The security page describes the technical controls in more detail.
MyMoneyConcierge is developed and operated by SmartHarmony AI LLC, the controller of the limited personal information described here. For any privacy question or request, contact support@smartharmonyai.com.
Your accounts, balances, transactions, categories, budgets and budget history, goals, notes, rules, receipt photos, insight reports and settings. They are kept in an encrypted database (SQLCipher, AES-256) whose key is created on your phone and held in the iOS Keychain or Android Keystore — or, for receipt photos, in your phone's own encrypted storage. They stay until you delete them. Backups and exports (CSV, archive, PDF) go only where you choose to save or send them; we cannot reach those copies.
Reminders are scheduled on your phone and never show an amount, payee, account or goal name. The app uses no push-notification service and does not collect a push token. If you use Face ID or fingerprint, your phone checks it and tells the app only whether it matched. We do not collect your precise location or your contacts.
| When | What | Who receives it | Why |
|---|---|---|---|
| Whenever the app talks to our server | An app-generated identifier for your subscription, a device identifier, app version and platform. Your IP address reaches our server with each request and is used briefly for rate limiting | Our server, hosted by Cloudflare | Secure requests and prevent abuse |
| You connect a bank (optional, Connected plan) | You sign in to your bank inside Plaid's screen. Plaid sends us your account names, balances, transaction history and institution; they pass through our server to your phone and are not stored on our server | Plaid; Cloudflare (in transit) | Import your transactions |
| While a bank is connected | A Plaid connection identifier, an encrypted access token, connection status and timing, and the number of linked accounts | Our server (Cloudflare) | Keep the connection working, and end it when your plan ends |
| The app starts for the first time, and about once a day after | A random trial identifier and the trial start date, kept on your device in the Keychain (iPhone) or Block Store (Android) so that reinstalling does not restart the trial. To check that the request comes from a genuine copy of the app on a genuine device we send Apple's DeviceCheck token (iPhone) or Google's Play Integrity verdict (Android). We store only a one-way hash of the trial identifier, the start date and whether the trial was granted — no account, name, email, device identifier or IP address | Our server (Cloudflare); Apple (DeviceCheck); Google (Play Integrity); RevenueCat (to record the trial period) | Offer one free trial per device and prevent abuse |
| The app starts | The app asks whether a newer version of its own program code is available. The request carries your IP address, the app version, platform and the identifier of the update already installed — no account, name, email, device identifier or financial data | Expo (update service) | Deliver fixes to the app's code without waiting for a new store release |
| You subscribe or restore a purchase | Purchase information and a random app user identifier | Apple or Google; RevenueCat | Manage your subscription |
| Your subscription changes | Subscription status and dates, linked to the app-generated identifier | Our server, from RevenueCat | Know which features you can use |
| You press Generate or Refresh Insights | Totals and summaries: total assets, debts and net worth; balances by account type; debt balances and terms; monthly income and spending totals; up to 15 category names with amounts; merchant names with totals; recurring-charge names; budget and goal names with amounts. Never individual transactions, descriptions, account names or institutions. The screen says this next to the button | Our server and Cloudflare AI Gateway, then OpenAI (by default) or Anthropic | Write your insight report |
| You turn on Send crash reports automatically (off by default) | Technical details of the crash, app version and device type, with email addresses and long numbers removed | Our own error-reporting service (GlitchTip, Sentry-compatible) | Fix problems |
| You send Report a problem | Your description (email addresses and long numbers removed), app version, device type, and your email address if you choose to give it | Same as above | Help you and fix problems |
| You search for your bank's coverage | The text you type | Our server, then Plaid | Show whether your institution is supported |
| You set up a passkey for bank actions | The passkey's public key (never the private key or your biometric) | Our server | Confirm it is you before a bank is connected |
| iPhone: the app is installed and used | The app gives Apple's attribution system (SKAdNetwork / AdAttributionKit) a single number from 0 to 63 recording how far you have got: installed, finished setting up, started a Personal or Connected trial, or became a paying Personal or Connected subscriber. No identifier, and never any financial information. Apple decides whether the install came from an ad and, days later, reports it to the ad network and to Tenjin only in aggregate, and only when enough installs share the campaign that no one can be singled out | Apple; then, in aggregate, the ad network (for example AppLovin) and Tenjin | Tell which ad campaigns work, without tracking anyone |
| iPhone: you subscribe, or the app starts | A short-lived attribution token issued by Apple (AdServices). RevenueCat exchanges it with Apple and records whether you came from an Apple Search Ads campaign, and which one | RevenueCat; Apple | Measure our Apple Search Ads campaigns. Apple provides this without tracking permission |
| Android: the app is installed and opened — only with Ad measurement on | Platform, system version, device model, build, language, country, time zone, app version, the Play install referrer, basic session counts, and a random installation identifier created by Tenjin. Your IP address reaches Tenjin with the request. The installation identifier is also stored with your RevenueCat record. With Ad measurement off, none of this is sent and Tenjin is never started. | Tenjin; RevenueCat | Tell which ad campaign brought the install |
| Android: you leave Ad measurement ticked on the second screen of setup, or turn it on in Settings (it is ticked by default at setup; untick it there, or turn it off at any time in Settings, and nothing is sent) | In addition: your device's advertising identifier and further device details (such as carrier and screen size). RevenueCat also records your advertising identifier, Android identifier and IP address, and passes your subscription events to Tenjin | Tenjin; RevenueCat | Measure which campaigns lead to installs and subscriptions |
We buy advertising (for example through AppLovin) to reach new users. No advertising network's SDK is in the app and the app shows no ads. On iPhone there is no attribution SDK at all and nothing that identifies you is used for advertising measurement: we see campaign results only as Apple's aggregate reports, and on iPhone we cannot tell which campaign any individual install or subscription came from, except Apple Search Ads as reported by Apple. On Android, Tenjin is the only attribution SDK; turning Ad measurement off stops sharing the identifier from then on, and identifiers RevenueCat already recorded stay with your subscription record until it is deleted (contact us to request that). Your financial information — accounts, balances, transactions, notes, names — is never sent to Apple's attribution system, Tenjin, RevenueCat or any advertising partner.
Insight reports are written by a third-party AI model — OpenAI by default, or Anthropic — from the summaries listed above, only when you press the button. Our server holds the provider keys; the app never does. Cloudflare AI Gateway logs request metadata (model, status, token counts, timing); payload logging and caching are turned off, so it does not store the content of requests or responses. OpenAI and Anthropic process requests under their own API terms. Insights are information about your own money, not financial advice, and are never used to decide what you can access or what you pay.
| Provider | What | Purpose |
|---|---|---|
| Plaid | The bank connection you authorise; account and transaction data for the accounts you link | Bank connections (Connected plan) |
| Cloudflare | Our server, its database and key-value storage (connection records, encrypted tokens, subscription status, device records); AI Gateway request metadata | Hosting, security, AI routing |
| OpenAI, Anthropic | Insight summaries you asked for | Write insight reports |
| Apple, Google | Purchases and subscriptions | App distribution and billing |
| RevenueCat | Random app user identifier and purchase history. iPhone: the Apple Search Ads attribution Apple returns for your install. Android: Tenjin installation identifier; with Ad measurement, advertising and Android identifiers and IP address | Subscription status; campaign attribution |
| Apple (attribution) | iPhone: the aggregate install and milestone value described above | Privacy-preserving ad measurement |
| Tenjin | iPhone: only Apple's aggregate campaign reports — nothing from your device. Android: the install report described above; with Ad measurement, advertising identifier | Measuring our advertising |
| GlitchTip (operated by us) | Crash and problem reports | Fixing problems |
These providers are based in the United States, and your information may be processed there or elsewhere outside your country, where it may be accessible to courts and authorities under local law.
| Information | How long |
|---|---|
| Everything on your phone | Until you delete it |
| Bank access token | Destroyed as soon as the connection is removed — when you disconnect, delete everything, or your subscription ends |
| Bank connection record on our server | Kept after the connection ends; automatic deletion is not yet enabled in production |
| Bank transaction data on our server | Never stored — it passes through to your phone |
| Subscription status and device-security records | Kept; no automatic deletion period is in place yet |
| Trial ledger entry (hash of the trial identifier, start date, grant state) | Kept, so that deleting the app does not allow a second trial; it identifies no one. It is not removed by “Delete everything”, and the trial identifier on your device is kept for the same reason |
| AI usage counts | 33 days |
| IP-keyed rate-limit records | Until the rate-limit window ends (minutes to hours) |
| AI Gateway request metadata | The most recent 100,000 requests |
| Crash and problem reports | As long as needed to resolve the problem |
| Plaid, RevenueCat, Tenjin, Apple, Google, OpenAI, Anthropic | Under their own terms |
Your records are encrypted on your phone; bank access tokens are encrypted on our server; bank credentials are never stored by us. All network traffic uses TLS. On Android the app trusts only the system's certificate authorities, so certificates a user or administrator installs cannot intercept it; on iPhone, App Transport Security applies. We do not currently pin certificates. Our Cloudflare, Plaid, RevenueCat and Doppler accounts require multi-factor authentication, and we have a written information-security programme. No system is perfectly secure.
MyMoneyConcierge is intended for adults managing their own finances. It is not directed to children, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.
MyMoneyConcierge is a tool for recording and understanding your own money. It does not provide financial, investment, tax or legal advice.
We update this page and its effective date before, or at the same time as, a change in how the app handles information reaches you.
Questions, requests, or help with deletion: support@smartharmonyai.com.