Privacy Policy

We collect only what we need to run Balance and keep it secure:

• Account information. Your email address, the display name you choose, your password (stored only as a salted hash), and your preferences such as language, currency, theme and which notifications you want.
• Money data you choose to add. Accounts you create (name, type, opening balance), transactions (date, amount, merchant or description, category, notes, splits), budgets, savings goals and round-up settings, smart rules, challenges, installment plans, overdraft settings (your credit line, interest rate and any payoff plan) and receipts you attach. See section 3 for where this data comes from.
• Card details from imports. When a statement file or card SMS names a card, we keep only its last 4 digits, so later charges land in the right account. We never ask for or store a full card number, expiry date or security code.
• Household information. If you create or join a household: its name, its members and their roles, how shared spending is split, which of your accounts you share, household budgets, goals and contributions, invite links (stored only as a hash) and who added or last edited a transaction in a shared account.
• Security information. Sessions (a hash of the session token, when it was created and last used, and the browser it came from), Shortcut keys (stored only as a hash, plus the last few characters so you can recognize them), and Touch ID public keys if you turn on the Mac app lock. Your fingerprint never leaves your device.
• Subscription information (Balance Plus). Whether and when you started the free trial, whether you asked to hear when Plus opens, and for a subscription: its status, plan (monthly or yearly), renewal or end date, and the payment processor's ids for it (a Stripe customer and subscription id, or an App Store transaction id). We never receive or store your card number or other payment details. See “Payments (Balance Plus)” below.
• Technical information. Your IP address is used briefly to rate-limit sign-in and other requests. Our servers keep operational logs. Optional, cookieless analytics on the public website run only if you allow them in cookie settings, and never inside the app.
• Error reports. When something breaks in the app (web or iPhone) or on our server, we record the error type, a cleaned-up error message and code location, the screen path without its query string, the app version and the platform (web, iPhone or server). Before anything is stored we remove email addresses, tokens and keys, ids, long numbers and amounts, quoted values and web addresses. Reports from the same bug are grouped, with a count and the number of different people affected, which we count with a one-way hash of your account id. Error reports never contain your transactions, amounts, account names, notes or what you typed in a form.
• Feedback and messages to us. What you write in “Send feedback” (its type and your text), linked to your account. If you leave “Include technical details” on (it is on by default and the form shows exactly what is sent), it adds the app version, platform and operating system version, language, theme, the screen you were on, the window size and the codes of your last few error reports. A screenshot is attached only if you choose an image yourself. If you tick “You can email me back”, we may reply to your account email address. Also anything you send when you contact support.

We use your information to:

• provide the service: show balances, categorize transactions, apply your rules, track budgets, goals, installments and overdraft plans, detect recurring charges, build forecasts and insights, and share the accounts you choose with your household;
• keep your account secure, detect fraud and abuse, and verify sign-ins;
• send in-app notifications you enable, such as budget alerts, upcoming bills, a weekly summary and household updates, by email too if you allow it, and service emails such as password resets and household invites;
• run Balance Plus: start your free trial, give you Plus while it is active, remind you before a trial ends, and process renewals, cancellations and refunds;
• respond to your questions, feedback and support requests;
• find and fix errors (the developer gets an alert when a new error appears or one suddenly happens often, and a daily summary) and, with your consent, understand in aggregate how the public website is used; and
• meet our legal obligations.

Where laws such as the GDPR apply, we rely on the following legal bases: performing our contract with you, our legitimate interests in running a safe and useful service, your consent (for example, for optional analytics) and compliance with legal obligations. We do not use your data to make automated decisions that have legal or similarly significant effects on you.

Balance does not connect to your bank or card company and never asks for your online banking password. Financial data reaches Balance only in ways you control:

• Typing it, including quick add.
• Importing a file: a CSV, or a statement file you download from your card company or bank (for example Max, Cal or Isracard). The file is read in your browser; only the transaction lines you import are sent to Balance, and the file itself is not stored.
• An Apple Pay payment you already made, sent by the Shortcuts automation on your iPhone with your connection key: the merchant, amount, time and the card's name in Wallet.
• A card charge SMS, sent by a Shortcuts automation with your Shortcut key. Balance reads the amount, merchant, date, last 4 card digits and installment details from the message and keeps only those. The text of the message is not stored, and messages that are not charges (codes, declines, summaries) are ignored.
• Scanning a receipt. The text is read on your device; the photo is not sent anywhere to be read. When you save the transaction, a compressed copy of the photo is stored as its receipt. If you turned on Smart mode and the on-device reading cannot find the total, the recognized text (not the photo) may be sent to Claude, as described in the next section.

Ask Balance, the feature that answers questions about your money, works out its answers on your device by default. Your questions are sent to an AI service only if you turn on Smart mode, described in the next section.

Balance works fully without AI. Smart mode is an optional extra, part of Balance Plus (with a free trial), that uses Claude, an AI model made by Anthropic, to answer harder questions and help with a few tasks. It is off by default, even with Plus. It turns on only when you switch it on in Settings → Smart mode (AI) and agree to the explanation shown there, and it applies only to your own account. Without it, everything keeps working on your device as before.

When Smart mode is on, our server sends Anthropic only the data each feature needs:

• Ask Balance: your question (and up to three earlier Smart mode questions and answers from the same visit), plus the records needed to answer it: dates, amounts, merchant descriptions, category names, the kind of account (for example “checking”) and, when you ask about them, budgets, goals, recurring charges and installments.
• Smart search: the search text you type and your category names.
• Category suggestions: the description, whether it is income or an expense, and the date of uncategorized transactions, plus your category names.
• Quick add: the text you type.
• Receipt help: the text read from a receipt on your device, only when that reading cannot find the total. Never the photo.
• Monthly summary: totals for the month (for example by category), not individual transactions.

Before anything is sent, email addresses, web-address parameters and long runs of digits (such as card, phone, ID or reference numbers) are removed from the text. We never send your name, email address, password, account names, notes, card numbers, receipt photos, or the private accounts of other household members.

Anthropic as our processor. Anthropic processes these requests on our behalf, under its commercial terms and data processing addendum. Requests go from our server to Anthropic, never directly from your device. Under those terms Anthropic does not train its models on this data. Anthropic says it deletes API inputs and outputs from its systems within 30 days, unless it must keep them longer to enforce its usage policy or to comply with the law (see Anthropic's retention article). Anthropic may process this data outside your country, including in the United States; see “International transfers” below.

What Balance keeps. We do not store your Smart mode questions or answers on our servers. We keep a usage record (time, feature, model, token counts, estimated cost and whether it worked) and a daily counter for fair-use limits, and delete them after 40 days. You can unlink your usage records from your account at any time with “Delete my AI history”. The app may keep answers on your device for the current visit.

Turning it off. Switch Smart mode off in Settings at any time. Nothing more is sent from then on, and Balance goes back to on-device answers. Where the GDPR applies, we rely on your consent for Smart mode, and you can withdraw it at any time.

Balance is free to use. Balance Plus, the optional subscription, is paid through a payment processor, never through Balance itself:

• On the web, Stripe. When you first check out, we create a Stripe customer with your email address and our internal id for your account. You enter your card details on Stripe's own checkout page, and you manage or cancel the plan in Stripe's customer portal. Stripe handles your payment details as an independent controller under its privacy policy.
• In the iPhone app, Apple. Purchases go through your Apple Account and the App Store under Apple's privacy policy. Apple tells us only about the subscription itself (product, dates, status and transaction ids), plus a random token we attach at purchase so the subscription lands on the right Balance account. We do not learn your Apple Account details.

What we keep: the subscription status, plan, renewal or end date and the processor's ids, and a short log of processor notifications we already handled (deleted after 90 days). Never a card number, expiry date or security code.

Why, and on what basis: to give you the plan you chose, keep it in step with the processor and meet our accounting and tax obligations. Where laws such as the GDPR apply, the legal bases are performing our contract with you and complying with legal obligations.

How long: while your account is open (so the free trial is used only once) and, for a subscription, at least while it is active. When you delete your account, these records are deleted with it. Invoices and payment records stay with Stripe or Apple, and in our own accounting records for as long as accounting and tax law requires ([period to be confirmed, usually 7 years in Israel]), without any of your money data.

Nothing is shared by default. If you join a household, its members see your name and email address. They see an account of yours, with all its transactions, notes, splits and receipts, only after you switch on sharing for that account, and they can add, edit and delete transactions in it. Household budgets and goals are visible to all members.

Your private accounts and their transactions, your categories and rules, personal budgets and goals, round-ups, installment plans, overdraft plans, Shortcut keys and notifications are never shared. When you stop sharing an account or leave a household, members lose access to it at their next sync, and the encrypted copy kept on their devices can no longer be read.

We share personal information only in these limited situations:

• Your household, as described in the section above, when you choose to share.
• Service providers that host our servers and database ([hosting provider to be confirmed]), send our emails (Resend), process payments for Balance Plus (Stripe on the web, Apple in the iPhone app; see “Payments” above) and, only if you turn on Smart mode, run the AI model (Anthropic), under contracts that limit their use of your data to providing services to us. Alerts about errors and new feedback go to the developer by email (Resend) and, if set up, a private chat or notification webhook ([alert service to be confirmed]). Error alerts contain only the cleaned-up error, the screen path and counts; feedback alerts contain the feedback type and the first 200 characters of your message, never your email address or screenshot.
• Legal reasons, when we believe in good faith that disclosure is required by law, or necessary to protect the rights, safety or property of our users, the public or Balance Inc..
• Business transfers, if Balance Inc. is involved in a merger, acquisition or sale of assets. We will notify you before your information becomes subject to a different privacy policy.
• With your consent, when you ask us to share something specific.

Merchant logos are fetched by our server from public favicon services (Google and DuckDuckGo) for the brands in Balance's built-in merchant directory, and then cached. These requests contain only the brand's web address, never your data or transactions, and they come from our server, not your device.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Balance has no ads. Balance is free to use, and our business is Balance Plus, the optional subscription you choose to pay for, not your data.

We do not use your transaction data to target you with offers from banks, lenders or other third parties.

We keep your data for as long as your account is open. Some things are removed automatically sooner:

• deleted transactions stay in a 7-day bin (so Undo works) and are then permanently deleted;
• sign-in sessions expire after 30 days without use and are then deleted;
• password reset links expire quickly and are deleted a day after they expire;
• household invite links expire after 7 days and are deleted 30 days later;
• receipts stay until you remove them or their transaction is permanently deleted;
• error reports are deleted 90 days after the error was last seen;
• feedback is kept until the developer deletes it, and for at most one year. If you delete your account, feedback you sent stays only without the link to your account (and with no way to reply), and is deleted on the same schedule. Ask us to delete it sooner at any time;
• Smart mode usage records and daily counters are deleted after 40 days (questions and answers are never stored);
• Balance Plus records stay while your account is open; payment records needed for accounting and tax are kept as long as the law requires (see “Payments”).

When you delete your account in Settings, your account and data are deleted from our database straight away. If you shared accounts with a household, you choose whether those accounts are deleted too or handed over to the household. Server logs are kept for [log retention period to be confirmed] and database backups for [backup retention period to be confirmed], after which deleted data is gone from them too. We may keep records we are required to keep by law.

We protect your information with access controls that scope every request to your own data and the accounts shared with you, passwords stored only as salted hashes, session tokens, Shortcut keys and invite links stored only as hashes, rate-limited sign-in and an optional Touch ID app lock on Mac. The copy of your data the app keeps on your device for fast start-up is encrypted, and the key is only given to an unlocked session. Balance never holds a bank login. No system is perfectly secure, but we work hard to protect your data and will notify you and the relevant authorities of a breach where the law requires. Learn more on our security page.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and receive a copy in a portable format;
• Correct information that is inaccurate or incomplete;
• Delete your account and personal information;
• Object to or restrict certain processing, and withdraw consent where we rely on it;
• Opt out of the sale or sharing of personal information (we do not sell or share it for advertising);
• Not be discriminated against for exercising any of these rights; and
• Complain to your local data protection authority (in Israel, the Privacy Protection Authority).

You can export or delete your data from the app settings, or email privacy@heybalance.app. We may need to verify your identity before acting on a request. See data & permissions for a plain-language overview.

Balance is not directed to children. You must be at least 18 years old (or the age of majority where you live) to create an account. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

We and our service providers may process information in countries other than the one where you live. When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we use appropriate safeguards such as standard contractual clauses approved by the relevant authorities. If you turn on Smart mode, the data described in the Smart mode section is processed by Anthropic, including in the United States. If you buy Balance Plus, Stripe or Apple may process your payment information in the United States and other countries.

We may update this policy from time to time. If we make material changes, we will notify you by email or in the app before they take effect, and update the effective date at the top of this page.

Questions about this policy or your personal information? Email our privacy team at privacy@heybalance.app. The data controller for your information is Balance Inc., [postal address to be confirmed].