Privacy Policy — Linaw

Effective date: 2026-10-24 Last revised: 2026-10-24 Version: 1.2

1. Plain-language summary

Linaw is built to keep your money data on your phone, not on our servers. Here is the short version:

Your records live on your device and in your own iCloud. We never receive your balances or transaction history. The only amounts an AI partner sees are ones inside a voice entry or receipt it is asked to read (below).
Sign in with Apple is the only sign-in. No passwords, no Google login, no Facebook login.
Receipt images (every plan) and, on Pro, voice entries your phone can't read on its own are sent to an AI partner for processing. Either can include an amount. The receipt image is deleted within 60 seconds. We do not store these long-term.
No advertising. No data sales. No data brokers. No third-party trackers.
You can export everything as CSV / JSON at any time, and delete your account in-app.

The rest of this document is the detail. The promise is the same either way.

Privacy promise (verbatim, from PRD §5.3): "Your records live on your device and in your own iCloud. Two things go to our AI partner to be read: on Pro, voice entries your phone can't read on its own (with your category and merchant names); on every plan, receipt photos you scan. Either can include an amount. See our privacy policy for current AI providers."

2. Who we are

Linaw ("Linaw", "we", "us", "our") is an iOS personal finance tracking application operated by Kristoff Ampong, a self-employed individual based in Dumaguete City, Negros Oriental 6200, Philippines.

Data Protection Officer (DPO): Kristoff Ampong Contact: [email protected]

This Privacy Policy applies to the Linaw iOS app and any associated services (the "Service"). It does not apply to third-party services we integrate with — those have their own policies, listed in §6.

This policy complies with the Republic Act No. 10173 (Philippines Data Privacy Act of 2012), and is written to satisfy the disclosure requirements of the EU GDPR and California Consumer Privacy Act (CCPA) for users in those jurisdictions.

3. What we collect

3.1 Data you provide

Data	When	Where it lives
Transactions (amount, merchant, category, note, date, account)	Every time you log	On-device (SwiftData) and synced to your private iCloud database via Apple CloudKit so the same data appears on your other Apple devices signed in to the same iCloud account. We never see this data. You can disable iCloud sync for Linaw at any time in iOS Settings → Apple ID → iCloud → Linaw.
Accounts, categories, merchants, remembered merchants	When you create them	Same as transactions — on-device + your private iCloud database.
Voice transcripts	When you use voice entry	Not saved. Your phone reads the words to fill in the entry and shows them on the confirm screen, then discards them; a transaction's note holds only what you type (entries logged in earlier test builds may still have the words as their note, which you can edit or delete). On Pro, when your phone can't read an entry on its own, the transcript text (which can include an amount) and your category and merchant names are sent to our AI partner for parsing, then discarded by the partner per their retention policy.
Receipt images	When you scan a receipt (free or Pro; scanning needs Sign in with Apple)	Sent to our AI partner via a short-lived signed URL, deleted within 60 seconds of OCR completion. Not stored on our servers or yours after the draft transaction is created.

3.2 Data your Apple ID provides (Sign in with Apple)

When you sign in (required only to scan receipts or to buy Pro or credits):

Apple subject identifier (apple_sub) — an opaque, per-app unique ID.
Email — either your real email or Apple's private relay address, your choice.
Display name — only if you choose to share it during the SIWA flow.

We never see your Apple ID password.

3.3 Data we collect automatically

Data	Purpose	Identifies you?
App version, iOS version, device model	Crash diagnostics, support	No
Subscription status, plan tier, credit balance	Operate Pro features and credit metering	Yes (linked to your `users` row when signed in)
Free receipt-scan count	Enforce the 5 free scans a month	Yes (linked to your `users` row)
Receipt-scan ID (a random number per scan, with whether it was paid by a free scan or credits and whether it was refunded)	Make sure a scan retried after a lost connection is never charged twice. Nothing read from the receipt is stored with it	Yes (linked to your `users` row)
Voice-parse ID (Pro only: a random number per spoken entry sent for natural phrasing, with whether its charge was refunded and how many tries it took)	Make sure an entry retried after a lost connection is never charged twice. Nothing you said is stored with it	Yes (linked to your `users` row)
Purchase fingerprint (a one-way fingerprint of each App Store purchase we've credited, made from Apple's transaction ID; it can't be turned back into the ID)	Make sure a purchase can't be credited twice, including after an account is deleted and a new one is made	No (not linked to you or your account)
Unused Pro balance (only if you delete your account while a Pro subscription is still running: your remaining credits and this month's usage counts, filed under the subscription's purchase fingerprint)	Give your credits back, once, if you sign in again with the same subscription, without letting a deleted account's credits or monthly limits be used twice	No (not linked to you or your account)
Apple DeviceCheck token (sent with each receipt scan)	Stop one iPhone's free scans being reset with another Apple ID. We use it only to read and set two yes/no flags that Apple keeps for this device; it isn't stored by us and isn't an advertising or tracking ID	No
Crash reports (only if you turn on sharing with app developers in iOS Settings → Privacy & Security → Analytics & Improvements; Apple collects them and passes them to us)	Fix bugs	No

We do not collect: IDFA, advertising ID, precise location, contacts, calendar, photos library (except the receipt image you explicitly capture), browsing history, or any data from other apps.

3.4 What passes through our servers, and what never reaches them

Two things pass through our servers on their way to our AI partner (§5), and we keep neither: the words of a Pro voice entry your phone couldn't read on its own (with your category and merchant names), and receipt photos you scan (deleted within 60 seconds). Either can include an amount.

Apart from those, our servers never see:

The list of your individual transactions.
The amounts you log.
Your account names or balances.
Notes you type or edit on a transaction.

Aggregate counts (e.g., "user has logged 47 transactions this month") may be derived for billing edge cases, but the underlying records stay on your device.

4. How we use your data

Purpose	Legal basis (GDPR Art. 6)	RA 10173 basis
Provide the core finance-tracking service you signed up for	Performance of contract	Art. 12(b)
Parse your voice / scan your receipts via AI	Performance of contract	Art. 12(b)
Operate subscriptions and credit metering	Performance of contract	Art. 12(b)
Send service-related notifications (streak reminders — if you opt in)	Consent	Consent
Diagnose crashes you choose to share and improve service quality	Legitimate interests (debugging)	Legitimate interests
Comply with legal obligations (for example, a lawful request)	Legal obligation	Legal obligation

We do not:

Sell or rent your data to anyone.
Share your data with advertisers, data brokers, or analytics resellers.
Use your data to train AI models. Our AI partner agreements forbid the partner from training on your content.
Profile you for targeted advertising.
Make automated decisions that have legal or similarly significant effects on you.

5. AI processing — exactly what is sent

Linaw uses third-party AI services for two things only: voice parsing and receipt OCR. Per PRD §5.3, the data scope is:

AI call	Sent to AI partner	Never sent
Voice parse (Pro, only when your phone can't read the entry on its own)	The words of the voice entry (can include an amount) + your category and merchant names	Account names, balances, transaction history
Receipt OCR (every plan)	The image you captured (can include an amount) + minimal context	Your identity, account names

After processing:

Receipt images are deleted from our object storage within 60 seconds of the AI partner returning a result.
Voice transcripts aren't saved on your device once the entry is filled in. The AI partner's copy is governed by their retention policy (typically zero-retention for API calls).

Current AI partners (as of the effective date):

Google LLC, via the Gemini API (US-based processing).

If we change AI partners, this section is updated and the change is surfaced in-app before the new partner receives any of your data.

6. Sub-processors

We rely on the following processors. Each has its own privacy practices and security commitments.

Processor	Role	Location	What they receive
Apple Inc.	Sign in with Apple, App Store payments, StoreKit, CloudKit	USA	Apple subject ID, email (or relay), subscription transactions. iCloud sync is end-to-end between your devices.
Supabase Inc. (US-incorporated)	Backend hosting (Postgres + Edge Functions + Storage) — project `linaw-sg`	Hosting region: `ap-southeast-1` (Singapore)	Your `users` row, credit ledger, transient receipt images (≤60s).
Google LLC	AI processing via the Gemini API	USA	Pro voice entries your phone can't read on its own (with your category and merchant names), receipt images.

Each processor is bound by a Data Processing Agreement (DPA) that restricts use to providing the services we contract for, prohibits onward transfer, and requires equivalent security standards.

Cross-border transfers: Apple and Google are US-incorporated and process data in the United States. Supabase Inc. is US-incorporated but hosts the Linaw backend in ap-southeast-1 (Singapore); the data Supabase holds therefore physically resides in Singapore under Supabase Inc.'s contractual control. Transfers from the Philippines rely on each processor's contractual safeguards (Data Processing Agreements + Standard Contractual Clauses where applicable) and on your consent at onboarding. EU/EEA users transferring data outside the EEA rely on the processors' Standard Contractual Clauses (SCCs) where applicable.

7. Where your data is stored, and for how long

7.1 On-device

Your transactions and related metadata live in a local SwiftData store on your iPhone, protected by iOS Data Protection (encrypted at rest, accessible only after first device unlock).

If you enable iCloud sync, the same data is mirrored to your iCloud account via Apple's CloudKit infrastructure (encrypted in transit and at rest). Apple is the data controller for your iCloud storage.

7.2 On our servers

The minimal records we hold server-side (your users row, credit ledger) live in Supabase Postgres in the ap-southeast-1 (Singapore) region, encrypted at rest (AES-256) and in transit (TLS 1.2+).

7.3 Retention

Data	Retention
Transactions and related on-device records	Until you delete them, delete the app, or close your account
Receipt images on our servers	≤60 seconds, then deleted
Receipt-scan IDs	Up to 1 day, then deleted
Voice-parse IDs	Up to 1 day, then deleted
`users` row, credit ledger	Lifetime of your account; deleted within 30 days of account closure
Purchase fingerprints	Kept after account deletion: a one-way fingerprint of each past purchase, not linked to you, kept so a purchase can't be credited twice
Unused Pro balance	From account deletion until you sign in again with the same subscription (then moved to your new account) or the subscription ends, whichever comes first
Subscription records (Apple)	Per Apple's retention; we mirror status only
Crash reports	Per Apple's retention; only the reports you choose to share
Backups	Rolling 30-day window (Supabase managed)

When you delete your account, deletion propagates to backups within the next 30 days. Some records may be retained longer where required by law (for example, a lawful request). The only records we keep after deletion otherwise are the purchase fingerprint and, if a Pro subscription is still running, its unused balance, neither linked to you (§13).

8. Your rights

Depending on your jurisdiction, you have some or all of the following rights:

Right	How to exercise it
Be informed	This policy and the in-app summary at Settings → Legal
Access	Settings → Export → JSON or CSV of all your data
Rectify	Edit any record in-app at any time
Erasure / Delete	Settings → Delete Account — server-side deletion within 30 days
Restrict / Object	Turn off sharing with app developers in iOS Settings → Privacy & Security → Analytics & Improvements; uninstalling the app stops all collection
Portability	Same JSON / CSV export — open standard formats
Withdraw consent	Same as restrict / object; account deletion withdraws all consent
Complain	DPO contact below, or your local data protection authority

8.1 For PH residents (RA 10173)

You may file a complaint with the National Privacy Commission of the Philippines:

Website: https://privacy.gov.ph
Email: [email protected]

8.2 For EU / EEA residents (GDPR)

You may file a complaint with your national supervisory authority. Find yours at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

8.3 For California residents (CCPA / CPRA)

You have the right to know, to delete, and to opt out of "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined in the CCPA. We do not offer financial incentives in exchange for data.

To exercise any right, email [email protected] from the email associated with your Apple ID. We respond within 30 days.

9. Security

We use the following safeguards:

Transport: TLS 1.2+ for every network call.
At rest: Supabase Postgres AES-256 encryption; iOS Data Protection on-device.
Authentication: Sign in with Apple only — no passwords stored. Supabase session tokens with short expiry.
Authorization: Row-level security on every server table — your queries can only return your rows.
Secrets: API keys held in Supabase Vault (server) and iOS Keychain (client). Never committed to source.
Receipt pipeline: Pre-signed upload URL → AI partner OCR → deletion within 60 seconds. No long-term blob retention.
Logging: Server logs scrub email, Apple subject ID, and any free-text fields before retention.

No system is perfectly secure. If we discover a breach affecting your personal data, we will notify you and the relevant data protection authority within 72 hours of becoming aware, per RA 10173, GDPR Art. 33–34, and equivalent obligations.

10. Children

Linaw is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided personal data to us, contact [email protected] and we will delete it.

In some jurisdictions (e.g., EU), the age threshold is higher (typically 16). Where local law requires a higher age, that threshold applies in place of 13.

11. Notifications and marketing

We send the following categories of communication:

Service notifications (streak reminders) — only after you grant Notification permission in iOS. You can revoke at any time in iOS Settings.
Critical service announcements (security incidents, material policy changes) — sent via in-app banner and to the email associated with your Apple ID. You cannot opt out of these.

We do not send marketing email, promotional push notifications, or solicitations.

12. Cookies and tracking

The Linaw iOS app uses no cookies and no third-party trackers. We do not use the iOS Advertising Identifier (IDFA). We have not requested and will not request App Tracking Transparency permission.

The Linaw website at https://linaw.app uses no analytics, no cookies, and no third-party trackers. The only outbound network call from the marketing site is to deliver the page assets themselves.

13. Account deletion details

To delete your account: Settings → Delete Account → confirm.

What happens:

Immediately, if you're signed in: our server deletes your users row, credit ledger, free-scan count, purchase records, receipt-scan and voice-parse IDs, and any receipt image still in storage. Your client then signs out.
Immediately, on your device: your transactions, accounts, merchants, remembered merchants and streak are deleted; with iCloud sync on, each deletion syncs to your iCloud copy. Your settings and time-saved totals are reset and onboarding starts again.
Within 30 days: the deleted server records roll out of our backups (§7.3).

What stays:

Your categories stay on your device and in iCloud, so Linaw is ready if you start again. Deleting the app removes them from your device.
Apple's records. Apple keeps its own records of your purchases, and the two yes/no DeviceCheck flags it holds for your iPhone (§3.3). An active Pro subscription keeps renewing until you cancel it in your Apple ID settings.
Purchase fingerprints. A one-way fingerprint of each past purchase, not linked to you, kept so a purchase can't be credited twice (§7.3). It holds no account ID, product or amount.
Unused Pro balance. If your Pro subscription is still running when you delete your account, we keep your remaining credits and this month's usage counts under that subscription's purchase fingerprint, with no account ID. If you sign in again with the same subscription, they move to your new account once and are deleted; otherwise they're deleted when the subscription ends (§7.3).

We keep no other records of your account after deletion.

14. Changes to this policy

We may revise this policy from time to time. Material changes — such as adding a new AI partner, changing retention windows, or expanding the data we collect — are surfaced in-app before the change takes effect, with a revised effective date at the top of this page.

Minor clarifications (formatting, contact updates, typo fixes) may be made silently and are reflected in the "last revised" date.

If you do not accept a revision, your remedy is to delete your account before the new policy takes effect.

15. Contact

Email: [email protected] Data Protection Officer: Kristoff Ampong Address: Dumaguete City, Negros Oriental 6200, Philippines

For PH-specific privacy complaints: https://privacy.gov.ph