Privacy policy

Pennykite is local-first. Your financial plan is stored in your browser, not on our servers. If you turn on encrypted sync, we also store a copy that is encrypted before it leaves your browser and that we can't read. This policy explains exactly what is stored where.

Stored only in your browser

Your plan is stored in your browser's IndexedDB storage on the device you use, separately for each account that signs in there:

• Your balance and the date you entered it.
• Your paychecks, bills, one-time items and debts.
• Your payoff plan and your monthly debt check-ins.
• Transactions you imported from statements.
• Your currency and cushion settings.

None of this is sent to our servers in a form we can read. Unless you turn on encrypted sync (below), no request carries it at all. Statement files (CSV or PDF) are read inside your browser tab and are never uploaded. We can't see, recover, export or delete this data for you. You control it in Preferences: download a backup file, restore one, or use Delete my plan from this browser. Clearing your browser's site data also deletes it.

Encrypted sync (optional)

If you turn on encrypted sync in Preferences, your browser encrypts your plan and imported transactions (AES-256-GCM) with a key created in your browser, and uploads only the encrypted result. That key is stored with us only in encrypted form: once under your sync passphrase and once under a recovery key shown to you once. We never receive your passphrase or your recovery key, so we can't read the copy, reset your passphrase or recover the copy if you lose both. We store the encrypted copy, its version, its size and when it last changed. Turning sync off in Preferences, or deleting your account, deletes it.

Stored on our servers

• Account: your name, email address, email verification state, profile picture if you add one, and your sign-in methods (a hash of your password, passkeys, two-factor settings). We also record the date and version of the terms you accepted.
• Sessions: a record of each signed-in browser, with the network address and browser description from when the session started.
• Subscription and billing: your plan, subscription status, billing interval and the customer reference from our payment provider. Card details never reach us.
• Weekly check-in email schedule: on or off, weekday, hour, time zone and the last week an email was sent.
• Encrypted plan copy, only if you turn on sync: see above.
• Email and notification records: the transactional emails we send you and in-app notifications.
• Support and contact requests (including every message in a support conversation, yours and ours) and documentation feedback you send us. Your network address is stored only as a keyed hash that can't be reversed, used for rate limiting and abuse prevention.

Our servers never store an amount, a payee or a transaction from your plan in a form we can read.

Free calculators

The free calculators run in your browser and need no account. They send only anonymous counts: one view per calculator per browser session, a click on "Save this plan", and a sign-up when onboarding completes after using a calculator. Each count is stored as a day, an event type, a calculator name and a number. No identifier or cookie is attached. A keyed hash of your network address is used only to rate-limit these counts and isn't stored with them.

"Save this plan" keeps the numbers you typed in your browser's local storage so you can bring them into a new account. They aren't uploaded. They expire after seven days and are removed once used or dismissed.

Email

We send transactional email: verification, password reset, security notices and a welcome message, plus optional account-activity email you can turn off in your notification settings. With Plus, you can turn on the weekly check-in email, a reminder at the weekday and hour you choose. It contains no amounts, because we don't have any. Every check-in email has an unsubscribe link, and the email respects your optional-email setting in your account's notification settings.

What we don't do

• We don't ask for bank logins or connect to your bank.
• We don't use AI to read your finances.
• We don't sell or rent your data, and we don't use advertising or third-party analytics.

Who processes data for us

See subprocessors for details.

How long we keep it

• Account data, the check-in schedule and billing state: while your account exists.
• Sessions and verification links: until they expire.
• Sent email records: 30 days. Read notifications: 90 days.
• Support and contact requests: one year after they're closed. Documentation feedback: one year.
• Billing event records and activity records: one year.
• Anonymous calculator counts: 400 days.
• Records of finished background work, such as a completed deletion: up to 90 days.

These windows are enforced automatically every hour.

Deleting your data

• Your plan: use Delete my plan from this browser in Preferences, or clear your browser's site data. Remember to do this on every device where you used the planner.
• Your account: request deletion in your account's privacy settings. You're emailed right away and can cancel for seven days. After that, your account, sign-in methods, sessions, check-in schedule and billing records tied to your account are removed. A record that the deletion happened is kept for 90 days, billing event records are kept for their one-year window, and activity records keep only an opaque identifier (no name or email) until their one-year window ends. Our payment provider keeps its own payment and tax records as merchant of record.

Deleting your account doesn't reach into your browser. Delete your plan there too if you want it gone.

Your rights

You can see and change your account details in your account settings. Your plan is already in your hands, and a backup file is a full copy of it. For any other request, use the contact page.