Privacy policy

Effective date: 2026-11-12

Pennow is operated by Pennow in US. This policy covers the Pennow mobile app, our cloud service and our website. Contact support@pnnnow.app about privacy or your data.

Local bookkeeping

You can keep a ledger without an account. Entries, account names, categories, budgets, recurring entries, items and preferences are stored on your device. Local bookkeeping alone does not upload your ledger to Pennow. Exports and backups you create are files under your control. App lock uses device authentication; Pennow does not receive your biometric template or device passcode.

Accounts and cloud sync

When you sign in, we process your sign-in email or the identity supplied by Apple or Google, an account identifier, authentication tokens and a device identifier. We use these to authenticate you and protect access. Our account database stores a hash of the sign-in identity rather than the full email address; the login email provider receives your address to deliver a code. Your device can retain your email for display.

If you enable sync, your ledger records and their sync metadata are sent to our server so that your devices can share them. These may contain financial amounts, currencies, account labels, merchants, notes and item information. Turning sync off stops subsequent sync; it does not delete data already stored in your cloud account. Use account deletion to remove it.

AI and voice

When you request official AI entry, the text or receipt image you submit, and relevant context such as categories, account names, currency, time zone and the current date, are sent through Pennow to US to produce structured entries. Review the result before saving. We do not retain raw AI input, uploaded images or model responses in the application database or application logs. A structured result may be cached for retry handling; its reuse expires after 24 hours, and expired rows are removed on subsequent processing or account deletion.

With your own AI provider, requests go directly from your device to the provider you configure. Your API key is kept in the device's protected credential storage and is not sent to Pennow. That provider's policies and charges apply to your use. If you configure a local-network HTTP endpoint, that connection is not encrypted; use it only on a network you trust. Choose what you include in an AI request; a receipt or note can contain other people's information.

The app's microphone entry uses supported on-device speech recognition. The app does not upload that recording to Pennow; the resulting text is sent only when you submit it for AI entry. If on-device recognition is unavailable, this feature is unavailable. Camera and photo access occur when you choose those input methods.

If you link a supported messaging bot, we process the platform's account/chat identifier and messages or attachments you send to the bot. Incoming messages are queued in encrypted form until processing; structured replies are retained temporarily for delivery retries and ordinarily cleared after 24 hours, with deduplication metadata retained for up to 30 days. Bot audio transcription, when enabled, is provided by US. The messaging platform also processes your messages under its own policy. Unlinking stops future bot access; deleting Pennow does not erase copies held in your messaging account.

Subscriptions

Google Play or the Apple App Store processes your payment. We do not receive your full payment card number. RevenueCat processes an app user or anonymous identifier, purchase and subscription history, entitlement status and technical information needed to provide purchases, restores and subscription analytics. The SDK may contact RevenueCat when loading plans even before you subscribe. Pennow does not send ledger content or your own AI API key to RevenueCat. See RevenueCat's privacy policy.

Security, service providers and transfers

We use device verification through Google Play Integrity or Apple App Attest, authentication and limited abuse-prevention records to protect our services. These can include a device identifier, verification public key, counters and integrity verdicts. Verification challenges are short-lived; expired challenges are removed by periodic cleanup. IP addresses are processed for network delivery and abuse prevention; application rate-limit keys use hashes. Operational error reporting sends fixed failure codes, time and version rather than ledger contents or request bodies.

Our hosting provider is US in US. Automated offsite backups are currently disabled. Sign-in email delivery is provided by US, and optional operational error reporting by Sentry. We use these providers to operate the service, and Apple, Google, RevenueCat and your chosen messaging or AI services for the functions described above. Data may be processed outside your country. Applicable safeguards and your statutory rights continue to apply.

Connections to the official cloud service use HTTPS. Backups, when enabled, are encrypted and access is restricted. Cloud sync is not end-to-end encrypted: Pennow's server processes your records to provide the service. No storage or transmission method is completely secure. We do not sell your ledger data, run advertising SDKs or use your ledger for advertising profiles.

Retention and deletion

Deleting an individual synced record sends a deletion marker to your other devices. That marker can retain the record's last contents until you delete your cloud account. Deleting a record is therefore different from erasing the cloud account and all its synced data.

Cloud ledger data is retained while your account exists. Delete your account in the app or request deletion without reinstalling it. Confirmed deletion removes your live Pennow account, synced records, sessions, bot links and access tokens. We queue removal of your RevenueCat customer record and retry until its deletion is confirmed; provider processing can take additional time. A minimal provider identifier remains in that queue only until completion. Hashed deletion receipts are retained for 30 days so a lost response can be safely retried. You may temporarily be unable to recreate the same account while provider deletion is pending.

Automated offsite backups are currently disabled. If backups were previously created, disabling the jobs does not delete those copies; they remain restricted to recovery and follow the storage provider's retention settings. They are not used to restore a deleted account to active service. We may retain information specifically required by law, or necessary to resolve a dispute or prevent abuse, and will explain any applicable exception in response to your request. Google, Apple and other independently controlled services can have their own legally required retention.

Deleting a cloud account does not cancel a store subscription. You can cancel in your store's subscription settings independently of deletion. You can choose whether to remove local data on the device used to delete the account. Copies on other devices, exported files and messages remain under your control; remove those separately. Uninstalling the app alone does not delete your cloud account.

Your choices and rights

You can use local bookkeeping, choose whether to sign in or sync, revoke camera or microphone permissions in device settings, use your own AI provider, unlink integrations and export your ledger. Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, obtain a portable copy, withdraw consent where consent is the basis, or complain to your data protection authority. Contact support@pnnnow.app; we verify requests to protect the account and do not ask for passwords or API keys.

We process account and requested service data to provide the service, protect the service under legitimate interests where applicable, honor permission choices, and meet legal obligations where required. Pennow is not directed to children under 13, or a higher minimum age required in their jurisdiction. Contact us if you believe a child has provided personal information. We will post changes here with a new effective date and provide additional notice where required.