Privacy Policy

Effective 27 October 2026. Last updated 29 October 2026.

Pennyroot is a personal finance app for iPhone, iPad, Apple Watch and Mac, made by Tolga Unal, an independent developer. It has no account to create, no server of its own, no analytics, no ads and no tracking, and it contains no third-party code that collects data.

Your records stay on your devices and in your own private iCloud. The developer cannot see them.

The short version

No personal data is collected. Nothing you enter in Pennyroot is sent to the developer.
Your records are stored on your devices and, if iCloud is on, in the private database of your own iCloud account.
Apart from Apple's own services (iCloud and the App Store), the only request Pennyroot makes to the internet is for exchange rates, only when you ask for it, and it contains a currency code and nothing else.
Purchases go through Apple. The developer never sees your payment details.
If you use a shared ledger, only that ledger is shared, with the people you invite, through Apple's iCloud.

What Pennyroot stores, and where

Pennyroot stores what you enter: accounts, transactions (amount, date, payee, note, category and tags), categories, budgets, savings goals, repeating transactions and bills, quick add buttons and your settings.

On your device. Every device you use keeps its own copy.
In your private iCloud, if iCloud is on. Pennyroot uses Apple's CloudKit to keep your iPhone, iPad, Apple Watch and Mac in sync when they are signed in to the same Apple Account. Your records go into the private database of your own iCloud account. Apple stores them under Apple's privacy policy. The developer has no access to that database and cannot read, copy or delete anything in it.
Shared settings, such as your main currency, exchange rates and the day your month starts, sync the same way through your own iCloud key-value storage.
Settings for one device only: App Lock, Hide amounts and the theme stay on the device where you set them.

If you are not signed in to iCloud, or iCloud is off for Pennyroot, your data stays on that device only.

Shared ledgers

If you start a shared ledger and invite people, that ledger (its accounts, categories, budgets and entries, and the name each person chose to show next to what they add) is kept in a separate area of your private iCloud database and shared with the people you invite through Apple's CloudKit sharing. They can see and add to that ledger only. Your other accounts and records are never part of it.

If you join someone else's ledger, it is kept in their iCloud, and what you add to it is stored there too. The person who started a ledger can remove people or delete it; deleting it removes it for everyone. If you leave a ledger or are removed, its copy is deleted from your devices, and what you added stays in the ledger. The developer has no access to shared ledgers either.

Widgets, Apple Watch complications, Siri and Shortcuts

Widgets and complications do not open your records directly. The app writes a summary (what is left today, your budgets, upcoming bills, goals, net worth, quick add buttons and your most recent transactions) into a container that Pennyroot shares with its own widgets on the same device, and the widgets read it from there. This summary never leaves the device. When Hide amounts is on, the widgets on that device hide amounts too.

Answers to Siri and Shortcuts come from the data on your device. While App Lock is on, Pennyroot does not give Siri any amounts. How Apple handles your voice request is covered by Apple's privacy policy.

Exchange rates

Accounts in other currencies need exchange rates. You can type rates yourself, and then nothing is sent anywhere.

If you tap Update from the European Central Bank (Settings › Exchange rates), Pennyroot asks the Frankfurter service (api.frankfurter.app), which publishes the European Central Bank's daily reference rates. The request contains only your main currency code, for example EUR. As with any request on the internet, that service can see your device's IP address. No account names, amounts or other details are sent, and Pennyroot never contacts the service on its own.

Notifications

Bill reminders and budget alerts are scheduled by Pennyroot on your device. There is no server that sends them. When iCloud has new data for you, Apple's push service can wake Pennyroot in the background so it can sync. That signal comes from iCloud, not from the developer.

App Lock

App Lock uses Face ID, Touch ID or your device passcode through Apple's LocalAuthentication framework. Pennyroot only learns whether unlocking succeeded. It never sees or stores your face, fingerprint or passcode.

Files you import and export

CSV exports and backups are created on your device and saved only where you choose. CSV files and backups you open in Pennyroot are read on your device. Pennyroot does not upload them anywhere.

Purchases

Pennyroot Pro is an auto-renewing subscription sold by Apple through the App Store. Apple handles the payment. The developer never receives your payment details. Pennyroot checks whether your subscription is active with Apple's StoreKit, on your device.

Optional features

The features below stay off until you choose to use them. Some depend on your device, your region or what Apple offers there.

Location on a transaction

Off by default. When you tap Add location on a new transaction, or turn on adding it to every new transaction in Settings, Pennyroot asks for permission to use your location while you are using the app, and saves the place with that transaction in your data (on your device and in your iCloud). It is not used for anything else and is never sent to the developer. You can remove the place from a transaction or turn the setting off at any time, and you can take back the permission in your device's Settings.

Receipt photos and receipt scanning

If you choose to attach a photo or scan a receipt with the camera, the text on it is read on your device with Apple's Vision framework to fill in the amount and date. The photo is saved with that transaction in your data. It is not sent anywhere else.

Typing a transaction in plain words

If you choose to type something like “coffee 4.50 yesterday”, Pennyroot works out what you mean on your device: with Apple's on-device model where it is available, and with built-in rules everywhere else. Nothing you type is sent to a server.

Live Activity

If you choose to show what is left today as a Live Activity on the Lock Screen, it is created and updated on your device.

Apple Card, Apple Cash and Wallet

Where Apple offers it, Pennyroot can read transactions from Apple Card, Apple Cash and other supported accounts in Wallet, but only after you give your explicit permission. Access is read-only and happens on your device. Transactions you bring in this way are stored like any other transaction in your data. You can take back the permission at any time.

AI assistant helper on Mac

Off by default. If you turn it on in the Mac app, a small helper on the same Mac can answer read-only questions about your data from an AI app that you connect to it yourself. Pennyroot itself sends nothing anywhere. However, whatever the helper gives the connected AI app is then handled under that app's privacy policy, not this one. You choose whether payee names and notes are included, and you can turn the helper off at any time.

What is not collected

No personal data is collected. There is no Pennyroot account, no analytics, no advertising, no tracking across apps or websites, no sale or sharing of data and no third-party SDK.

If you have chosen in your device settings to share analytics with app developers, Apple may give the developer anonymous crash reports and usage statistics. These come from Apple and do not include your records.

Deleting your data

You can delete any record inside the app. Deleting the app removes its data from that device.

To remove the copy in iCloud on iPhone, open Settings › [your name] › iCloud › Manage Storage (the wording can differ slightly between versions), choose Pennyroot and delete its data. If Pennyroot is still installed with iCloud on another device, that device can upload its copy again, so delete the app there first.

The developer holds no copy of your data, so there is nothing to delete on our side.

Children

Pennyroot collects no personal data from anyone, including children.

Changes to this policy

If this policy changes, the new version will be posted on this page and the date at the top will change.

Contact

Questions about privacy: contact@tolgaunal.com. Pennyroot is made by Tolga Unal.