Privacy Policy
Effective September 7, 2026
Money Tracker is built so that your financial data stays on your device. This policy explains the small amount of data that does leave your device, why it does, who processes it, and the choices you have.
1. Who we are
Money Tracker (the “App”) and this website are operated by Macaroni Studios LLC (“Macaroni Studios”, “we”, “us”). We are the data controller for the personal data described in this policy. You can reach us at support@macaroni-studios.com.
This policy applies to the App for iPhone, to this website, and to purchases made through either. Your use of the App is also governed by our Terms and Conditions.
2. The short version
- Your transactions, balances, budgets, and categories are stored only on your device in an encrypted database. We do not keep a server-side copy of your financial history.
- You do not need an email or password. The App creates an anonymous account identifier so your subscription and any bank connections can be restored.
- Bank sync is optional. If you connect a bank, Plaid retrieves your data and our server passes it straight to your device without storing it.
- AI features run on your device. Receipt scanning, transaction categorization, and the assistant use Apple on-device models. Your transactions are never sent to a cloud AI service.
- We do not sell your data, show ads, or track you across other apps.
3. Data that stays on your device
The following is stored exclusively in an encrypted SQLite database on your phone. The encryption key is generated on the device, kept in the iOS Keychain, and excluded from cloud backups.
- Accounts, balances, and account names or masks you enter or import
- Transactions, including merchant names, amounts, dates, notes, categories, and tags
- Budgets, spending goals, recurring items, and categorization rules
- CSV files you import and receipt photos you scan (processed locally and not uploaded)
- Your preferences, such as currency, text size, and notification settings
Optional Face ID, Touch ID, or device passcode locking is handled entirely by your operating system. We never receive biometric data.
Deleting the App destroys this database together with its encryption key. You can also export your transactions as a CSV file at any time from within the App.
4. Data we collect and why
The table below lists every category of data that leaves your device, the reason, and where it is held.
| Data | Purpose | Where it is processed |
|---|---|---|
| Anonymous account identifier | Created automatically on first launch so that your subscription and bank connections can be restored. It is not linked to your name, email, or phone number. | Supabase (authentication and database hosting) |
| Bank connection credentials and metadata | If you connect a bank, an encrypted access token, the institution name, connection status, and a sync cursor are stored so the connection can be refreshed and re-authorized. | Plaid (data aggregator) and Supabase (encrypted at the application layer) |
| Bank transactions and balances in transit | Retrieved from Plaid by our server, normalized in memory, and returned to your device. They are not written to server-side storage. | Our serverless functions on Supabase, momentarily |
| Subscription and entitlement records | To know which plan you are on and to restore purchases across devices. Includes an anonymous app user ID, plan, and renewal state. We never see your card number. | RevenueCat, Apple App Store, Google Play, and Paddle (for web purchases) |
| Push notification token and a random device ID | Only if you enable notifications, so that budget alerts and reminders can be delivered. | Expo Push Service and Supabase |
| Product analytics events | Event names, screen names, app version, device model, OS version, and your anonymous ID. Used to understand which features are used and to improve the App. Contains no amounts, merchants, account details, or transaction content. | PostHog |
| Crash and error reports | Stack traces, app version, device model, OS version, and your anonymous ID, so we can fix bugs. IP addresses and personal data are stripped before sending. Session replay and screenshots are disabled. | Sentry |
| Referral fraud signals | If you redeem a referral code, a one-time Apple DeviceCheck token and a hashed device vendor identifier are sent to prevent the same device from redeeming repeatedly. | Apple and Supabase |
| Support messages | If you contact us from the App, your message, the email address you provide, and basic diagnostics (app version, device model, OS version) are emailed to our support inbox. | Resend (email delivery) and our email provider |
| Web checkout details | If you subscribe on this website, Paddle collects your email, billing country, and payment details as the merchant of record. We receive a transaction reference, not your payment details. | Paddle |
Exchange rate and security price lookups are made by our server against public market data feeds and contain no personal data. App updates are delivered through Expo Updates, which receives the app version and platform when checking for an update.
5. Legal bases for processing
Where the GDPR or UK GDPR applies, we rely on the following bases:
- Performance of a contract for the anonymous account, subscription records, bank connections you initiate, and notifications you enable.
- Consent for bank connections (given through Plaid Link), for notifications (given through the system prompt), and for analytics and crash reporting where required by law.
- Legitimate interests in keeping the App reliable and secure, preventing referral fraud, and understanding aggregate feature usage. These interests are balanced against your rights and never involve your financial data.
- Legal obligation for retaining subscription and tax records.
6. Bank connections through Plaid
When you choose to connect a bank, you authenticate directly with Plaid. We never see your bank username or password. Plaid’s handling of your data is governed by the Plaid End User Privacy Policy. By connecting a bank you grant Plaid the right to access and transmit your financial information to us as described in that policy.
You can disconnect a bank at any time from Settings. Disconnecting revokes the access token at Plaid, blanks the stored ciphertext, and deletes the connection metadata. Transactions already downloaded remain on your device until you delete them. You can also manage connected apps directly at my.plaid.com.
8. Tracking, advertising, and cookies
The App does not contain advertising, does not use the advertising identifier, and does not track you across other companies’ apps or websites. It does not request App Tracking Transparency permission because it has no reason to.
This website uses only strictly necessary cookies set by Paddle during checkout. We do not run advertising or cross-site tracking cookies.
9. How long we keep data
| Data | Retention |
|---|---|
| Financial data on your device | Until you delete it, disconnect the bank, or delete the App |
| Bank access tokens and connection metadata | Life of the connection; destroyed when you disconnect or delete your account |
| Subscription and entitlement records | Duration of the subscription, then up to 7 years where required for tax and financial record keeping |
| Push notification tokens | Until you disable notifications or delete your account |
| Product analytics events | Up to 24 months |
| Crash reports and server logs | 30 days, then automatically purged |
| Support correspondence | 24 months from resolution |
Access tokens, secrets, and transaction detail are never written to application logs. Our full Data Retention and Disposal Policy is available on request.
10. Deleting your account
You can delete your account from within the App under Settings. Deletion is immediate and does the following in order: revokes every bank connection at Plaid, deletes your server-side records including subscription links and push tokens, removes the anonymous account, and wipes the local database on your device.
Purchases remain with Apple, Google, or Paddle according to their own policies. Deleting your account does not cancel an active subscription; cancel it through the store or Paddle first if you do not wish to be charged again.
If you cannot access the App, email support@macaroni-studios.com and we will delete your server-side records within 30 days. We acknowledge requests within 7 days.
11. Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you and receive a copy
- Correct inaccurate data
- Delete your data (see Section 10)
- Restrict or object to processing, including analytics
- Data portability (the App exports your transactions as CSV at any time)
- Withdraw consent at any time, without affecting processing that happened before withdrawal
- Lodge a complaint with your local supervisory authority
California residents. We do not sell or share personal information as defined by the CCPA/CPRA, and we have not done so in the preceding 12 months. You have the right to know, delete, and correct, and to be free from discrimination for exercising those rights.
EEA, UK, and Swiss residents. Our service providers are located in the United States. Transfers rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-US Data Privacy Framework where the provider is certified.
Because your account is anonymous, we may ask you for the support ID shown in the App’s Settings so that we can locate your records. To exercise any right, email support@macaroni-studios.com.
12. Security
Your local database is encrypted with AES-256. Bank access tokens are encrypted with AES-256-GCM at the application layer before being stored, on top of encryption at rest. All traffic between the App, our servers, and our providers uses TLS. Access to production systems is restricted and logged. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.
13. Children
The App is not directed to children and is intended for users who are at least 18 years old or the age of majority where they live. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with data, contact us and we will delete it.
14. Changes to this policy
We will post any changes on this page and update the effective date. If a change materially affects how we use your data, we will also notify you in the App before it takes effect. Continued use after the effective date means you accept the updated policy.
15. Contact
Macaroni Studios LLC
support@macaroni-studios.com