SmartHarmony AIYour money data, and what we can — and can't — do with it.
This is a plain description of how My Money Concierge handles your data today. It is not a certification. Where we have not done something yet, we say so.
No account · Records stay on your phone · No ads
Built so that your records stay with you
No account
You don't need to sign up or give us an email address or password. Your subscription is tied to a random customer id from the app store.
Your records stay on your phone
Accounts, transactions, budgets and receipts are stored on the device, not on our servers.
No ads
The app shows no advertising and includes no advertising or analytics SDKs. Nothing is sent for advertising unless you turn it on (see below).
On Android the app includes one install-attribution tool (Tenjin), which tells us which ad campaign brought someone to the app. It is off until you switch on Settings → "Ad measurement". While it is off, nothing is sent to Tenjin at all: no install, no device details, no identifier, and the tool is never started. Switch it on and the app reports the install with basic technical details — platform, system version, device model, language and country — together with your advertising identifier; like any internet request, that report reaches Tenjin from your device's IP address. Switching it off again stops it from then on. On iPhone there is no attribution tool and nothing to switch on: the app never asks to track you and never reads your advertising identifier; campaigns are measured only through Apple's own aggregate attribution, which reports installs days later without identifying you or your device. Your accounts, transactions, notes and names are never part of any of it.
What we hold, and what we don't
We don't hold this
- ✕Your bank username or password — you sign in to your bank inside Plaid's own screen
- ✕Your card details — subscriptions are bought through the App Store or Google Play
- ✕Your transactions — they pass through our server while your phone syncs and are saved only on your phone
- ✕Bank names, account names, account numbers or balances
- ✕An email address or password — there is no account
We do hold this
- ✓A random customer id and your purchase status, through RevenueCat
- ✓Bank access keys, encrypted, if you connect a bank
- ✓Bank connection records — a random id, Plaid's connection id, status and dates. These are kept after disconnection
- ✓AI Action counters, which expire after 33 days, and operational details of AI requests (model, token count, cost)
- ✓Crash reports and problem reports, only when you send them
How it's protected
Encryption on your phone
Your records are kept in a database encrypted with SQLCipher. The key is held in the iPhone Keychain or Android Keystore. Receipt photos are protected by your phone's own storage encryption. The database is excluded from iCloud and Android device backups.
App lock
The app can require your Face ID, Touch ID or fingerprint to open your records, where your phone supports it. After the app has been in the background for five minutes, it asks again.
Backups only when you make one
Backups happen only when you create one (Settings → Backup and restore), protected by a passphrase you choose. That backup passphrase is the only passphrase in the app. A forgotten backup passphrase cannot be recovered by us or by anyone. Restoring a backup on a new phone is how you move phones.
Encryption in transit
The app reaches our servers only over HTTPS. Plain HTTP is redirected, and TLS versions older than 1.2 are refused. Our server runs on Cloudflare, where the encrypted connection is terminated. On Android the app trusts only the system's certificate authorities. We do not pin certificates.
Reminders say nothing on a lock screen
Reminders are local notifications scheduled on your phone. They never show an amount, a payee, an account or a goal's name.
Bank connections
Bank connections are optional and available on the Connected plan.
- You sign in to your bank inside Plaid's own screen. Your bank username and password never pass through My Money Concierge.
- Transactions only. We request Plaid's Transactions product for chequing, savings and credit card accounts in Canada and the United States, up to five connected accounts. You choose which accounts to share in Plaid's account selection screen.
- Bank access keys are encrypted on our server. Each connection's key is encrypted with its own data key. That data key is wrapped by a key held in Cloudflare's secret storage.
- Transactions are not stored on our server. They pass through it while your phone syncs and are saved only on your phone.
- Disconnect whenever you like. Disconnecting removes the connection at Plaid and destroys the stored access key. Connections are also removed when your subscription ends.
Bank data is only as current as your bank shares it, and posted transactions can take time to appear. Exports state the date they are complete through.
AI Insights
AI is used only when you tap Generate Insights or Refresh Insights. Each tap uses one AI Action. Opening the screen sends nothing. Cloud AI needs your consent in the Privacy Centre.
What is sent
A summary prepared on your phone.
- ✓Totals by account type
- ✓Monthly income and spending
- ✓Your top categories, with totals
- ✓Debt balances, interest rates and minimum payments
- ✓Merchant names, with totals
What is not sent
None of this leaves your phone for AI Insights.
- ✕Individual transactions
- ✕Descriptions or dates
- ✕Account names or bank names
- ✕Account numbers
Where it goes: through our server and Cloudflare AI Gateway to OpenAI by default, or to Anthropic. Payload logging and caching are turned off on the gateway; we log only operational details such as the model used, token count and cost. OpenAI and Anthropic process requests under their own API terms. Insights describe your figures. Generating them does not change your records.
Crash reports, support and payments
Crash reports are off unless you turn them on
Settings → Crash reports. A report carries the app version, your device type and where the app failed, is scrubbed, and never includes your accounts, balances, transactions or receipts. Reports go to our own self-hosted error-tracking server (GlitchTip), not to a third-party analytics vendor.
Report a problem sends only what you write
Help → Report a problem. The app removes email addresses and long numbers from it, and your email is optional. Screenshots are not accepted.
Payments go through the store
Subscriptions are purchased through the App Store or Google Play and managed with RevenueCat. The app never sees your card details. Cancel through the store.
Your control: export, retention and deletion
Export
Reports → "Take your data with you" → Export as CSV, or "Export full archive" (transactions, budgets, goals, tags, rules and receipts in an open format, with CSV inside). A report can be exported as a PDF. You can also make an encrypted backup in Settings → Backup and restore. Export stays available if your subscription lapses or you cancel.
Delete
Settings → "Delete everything on this device" disconnects your banks at Plaid, ends the app's sessions with our server, destroys the encryption key and deletes your records from the phone.
What remains on our servers
Bank connection records (a random id, Plaid's connection id, status and dates) are kept after disconnection. AI Action counters expire after 33 days.
Who processes data for us
| Provider | Purpose | What they receive |
|---|---|---|
| Cloudflare | Hosts our server, its database and secret storage, and the AI gateway | Encrypted bank access keys, random ids, connection status, AI request metadata. Transactions and AI summaries pass through but are not stored. |
| Plaid | Bank connections | Your bank sign-in (inside Plaid's screen) and your transaction data from the bank. |
| OpenAI, Anthropic | Generating AI Insights, when you ask | The summary described above. |
| Apple, Google | App distribution and payments | Your purchase and payment details. |
| RevenueCat | Subscription status | A random customer id and your purchase status. |
| GlitchTip (self-hosted by us) | Crash reports and problem reports, only when you send them | App version, device type, failure details, your report text. |
| Tenjin (Android only) | Install attribution, only if you switch on Ad measurement | The install report described above. Nothing while it is off. |
How we run security
Multi-factor authentication on our service accounts.
It is required on our Cloudflare, Plaid, RevenueCat and Doppler (secret storage) accounts. Access tokens are limited to what each task needs.
No secrets in code.
Credentials live in a secrets manager, and our builds fail if key material is committed.
A written programme and plan.
A written information security program, approved on 15 September 2026, and a written incident response plan.
What we have not done yet.
We hold no security certification. No independent security review, penetration test or external audit has taken place. We have not yet rehearsed our incident response plan. One person currently holds production access.
A rooted or jailbroken phone weakens on-device protection.
The app warns you when it detects one.
Found something? Tell us.
We'd genuinely rather hear it from you than read about it later. Report a vulnerability to support@smartharmonyai.com with "Security" in the subject. We acknowledge within two business days, we won't pursue anyone acting in good faith, and we'll credit you if you'd like us to.
Please don't test against other people's accounts or run denial-of-service attempts — everything else is fair game.
Last reviewed 21 September 2026 · Operated by SmartHarmony AI LLC · This page describes My Money Concierge only. See also the Privacy Policy and Terms.