to respond to your support request.

Your data, your control

Because we hold no copy of your budgeting data, there is nothing for us to hand over or delete on your behalf. Deleting the app removes the data on that device, and Delete iCloud Copy removes the synced copy. Data held in your iCloud account is governed by your agreement with Apple.

Changes to this policy

We update this page before a release changes what leaves your device, not after.

Contact

Questions or concerns? Email us at support@penniva.app.