Money Pot — Privacy Policy

Last updated: 2026-09-11

Money Pot is an iOS app that helps you track personal expenses, income, and net worth. We designed it to keep your financial data private.

What we store

Expense, asset, recurring, and category records are stored locally on your device using Apple’s SwiftData framework. Optional features transmit the data described below when you choose to use them.

iCloud sync (opt-in)

If you enable iCloud sync in the app’s Privacy Choices sheet, your records are synchronized to your personal iCloud account using Apple CloudKit. The data is encrypted at rest and in transit, and remains under your Apple ID. Money Pot does not have access to your iCloud-synced data.

AI scanning and category suggestions (opt-in)

When you grant consent and use the camera scanning feature, the captured photo is sent to our AI service provider (OpenAI via AIProxy) solely for the purpose of extracting the receipt or product details. Images are not stored on our servers and are not used for training.

With your AI consent, category suggestions can also send entered expense titles and category information to OpenAI via AIProxy. When you use batch categorization, the request can include expense titles, amounts, current categories, and merchant details when present. This data is used to suggest appropriate expense categories.

Monthly summary emails (opt-in)

If you enable Email me a monthly summary in Edit Profile, we send a verification email to the address you provide. Monthly summaries are queued only after you confirm that address. You can use Money Pot without enabling this feature.

To provide the service, our backend processes your email address, language preference, subscription and verification identifiers, and the summary prepared by your device. The summary includes the month, spending totals and category breakdowns, asset names and values, and net-worth information. It does not upload a copy of your entire local database.

Cloudflare Workers and D1 host the subscription and delivery queue; Resend receives the recipient address and email content to send the verification and summary emails. Firebase App Check verifies requests from the app. We use this information to provide the requested emails, manage your subscription, and prevent abuse. See the Cloudflare privacy policy and Resend privacy policy for their data-handling practices.

Retention and stopping emails

We retain your email address and subscription details while the email subscription is active. Unconfirmed sign-ups are scheduled for removal after 24 hours.
Summary content stays in the delivery queue until the email provider accepts it or five delivery attempts fail. At that point, the financial email body is cleared from our queue. Remaining delivery metadata is scheduled for cleanup 90 days after the queue entry was created.
Turn off the monthly-summary toggle in Edit Profile or use the unsubscribe link in an email to stop future summaries and delete the server-side subscription and queued messages. If the app cannot reach the server, it saves the deletion request for retry; the email unsubscribe link is also available independently of the app.
We retain a hashed suppression record of the email address to honor the opt-out. This record has no automatic expiry; it is removed if you later verify a new subscription for that address. Short-lived rate-limit records are scheduled for cleanup after two days.

These queue-deletion rules apply to our backend. Unsubscribing does not recall emails already sent to your inbox or erase copies subject to an email provider’s own retention policies. Contact us below with questions about your email subscription or deletion of its data.

Analytics & diagnostics

Money Pot uses a small number of third-party services to understand how the app is used and to keep it stable and reliable:

Firebase Analytics (Google) — collects anonymous, aggregated usage events (such as which screens are opened) to help us improve the app. This build uses the ad-identifier-free variant of Firebase Analytics: it does not collect the Advertising Identifier (IDFA) and does not track you across other companies’ apps or websites.
Firebase Crashlytics (Google) — collects crash and diagnostic reports so that we can find and fix bugs.
Adapty — manages in-app subscriptions and purchases, including purchase history and subscription status.

These services may process a device-scoped identifier and interaction data linked to your app installation. None of this data is used to track you across apps or websites owned by other companies: Money Pot does not use the Advertising Identifier (IDFA) or App Tracking Transparency.

Contact

For questions about this policy, please contact: apputopiacy@gmail.com