Privacy Policy

Last updated: July 1, 2026

In short: Penny is a personal-finance app. You enter your data yourself — we never ask for your bank logins. We use your information to run the app, keep your account secure, and provide the optional AI assistant. We don't sell your data. You can permanently delete your account and all its data at any time from the app.

This Privacy Policy explains how Tigran Nazaryan, acting as an Individual Entrepreneur (IP) based in Yerevan, Armenia ("Penny", "we", "us", or "our"), collects, uses, shares, and protects your information when you use the Penny mobile app and website (together, the "Service").

By using the Service you agree to this Policy. If you don't agree, please don't use the Service.

Contents
  1. Information we collect
  2. How we use your information
  3. Legal bases (GDPR)
  4. How we share information
  5. The AI assistant
  6. International data transfers
  7. Data retention & deletion
  8. Security
  9. Your rights
  10. Children
  11. Changes to this Policy
  12. Contact

1. Information we collect

Information you provide

  • Account information: your name, email address, and a password. Passwords are stored only as a salted cryptographic hash — we never store or see your actual password.
  • Financial information you enter: expenses, income, budgets, tags, recurring items, debts, account names and balances, savings goals, and similar data you choose to record. Penny does not connect to your bank; all of this is entered manually by you.
  • Preferences & settings: currency, language, budgeting strategy, and other in-app settings.
  • AI assistant content: the messages you send to the optional in-app assistant, which may include the financial data described above (see Section 5).
  • Support communications: messages you send us (e.g. via the contact form or email).

Information collected automatically

  • Sign-in with Google (optional): if you choose to sign in with Google, we receive your email address and basic profile information (such as your name) from Google to create or access your account.
  • Technical & usage data: device language, app version, and server-side logs that may include your IP address, timestamps, and request information used for security and reliability.
  • Subscription data: if you purchase a subscription, the app stores and Apple/Google process the transaction. We receive confirmation of your subscription status but never your full payment-card details.

2. How we use your information

  • Provide, operate, and maintain the Service and your account.
  • Authenticate you and keep your account secure (including email verification and password-reset codes sent by email).
  • Power features you use, including the optional AI assistant.
  • Send transactional emails (e.g. verification codes, password-change alerts, welcome messages).
  • Respond to your support requests.
  • Detect, prevent, and address fraud, abuse, and security issues.
  • Comply with legal obligations.

We do not sell your personal information, and we do not use your financial data for advertising.

3. Legal bases for processing (GDPR)

If you are in the European Economic Area or the UK, we process your personal data under the following legal bases:

  • Performance of a contract — to provide the Service you sign up for.
  • Consent — for optional features such as the AI assistant and Google Sign-In. You can withdraw consent at any time.
  • Legitimate interests — to secure, maintain, and improve the Service, where not overridden by your rights.
  • Legal obligation — where we must process data to comply with the law.

4. How we share information

We share information only with service providers ("sub-processors") who help us run the Service, and only as needed. These include:

  • DigitalOcean — cloud hosting and database storage (data hosted in the EU, Frankfurt region).
  • Mailgun (Sinch) — delivery of transactional emails (receives your email address, name, and the email contents).
  • Google — "Sign in with Google" authentication (only if you use it).
  • Anthropic — processing of AI-assistant messages to generate responses (see Section 5).
  • Apple App Store / Google Play — payment processing for subscriptions.

We may also disclose information if required by law, to enforce our Terms, or to protect the rights, safety, and security of our users or the Service. If the Service is ever involved in a merger or acquisition, information may be transferred as part of that transaction, subject to this Policy.

5. The AI assistant

Penny includes an optional AI assistant. When you use it, the messages you send — which may include your financial data — are transmitted to Anthropic (the provider of the underlying AI model) to generate a response. Under Anthropic's commercial API terms, this content is not used to train their models and is retained by Anthropic only for a limited period for abuse-monitoring before deletion. If you prefer not to share data this way, simply don't use the assistant.

6. International data transfers

Your data is stored on servers in the European Union (Frankfurt). Some of our sub-processors (for example, Anthropic and Google) may process data in the United States or other countries. Where required, such transfers are covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

7. Data retention & deletion

We keep your information for as long as your account exists. You can permanently delete your account at any time from Settings → Remove account in the app; this immediately and irreversibly deletes your account and all associated data (expenses, income, tags, and everything else) from our database. We may retain limited records where required to comply with legal obligations or to resolve disputes.

8. Security

We protect your data with industry-standard measures, including encryption in transit (HTTPS/TLS), hashed passwords, access controls, and a database that is not publicly exposed. No method of transmission or storage is 100% secure, but we work to protect your information and to notify you of significant incidents as required by law.

9. Your rights

Depending on where you live (including under the EU/UK GDPR and the California CCPA/CPRA), you may have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate data (most of your data can be edited directly in the app).
  • Delete your data (available in-app via "Remove account").
  • Receive a copy of your data in a portable format.
  • Object to or restrict certain processing, and withdraw consent.
  • Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email us at penny.app.support@gmail.com. We do not sell personal information.

10. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you are between 13 and the age of majority in your jurisdiction, you may use the Service only with the involvement and consent of a parent or guardian. If you believe a child under 13 has provided us with personal data, contact us and we will delete it.

11. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app or by email. Your continued use of the Service after changes take effect means you accept the updated Policy.

12. Contact

Questions about this Policy or your data? Contact the data controller:

Tigran Nazaryan (Individual Entrepreneur)
Yerevan, Armenia
penny.app.support@gmail.com