Privacy policy

1. Who we are and what this covers

Penny: Money Together is provided by Hastings Dynamics Ltd, company number 13958053, 124 City Road, London EC1V 2NX, United Kingdom. We are responsible for the personal data we process to provide Penny and respond to you. Contact us at hello@support.hastingsdynamics.com.

This notice covers the Penny apps, their beta versions, these Penny web pages and Penny support. Apple and any bank you connect also process information under their own privacy notices. This policy does not replace those notices.

Current availability: Penny is in a private beta. Manual accounts, CSV import and iCloud features are available for testing. Apple has granted Penny’s FinanceKit entitlement. TestFlight enables personal Wallet imports on eligible iPhones after you review the data-use disclosure and authorise access. Wallet records cannot enter household shares in this version.

2. Information Penny processes

• Financial records you enter or import: account names, institutions, account types, balances and currencies; transaction dates, descriptions, merchants, amounts, status and source identifiers; categories, rules, notes and split allocations.
• Planning information: budgets, savings goals, recurring-expense plans, reminder preferences and manually recorded settlements. Savings goals are records of a plan, not transfers of funds.
• Sharing and sync information: your iCloud user identifier, household membership and participant identifiers, selected shared records, device importer registration, Wallet consent choices and withdrawal markers, and sync metadata.
• On-device AI: questions, answers, cited facts, automatic categories, reviews, budget drafts, processing-device selection and queue metadata. These remain personal.
• Subscription information: Apple-signed transaction and entitlement information, such as product identifiers, purchase dates, renewal/expiry and revocation status. Apple handles payment-card details; Penny does not receive them.
• Support information: your email address and the message, device details or attachments you choose to send. Please do not send bank credentials, full statements, account numbers or other people’s financial information.

The demo uses fictional records in a separate local workspace. Penny processes CSV files on your device. Selecting a CSV does not upload the original file to us; the imported records can sync through your iCloud account.

3. Why we use it

Penny uses records to display your accounts, organise and search transactions, calculate spending and budgets, apply your categorisation rules, plan expenses, and provide the sharing you request. Categorisation and financial calculations run on device. There is no third-party advertising SDK, external AI processing or in-app analytics service in the current app.

Where UK data-protection law requires a lawful basis, we rely on performing our contract with you to provide requested app features and membership; your consent for optional access, sharing and notifications where required; our legitimate interests in answering support requests, protecting the service and investigating faults; and legal obligations where records must be retained by law. You can withdraw optional consent without affecting the lawfulness of processing before withdrawal.

Penny does not make lending, insurance, employment or other decisions with legal or similarly significant effects about you.

On-device AI

Penny uses Apple’s on-device model to fill uncategorised transactions, explain recorded spending and prepare budget drafts. It requires compatible hardware, iOS/iPadOS 26 or macOS 26 or later, a supported language, and Apple Intelligence enabled with its model downloaded. Existing categories, rules and your edits take precedence. You approve budget changes; AI cannot initiate payments or make investment decisions.

On-device AI defaults to enabled when an eligible device becomes available unless you previously turned it off. Settings lets you disable it or select a processing device. Questions from an unsupported iPhone wait in private iCloud for Penny on the selected Mac. Penny must be running there; delivery is not immediate when a device is asleep, offline or still syncing. We do not use Private Cloud Compute or third-party AI as a fallback.

Inference runs locally on your selected device using saved personal records. Questions, answers, supporting facts, categories and plans sync through your private CloudKit database. AI records are not included in household shares, and processing does not expand Wallet access. We do not use your questions or finances to train our own model.

Turning AI off cancels unfinished work once devices receive the setting. Saved results remain. Insights provides export and deletion of AI history; categories and budgets already applied remain. Deleting source records or withdrawing Wallet continued-use consent removes dependent results and Wallet-derived budgets. Changes reach other devices after syncing; exported copies must be deleted separately. Membership expiry stops new AI generation and budget application while preserving reading, export and deletion.

AI explanations can be mistaken. Penny calculates monetary figures separately and links supporting records. Review the sources and data freshness before acting.

4. Your device and iCloud

Financial records are stored in Penny’s local database. In the current TestFlight app, personal mode requires iCloud sign-in and syncs personal records through your private CloudKit database. Your other supported devices can receive those records when signed in to the same Apple Account. The demo stays separate and does not use this sync.

We do not receive a copy of your private financial database on a developer-operated server. Apple provides iCloud storage, account and network services under its own terms. Penny uses platform data protection and encrypted CloudKit financial fields. We do not claim that every shared field, device backup or exported file is end-to-end encrypted.

Keep your devices and Apple Account secure. Availability and sync timing depend on your connection, iCloud settings and storage quota. Uninstalling Penny is not a request to delete copies in iCloud, on another device or in a backup.

5. Optional household sharing

Partners use separate Apple Accounts and a private iCloud invitation. You choose which account summaries or expenses to publish. A shared summary can include the account name, balance, currency and freshness; shared expenses can include the merchant or description, date, amount, category, payer and allocation. Household budgets, expenses and settlements entered in the shared space are visible to its participants.

Personal notes and unselected account history are not attached to the household share. An invitation does not give the recipient your bank credentials, bank access or FinanceKit permission. Participants with editing access can change shared budgets and expense allocations.

You can withdraw published records, leave a household or revoke a share through Penny’s household controls. Changes and loss of access may take time to reach an offline device. A recipient may retain a copy they previously exported or otherwise saved. Removing your personal records does not automatically delete expenses that someone entered separately in a household.

FinanceKit-derived household data: this is not enabled in the current beta. It requires separate written permission from Apple and a specific disclosure and choice before use. A household invitation or consent to this policy does not override Apple’s restrictions.

6. Apple Wallet and FinanceKit

Penny asks for your permission before reading selected eligible accounts and history through FinanceKit on iPhone. The information includes account identifiers and details, balances and currencies, transaction identifiers, dates, status, amounts, merchant information, original descriptions and available categorisation information. Your bank determines availability and freshness; your consent determines what Penny may access.

Penny does not ask for or store bank login credentials, initiate payments or force a bank to refresh. A card added for Apple Pay alone does not necessarily provide account data to Penny. Import checkpoints stay on the importing device.

Use Settings → Disconnect bank imports to stop future fetching, or manage access through Apple’s Wallet or system controls. Previously imported records remain available. Use Settings → Delete Wallet data to withdraw permission for continued use: Penny stops imports and deletes Wallet accounts, transactions and associated categorisation, notes and Wallet-derived AI results and budgets on that device. Withdrawal markers sync through iCloud and remove old copies when Penny next receives them. Reconnecting requires fresh consent; an old import cannot restore records after a withdrawal has reached the device. Independently entered manual and CSV records are retained. We cannot remove exported files or records held independently by your bank.

Before connecting, you explicitly agree to private iCloud sync and use in Penny on your other Apple devices. Apple’s terms require deletion following withdrawal of continued-use consent within 30 days. Bring every device online and open Penny so it can apply the withdrawal; contact support if a device cannot sync. Wallet records are not published to household shares. If a future approved use changes this, we will update the disclosure and request the required consent first.

7. Apple, support providers and this website

Apple processes purchases, subscriptions, iCloud services and any diagnostics you choose to share with Apple. If Apple makes diagnostic reports available to us, we use them to investigate faults. Penny’s diagnostic messages are designed to exclude financial values and transaction descriptions.

When you contact us, our email service processes the message to deliver and store your request. Only people who need it to handle support, security or legal matters should access it. We may disclose relevant information when legally required or necessary to establish, exercise or defend legal claims.

These pages are hosted by Vercel. Visiting them necessarily involves network information such as an IP address, requested URL, browser/device information and request time. Hosting providers may process technical logs for delivery and security. The Penny pages do not set advertising cookies, include a marketing tracker, or ask you to submit financial data. Following an external link takes you to that provider’s service.

Service providers may process information outside the UK. Transfers for which we are responsible must use an applicable adequacy arrangement or other legally valid safeguards. Apple’s and Vercel’s privacy notices explain their own processing: Apple Privacy Policy and Vercel Privacy Policy.

8. Retention, export and deletion

Your personal ledger remains available until you delete it, subject to any consent withdrawal or legal requirement. Ending a subscription stops paid editing and new imports after entitlement expires; it does not by itself delete existing records. Reading, export and deletion remain available.

Use Settings → Export transactions to save a CSV, or delete an account or choose Delete personal records. Deletion removes the relevant app records, syncs changes when iCloud is available and withdraws your published account data. Independently entered household expenses and copies you or a recipient exported need to be managed separately. Your bank’s own records and Apple’s purchase records are not deleted by Penny.

We retain support correspondence only for as long as reasonably necessary to resolve your request, keep an appropriate record of its resolution, handle a dispute or meet a legal obligation. We remove unnecessary financial attachments when identified. Hosting and Apple service records follow their providers’ retention arrangements. Device and iCloud backups may retain earlier copies under your backup settings. Minimal consent-withdrawal markers contain no financial amounts or descriptions and remain to prevent old Wallet records from returning. After restoring a backup, connect to iCloud and open Penny to receive those markers before using Wallet data.

9. Your rights and choices

Depending on the circumstances, you can request access, correction, erasure, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent. You can manage most ledger information in Penny because we do not hold your private iCloud database. Contact us for help or for a request about information we do hold, such as a support conversation.

We normally respond within one month and may need proportionate information to verify a request. Do not email your bank password or complete financial history as proof of identity. You can also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.

Penny is intended for adults aged 18 and over. We do not knowingly solicit personal data from children through support or this website. Please contact us if you believe a child has supplied information to us.

10. Changes and contact

We will update the date on this page when the policy changes and highlight material changes in the app where appropriate. New optional uses that require consent will not be enabled solely by changing this page.

Email hello@support.hastingsdynamics.com with “Penny Privacy” in the subject, or write to Hastings Dynamics Ltd at the address above. Practical instructions are on the Penny support page.