PennyPathPennyPath Privacy Policy
Effective 2026-10-31. This policy describes what PennyPath actually does with your data.
In short
PennyPath is a manual budgeting app. Your expenses, budgets and savings goals are stored on your iPhone. PennyPath never connects to your bank and never asks for bank details. An account is optional and only used for cloud backup. Pseudonymous usage statistics never include amounts, notes or names, and you can turn them off.
Who is responsible
PennyPath is published under the Garinio name by Alexandre Garin, communiquée à l'hébergeur (art. 6, III, 2 de la loi n° 2004-575 du 21 juin 2004) ("we"), the data controller. Questions about your data: privacy@garinio.com.
What stays on your iPhone
Expenses (amount, currency, category, date, optional note), weekly budgets, categories, savings goals and contributions, and your settings (currency, week start, theme, reminders).
We have no access to this data. It is included in your iCloud or computer backups if you use them; those backups are governed by Apple. You can erase everything in Settings › Delete local data, or by deleting the app. Settings › Export my data gives you a CSV copy.
Reminders
Reminders are local notifications scheduled by your iPhone, only if you allow them. No notification server is involved and their content is never sent to us. You can turn them off in the app or in iOS Settings.
Optional Garinio account
PennyPath works fully without an account. If you choose to create a Garinio account to back up and sync your data:
- Sign in with Apple gives us a unique identifier and an email address, which can be an Apple relay address if you choose "Hide My Email". Where the app offers sign-in with an email address instead, your password is stored only as a secure hash.
- Your expenses, budgets, categories, goals and settings are copied to our server so they can be backed up and synced between your devices. The database only lets each account read and change its own data.
- The account is shared by the Garinio apps: one sign-in, but each app stores only its own data.
- Settings › Account & backup › Delete account deletes this app's data from our server immediately, then the account itself if no other Garinio app uses it. Deleted data disappears from our server backups within 14 days.
- If an account is unused for 3 years, we may delete it after notifying you by email 30 days in advance.
Legal basis: performance of the contract with you (GDPR art. 6(1)(b)).
Usage statistics
To understand how PennyPath is used and improve it, the app records product events, for example "onboarding completed", "expense added" or "paywall viewed". Each event contains the event name and time, the app version, the iOS version, the language and region setting, whether the build is a test or production build, a random installation identifier and a random session identifier created by the app.
Events never contain amounts, notes, category or goal names, your email, your location or any content you type. They are not linked to your name, your email or a Garinio account, never include the advertising identifier, are not used for advertising, are never sold and are never used to track you across other companies' apps or websites.
Why and on what basis. These statistics are used only to measure the app's audience and how its features are used, so we can fix and improve it. The legal basis is our legitimate interest (GDPR art. 6(1)(f)). Because they serve only this purpose and stay with us, they are exempt from prior consent under the audience-measurement exemption (art. 82 of the French Data Protection Act, as applied by the CNIL) and, in the UK, the statistical-purposes exemption of PECR introduced by the Data (Use and Access) Act 2025.
Your choice. Statistics are on by default and you are told so before they are used. You can turn them off at any time in Settings › Your data: collection stops immediately and events not yet sent are deleted from your iPhone. Deleting all the app's data or reinstalling it creates a new installation identifier, and the identifier is renewed at least every 13 months.
Where and how long. Events are sent over HTTPS to Garinio's server, hosted in Canada by OVH Hosting Inc. (OVHcloud Canada), Beauharnois, Québec, Canada. Raw events are deleted after 400 days (about 13 months); beyond that we only keep aggregated counts that contain no identifier. Your IP address is necessarily seen by the server when the app connects, but it is not stored with the statistics.
Purchases
Purchases and subscriptions are handled by Apple. Through Apple's StoreKit, the app receives the signed transaction information from the App Store (which product, purchase and expiry dates, a transaction number) to unlock Premium on your device. We never receive your name, your Apple Account email or your payment details. Apple's privacy policy applies to the payment. Legal basis: performance of the contract (GDPR art. 6(1)(b)).
If you contact us
When you write to us, we use your email address and message only to answer you, and keep them for 3 years after our last exchange. Legal basis: our legitimate interest in providing support.
Who receives data
- Our hosting provider, OVH Hosting Inc. (OVHcloud Canada), Beauharnois, Québec, Canada, which stores the data sent to our server on our behalf and under our instructions (data processor).
- Apple, for App Store purchases and device backups, as an independent controller under its own privacy policy.
We don't sell or rent personal data, and the app contains no advertising or third-party analytics SDK.
International transfers
Our server is located in Canada, which the European Commission recognises as providing an adequate level of data protection (decision 2002/2/EC), so no additional safeguard is needed. Apple may process data outside the EU under its own safeguards.
How long we keep data
| Data | Kept |
|---|---|
| What you enter in the app | On your iPhone until you delete it or the app |
| Usage statistics | 400 days, then only aggregated counts without identifiers |
| Garinio account and synced data | Until you delete the account, then 14 days in server backups |
| Support emails | 3 years after the last exchange |
Your rights
Under the GDPR and the UK GDPR you can access, correct, delete or export your data, restrict or object to its use, and, in France, give instructions about your data after your death. Most of this can be done directly in the app: see and correct everything you entered, export it (Settings › Export my data) and delete it (Settings › Delete local data, and Account & backup › Delete account). Statistics are pseudonymous: we can't find your events without your installation identifier, but turning them off stops collection and deleting your data replaces the identifier. For anything else, write to privacy@garinio.com; we answer within one month.
You can also complain to the CNIL (www.cnil.fr), our lead supervisory authority, or to the authority where you live, such as the ICO in the UK (ico.org.uk).
US residents. We don't sell or share personal information as defined by California law and don't use it for targeted advertising. As we don't track you across websites, the app doesn't need to respond to Do Not Track signals.
Children
PennyPath is not directed at children under 13, and we don't knowingly collect their personal data. If you believe a child has sent us personal data, contact us and we'll delete it.
Security
Data on your iPhone is protected by iOS (app sandbox and file encryption when the device is locked with a passcode). Data sent to our server travels over HTTPS; the database is not reachable from the internet.
Changes
If this policy changes, the new version is published at the same address with a new date, and significant changes are announced in the app.
Contact
Alexandre Garin, communiquée à l'hébergeur (art. 6, III, 2 de la loi n° 2004-575 du 21 juin 2004) — privacy@garinio.com