Pennywise - Privacy Policy

Draft. This is a working draft written against what the code actually does, intended as the starting point for the policy you publish on the Play Store / App Store and link from the app. Have a lawyer review it for your jurisdiction before shipping - Kenyan Data Protection Act (2019) and Google Play’s restricted-permission policy for READ_SMS both apply, and this document is not legal advice.

Last updated: [DATE]

Summary

Pennywise analyzes the financial transaction alerts in your SMS messages - M-PESA sends, receives, pay-bill and buy-goods messages, and bank debit and credit alerts in shillings or dollars - entirely on your device to categorize your spending. Your messages and the financial ledger they produce are not uploaded to our servers. The only data that leaves your device is the anonymous request made to download the on-device AI model, described below.

What we access

• SMS messages. With your permission, Pennywise reads your SMS inbox to detect transaction alerts: M-PESA money sends, receives, pay-bill and buy-goods messages, and bank debit and credit alerts in shillings or dollars. These are parsed on-device into transactions. We do not read personal messages unrelated to transactions, and nothing is uploaded.
• Microphone (optional). If you use voice input, audio is processed for speech recognition on-device.
• Notifications (optional). Used to tell you when a model download finishes or a background task completes.

What we store, and where

• Transactions, categories, budgets, subscriptions, and your chat history with Penny are stored in an encrypted-at-rest SQLite database on your device. They stay there until you delete them or wipe the app.
• Settings and preferences are stored locally on your device.

What leaves your device

• Model-download requests. When you download the on-device AI model, the app contacts our model server. That server receives:

  • an anonymous, per-install random identifier (not your phone number, name, or accounts),
  • your app version and device platform,
  • a device-integrity attestation token (Play Integrity on Android, App Attest on iOS) used to confirm the app is genuine,
  • your IP address, which is salted-hashed before it is written to any server log and used only for rate-limiting and abuse prevention.

  The model server does not receive your transactions, your SMS, or your ledger.

• Backups and exports are your choice. “Backup Database,” “Export CSV,” “Export SMS Backup,” and “Export Diagnostics” use your device’s share sheet. The file goes wherever you send it (cloud drive, email, another device). We never see it unless you send it to us.

Crash and error reporting

• Unhandled errors are written to a local log on your device. This log is never uploaded automatically. You can share it voluntarily via Settings → Export Diagnostics, and you choose the destination.

Data you delete

• Wipe All Data in Settings deletes your transactions, categories, budgets, subscriptions, rules, balloons, and chat history from the device. This cannot be undone and does not affect any backup file you already exported.

Children

Pennywise is not directed at children under 13, and we do not knowingly collect data from them.

Changes

If this policy changes materially, we will update it here and in the app’s About screen.

Contact

Questions about this policy: [CONTACT EMAIL / ADDRESS]