Your ledgers and local storage
You enter ledger names, currencies, amounts, categories, dates, notes, recorder labels, payer/recipient labels, household member names, expense attribution and expense-sharing members. The app stores these records, revision history, revoked entries and preferences in its own storage on the device. Basic bookkeeping works offline and does not require a PennyTally account.
The app has no advertising, cross-app tracking, bank connection or developer-operated analytics service. It does not request contacts or location access. We do not automatically receive your ledger content.
Receipt evidence
Scanning requests camera access. You can instead select a photo or an image/PDF file. Receipt text is recognized on this device using Apple Vision; receipt content is not sent to an OCR service. Recognition is a suggestion you review before applying.
Scans and photos are stored as readable PDF copies; imported PDFs retain their original bytes unless you crop or rotate them. Receipts are part of the entry and its saved revision history, including JSON backups. They follow the selected ledger’s iCloud and family sharing settings, so members of a shared ledger can see its receipts. Removing or replacing a receipt does not erase earlier saved versions. Repeating an entry does not copy its receipt.
Optional voice and offline AI
Voice entry requests microphone and speech recognition permission only when you choose to record. Supported devices and languages use on-device speech recognition; the app does not switch to network recognition. Audio is held for transcription and is not saved as a recording. You can type or edit the text instead. The separate Speech tests page in Debug builds keeps test recordings and recognition results on this device until you clear them. These files are excluded from device backup, are not synced to iCloud and do not create ledger entries. Exporting explicitly shares the recordings and results through the destination you choose. Test models are prepared separately on that page.
Offline AI is built into the app and ready to use. Analysis stays on this device. Review the results before saving. The model files (about 290 MB) ship with the app; no separate model download or App Attest registration is required. Voice, entry text and receipts are not sent to a model provider. Microphone permission is requested only when you choose to record. Saved entries and receipts follow your ledger’s sync settings.
Text analysis runs locally. Recognized amounts, dates and categories are suggestions for you to check; you must apply them and save the entry yourself. Saved notes, entries and receipts follow the selected ledger’s existing iCloud and sharing settings.
Optional iCloud
iCloud is off by default. When you enable it, the app checks your Apple Account identity and uses it to separate local cloud stores. Moving a ledger to iCloud sends its member list, full entries and history to your private CloudKit database, operated by Apple. A hidden local recovery copy is retained.
Apple handles iCloud account information, service diagnostics and cloud storage under its own terms and privacy policy. Network availability, iCloud settings and storage limits affect synchronisation. An upload status does not prove another device has received the data.
Exchange rates
Choosing a foreign currency requests daily ECB reference rates through Frankfurter (https://frankfurter.dev/). The request contains only the two currency codes and the entry’s calendar date; amounts, notes, ledger names and recorder labels are not sent. Network providers necessarily receive connection information to deliver the response. Reference rates are cached on this device.
You can replace the reference rate manually. Each entry retains its original amount, applied rate and converted amount in its revision history and backups; enabling iCloud also includes this information in the selected ledger.
Family sharing
Sharing is optional and uses Apple CloudKit private invitations. An invitation uses the recipient email address you enter. Any Apple Account may be invited; an @icloud.com address or Apple Family Sharing group is not required. Only invited accounts can access the private share. Invited members can access the selected ledger, including notes, recorder and payer/recipient labels, member names, expense attribution, expense shares, revoked entries and full revision history. These labels are not authenticated member identities.
Read-only members can view the ledger. Members with editing access can change the whole shared ledger. Separate personal ledgers are not included in that invitation. Leaving or stopping sharing first creates a local copy. Copies already saved or exported by members cannot be recalled.
Exports, history and deletion
CSV and JSON exports are not encrypted. The app sends a file only to the location or recipient you choose using Apple’s file and sharing controls. A JSON backup includes the full revision history; it does not include CloudKit account details or sharing permissions.
Keep backups of important records; exports are unencrypted. Entry deletion is permanent. Deleted ledgers stay in Recently deleted and can be restored. Deleted ledgers can be restored for 30 days. After that, they and their entries, receipts and history are permanently deleted.
Local app records remain until the app’s data is removed. Uninstalling does not necessarily delete iCloud records, device backups, exported files, migration recovery copies elsewhere or copies held by other members. Manage cloud data through Apple’s storage controls and ask support before deleting data you need.
Imported CSV and XLSX files are parsed on this device. Reporting-currency conversion saves a complete pre-conversion JSON backup in the app’s local storage, including receipts and revision history. These backups remain until the app’s local data is removed; exported copies remain wherever you saved them.
Support and TestFlight
If you email us, we receive your email address, message and the attachments you choose to send. We use these to answer your request and investigate faults. Send only necessary information and remove private amounts, notes, passwords and unrelated personal details.
For TestFlight versions, Apple automatically collects crash logs and usage information and shares them with us. Apple also forwards feedback and screenshots you submit, and may provide your name or email depending on the invitation and feedback method. We use this information to test and improve PennyTally, not for advertising or sharing with third parties. Apple’s TestFlight privacy information explains this separate testing service.
Purposes and retention
We process support information to respond to your request and provide the service you ask for. We also rely on our legitimate interests in investigating faults and maintaining reliable support records, balanced against your rights. You may object to processing based on legitimate interests.
We keep support and testing information only as long as needed to respond, investigate problems or meet legal obligations, then delete or anonymise it. Apple and email providers process information within their services; services may operate outside your region, with applicable safeguards where required. Disclosure to authorised bodies may be required by law.
Your choices and rights
You can use local ledgers, choose which ledgers move to iCloud, control invitations and member permissions, and export your records. Protect access to your device, Apple Account and backup files. No storage or transmission method is completely secure.
To ask about information we hold or exercise applicable rights of access, correction, erasure, restriction, portability or objection, email contact@yorkglobal.co.uk. We do not have a developer copy of your private ledger to edit or erase. You can also complain to the UK Information Commissioner’s Office or your local data protection authority.
Children and policy changes
PennyTally is a general bookkeeping tool and is not directed to children. We do not knowingly collect children’s personal information through support.
We update this policy and its date when practices change. The bundled policy remains available offline under Settings → Help and about. The website contains the latest published version.
Contact support
Visiting this website
Cloudflare hosts this site and processes network request information needed to serve pages and maintain security. The site stores only a theme preference in your browser and adds no advertising or analytics scripts. Website visits are separate from ledger storage inside the app.