PennyBook is built so that we couldn't see your money even if we wanted to. The app has no servers, no accounts, and contains no networking code: it has no way to send anything anywhere.
What we collect
Nothing. PennyBook collects no personal data, no financial data, no analytics, no crash reports, no identifiers, and no usage statistics. Not from anyone, ever.
Your book
Your entries, wallets, balances, categories and budgets are stored only on your iPhone, in the app's own storage.
There is no sign-in and no bank connection. PennyBook never asks for a bank login and never talks to a bank.
If you back up your iPhone (to iCloud or to a computer), the book is part of that backup, the same as any app's data. That backup is yours, protected by Apple under your Apple Account; we have no access to it.
You can export the whole book as a CSV file to a place you choose, and you can erase everything from Settings at any time.
Bank messages
PennyBook cannot read your messages. iOS does not allow it, and we would not want it to.
It reads only the text you paste into it, or the text a Shortcuts automation that you set up hands to it. That text is read on your iPhone, kept with the draft so you can see what was understood, and never transmitted.
Messages that look like one-time passwords are refused and not stored.
Face ID and Siri
The optional lock uses Face ID, Touch ID or your passcode through iOS. The app only learns whether you passed; it never sees your face or fingerprint data.
If you ask Siri to log an expense, your request is handled by Apple under Apple's privacy policy before it reaches the app, as with any Siri request. PennyBook itself sends nothing.
Purchases
PennyBook is not yet on sale. When it is, the one-time purchase will be processed entirely by Apple through the App Store. We will never see your payment details, and Apple's privacy policy will govern that transaction.
Children
PennyBook collects no data from anyone, including children.
Changes
If this policy ever changes, the updated version will be posted at this address with a new effective date. Since the app has no way to send data, any future change could only apply to future versions of the app.