Privacy Policy

Last updated October 2026

Who we are

Penny (askpenny.co and the Penny apps for iPhone and Android) is run by Malih Dabboussi, an individual based in Tunisia. In this policy “Penny”, “we” and “us” mean the operator of the service, who is responsible for your personal data.

Questions or requests about your data: support@askpenny.co.

What we collect

Account details: your name, email, a securely hashed password (we never store the password itself), whether your email is confirmed, your settings such as currency and notification preferences, and, if you choose to tell us, how you heard about Penny.

The finances you enter: transactions, categories, budgets, accounts and balances, goals, plans, recurring payments, reminders, and your chat messages with Penny. Penny does not connect to your bank — it only knows what you type or scan.

Invoice and receipt photos, when you choose to scan one.

Support messages: what you write to us on the Support screen and any screenshots you add, with your name, email, plan, app version and account ID so we can help you.

Subscription status from the App Store or Google Play, through RevenueCat. Payments are handled by Apple and Google — we never see or store your card details.

Technical data needed to run and protect the service: device type, app version, push-notification tokens, and server logs that include your IP address and the requests your app made.

We don't collect your contacts, location, photos you haven't chosen to scan, or data from other apps.

How we use it

To run Penny for you: record your spending, show balances and analytics, answer your questions, send the reminders and check-ins you turned on, and manage your subscription.

To keep your account and the service secure: sign-in, email confirmation, password resets, rate limits and preventing abuse.

To send service emails (for example confirming your email or resetting your password). We don't send marketing emails without your consent.

Legal basis (where the GDPR or similar laws apply): providing the service you signed up for (contract), keeping it secure (legitimate interests), and meeting legal obligations such as keeping payment records.

How Penny's AI uses your data

When you chat with Penny, your message and a short summary of the context needed to answer it (for example your recent messages, category names and account names) are sent to an AI model provider — OpenAI or Anthropic — to understand what you asked. We don't send your full history.

When you scan an invoice, the photo is sent to OpenAI to read the amount, date and merchant. We process it in memory and don't keep the photo.

These providers don't use data sent through their business APIs to train their models, and may keep it for up to 30 days to detect abuse before deleting it.

To understand you better, Penny learns from your own messages: habits from your answers and corrections (for example that “500” for coffee means 500,000 LBP, or which account you use for taxis) and a short summary of how you use your money, without amounts. They're used only for your account, they're part of the context sent to the AI provider as described above, and they never change your numbers. You can see, delete or pause them anytime in Settings → What Penny knows about you.

To understand everyone better, Penny also learns single misspelled or non-English words (for example “sraft” meaning “spent”). Only the word and its meaning are kept, never your message; a word is used for everyone only after several different people used it the same way and we reviewed it. Nothing is learned while you've paused learning.

The AI never changes your numbers by itself: balances and totals are always calculated by our own systems from what's stored in your account.

Who we share it with

We don't sell your personal data, and we don't share it with advertisers or data brokers.

We use service providers who process data only on our instructions: Railway (servers), Supabase (database, hosted in Frankfurt, Germany), Amazon Web Services (website), our email delivery provider, OpenAI and Anthropic (AI), Apple and Google (push notifications and in-app subscriptions), RevenueCat (subscription status), and Discord (the tool our team uses to read and answer support messages).

Exchange rates come from a public rates service; we only request currency rates and don't send it any of your data.

We may disclose data if the law requires it, or to protect the rights and safety of our users and the service.

We don't show ads in Penny.

Where your data is processed

Your data is stored in the European Union and may be processed in the United States and other countries where our providers operate. Where data leaves your country, we rely on our providers' contractual safeguards, such as the European Commission's Standard Contractual Clauses.

Cookies and local storage

Penny uses only what's needed to work: keeping you signed in and remembering display preferences such as theme. We don't use analytics, advertising or tracking cookies.

How long we keep it

We keep your data while your account exists — including while it's locked after a trial or subscription ends, so everything is there if you subscribe again. If you don't want that, delete your account.

You can delete your account and all its data at any time: in the app (Settings → Delete account) or on the web at https://spendings-ai-chat-production.up.railway.app/account/delete. Your profile, transactions, chats, goals, support messages and screenshots, and other personal data are deleted immediately, including the copy of your support conversations in Discord. Backup copies are overwritten within 30 days. Payment and usage records we must keep for accounting are kept without your name or email.

Deleting your account doesn't cancel an App Store or Google Play subscription — cancel it in your store account.

Keeping it safe

Data is sent over encrypted connections (HTTPS). Passwords and one-time links are stored only as hashes. Access to production systems is limited and protected with two-factor authentication. No system is perfectly secure, but if a breach affects your data we'll tell you and the authorities as the law requires.

Your rights

You can view and edit your data in the app and change notification settings anytime.

In Settings → What Penny knows about you, you can see what Penny has learned, delete any of it, forget everything, or stop her learning.

You can also ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to you in a portable format. Email support@askpenny.co from the address on your account; we answer within 30 days.

You can complain to a data-protection authority — in Tunisia the Instance Nationale de Protection des Données Personnelles (INPDP), or the authority in the EU country where you live.

Children

Penny isn't meant for children under 16, and we don't knowingly collect their data. If you think a child has created an account, contact us and we'll delete it.

Changes to this policy

If we change this policy we'll update the date at the top. For significant changes we'll tell you in the app or by email before they take effect.

Contact

Malih Dabboussi (Penny) · support@askpenny.co