CoPenny Privacy Policy
Effective November 8, 2026 · One policy for CoPenny on Android and iPhone.
The short version
CoPenny is a budgeting app for couples, built so that we can't read your money.
- Your money stays yours. Amounts, entries, bills, budgets, goals, balances, categories and names are kept on your phone. When you sync with your partner, they are encrypted on your phone first, with keys only your phones hold. Our servers store them locked and cannot read them.
- We never connect to your bank. You enter your money yourself, or read it from a screenshot you choose.
- Screenshots you choose to read are the one exception to encryption. They are read by an AI service and then forgotten; nothing about who sent them reaches it.
- We don't sell your data, show ads, or track you. No analytics, no advertising tools.
| CoPenny can see | Only your phones can see |
|---|---|
| Your email address, and that you signed in with Google | Every amount and entry |
| Which accounts share a Duo | Your bills, budgets and goals |
| When your phone last synced, and how much locked data it holds | Your balances and net worth |
| How many screenshots your account read today | Your names, notes and categories |
| Feedback you send, and problem reports you allow | Your Touch Base days and streaks |
Who we are
CoPenny is made by Ephrem, its lead developer, working independently ("we", "us"). Questions about privacy go to privacy@aymro.dev.
What stays on your phone
Everything you enter is kept in a database on your phone. CoPenny works fully without an account or a connection: it plans your month, tracks bills and budgets, and keeps your history on the phone itself. Settings of the phone, such as hiding amounts, bill reminders and the lock, never leave it. Deleting the app deletes what is on that phone.
Accounts
An account is optional. You need one to sync with your partner and to read screenshots; you can use everything else without one. You sign in with Google. We keep your email address and the identifier Google gives us for your account. We don't keep your name on our servers: your partner sees it because it travels inside your encrypted data.
What is end-to-end encrypted
When you sync, your phone sends its changes so your partner's phone can receive them. Before anything leaves your phone, it is encrypted with a key that is made on your phone and never sent to us:
- What you share in a Duo is encrypted with a key only you and your partner hold. Your partner's phone receives it through the invite code you show them, which our servers never see whole: they keep only a locked copy of the key that the code alone opens.
- What is yours alone (your Solo) is encrypted with a key only your own phone holds.
We store and pass on this data in its encrypted form. We cannot read it, and neither can anyone who gains access to our servers. We can see its size, when it was sent, and which account sent it, because we need that to deliver it.
What this means for you: because we cannot read your data, we cannot restore it for you. What you shared in a Duo is also on your partner's phone. Today there is no way to restore your Solo if you lose your phone; a recovery kit is coming, and the app will explain it when it arrives.
Reading screenshots and receipts
When you choose screenshots, or photograph a receipt, to have them read:
- Your phone makes each image smaller and saves it anew, so its hidden details (such as where a photo was taken) stay behind, and sends it to our reader over an encrypted connection (TLS).
- The reader checks that you are signed in and counts the read against your account's daily limit. It keeps that count, a number and a time, for a day or two, and nothing else.
- It sends the image to an AI service, Groq, or Cerebras when Groq is busy, to read the entries in it. The AI service receives the image only: no name, email or account.
- The AI services are used with their data retention turned off: they do not keep the image or what they read from it. The reader writes no image or entry anywhere.
- The entries come back to your phone, where you check each one before it is saved. Your phone remembers what an image gave for 30 days, so reading the same image again sends nothing.
Screenshots are not end-to-end encrypted, because the AI service has to see the image to read it. If you prefer, type every entry instead.
Problem reports and feedback
When something in CoPenny breaks, your phone keeps a short note about it: where in the app it happened, the kind of error, where in the code it came from, how often, and which version of the app on which phone model. The note leaves out numbers, email addresses and web addresses, and never holds names, amounts or notes.
These notes stay on your phone unless you choose otherwise: you can turn on "Send problem reports" in your Profile, or attach them to feedback. Feedback is what you write yourself, sent with the same details about the app and the phone. Both go to our own servers, with your account when you are signed in so we can answer, and are deleted after 90 days, or with your account.
The lock
If you turn on the lock, your phone checks your fingerprint, face or PIN itself. CoPenny only learns whether the check passed. In a browser, the lock uses a passkey kept on that device.
Reminders
Bill reminders are scheduled on your phone by your phone. Nothing about them leaves it.
What we keep, and for how long
- Your account (email and Google's identifier) while you have it.
- Encrypted data: the latest version of each record, while the Duo or Solo it belongs to exists. When the last member leaves a space, it is deleted with all its data.
- Read counts: up to two days.
- Problem reports and feedback: 90 days.
- Network addresses, as any internet service handles them, to deliver data and limit abuse: our hosting provider keeps them in its request and sign-in logs for a period set by our plan (days, not months). We don't keep them anywhere else.
Deleting your account
Write to privacy@aymro.dev from the address you signed in with, and we delete your account, your encrypted data, your read counts and your reports within 30 days. Deleting your account in the app is coming. What you shared in a Duo is also on your partner's phone; deleting your account cannot remove it from there, just as a message you sent stays with the person who received it.
Who else is involved
We use these service providers. Each receives only what is described here, and only to provide its service to us:
| Provider | What it does | What it receives |
|---|---|---|
| Supabase | Hosts accounts, encrypted data, the screenshot reader, reports | Your email, Google's identifier, Duo links, encrypted data, read counts, reports, screenshots in transit |
| Groq, Cerebras | Read screenshots | The images you choose to read, nothing else |
| Sign-in, Google Play | What their own privacy policy describes | |
| Expo | Delivers app updates, and runs the beta inside Expo Go | What their own privacy policy describes |
| Cloudflare | Hosts this website | Visits to the website |
We do not sell or rent personal information, share it for advertising, or use advertising or analytics tools.
Your choices and rights
- Everything you entered is on your phone, and you can change or delete it there.
- Sync, screenshot reading and problem reports are each your choice; CoPenny works without them.
- Ask us for a copy of what we keep about your account, to correct it, or to delete it, at privacy@aymro.dev. We answer within 30 days.
If you live in California or another US state with a privacy law, you have these rights under it, and we do not sell or share personal information as those laws define it.
Children
CoPenny is for adults managing their own money. It is not directed to children under 13, and we do not knowingly collect information from them.
Security
Your money data is encrypted on your phone with keys we never receive, and kept in your phone's secure storage. Everything sent is protected in transit with TLS. No system is perfectly secure, so ours is built so that a breach of our servers reveals nothing about your money.
Changes
If we change this policy, the app shows the new version and asks you to agree before you go on. If a change would let us see more than this policy describes, we will ask first.