Privacy Policy.

The short version

What stays on your device

All of it, by default:

• Receipts, pay stubs, bank and brokerage statements, and any images or PDFs of them
• The text extracted from those documents
• Your transactions, accounts, balances, budgets, goals, bills and categories
• Everything derived from the above
• In the iPhone app, the prices fetched for your holdings (see Investment prices), which are kept on the phone and are never synced

In the Windows app these are stored in %AppData%\Addtivity\Finance on your machine. In the iPhone app they are stored inside the app on the phone. Unless you turn on books sync (below), they are not uploaded, not backed up by us, and not on our systems.

What that means if you lose your device: records that were never synced cannot be recovered by us, because we never had them. Keep your own backups.

What leaves your device, and why

1. Your account, if you create one

Signing in to Addtivity Command creates an account record. It holds your email address, an account identifier, the sign-in method you used, your app preferences, and a list of the devices you have signed in on (each device's name, an identifier generated by the app for that installation, its platform, the app version and when it was last seen). This is what lets your preferences follow you between devices.

You can sign in with an email address and password, with Google, or with Apple. We never see your password for Google or Apple.

• Google tells us the email address on your Google account, and also your Google account's name and the web address of its profile picture. We store the name and that address with your account.
• Apple tells us your email address, or a private relay address if you choose to hide it. We do not store a name from Apple.

Signing in is optional: every screen of the Windows and iPhone apps works without an account. Signing in on its own uploads none of your financial records.

Held by Supabase, our database provider, in the United States (US East). Every row is protected so that your account can read its own records and no others.

2. Your books, if you turn on books sync

Books sync carries your records between your own devices, signed in to your own account. It is off by default, in both apps, until you choose otherwise. It has three settings:

• Off — nothing from your books is sent.
• Records (any plan) — sends the figures and text of every record: transactions, receipts together with the text read from them, income records, statements, accounts, balances, budgets, goals and bills. Document files stay on the device that holds them.
• Everything (the Pro plan) — sends all of the above, and also uploads the document files themselves: receipt photos, scans and PDFs.

While sync is on we also keep what is needed to run it: which of your devices sync, when each last synced and why (for example, when the app opened or after a change), and daily counts of sync runs and data sent.

On the iPhone, the app asks for your agreement before your books are first sent, and records it (see Consent). On Windows, the Settings card says exactly what each setting moves before you choose it.

Synced books are held by Supabase in the United States (US East), protected so that only your account can read them through the apps. We store them so that your own devices can fetch them, and for no other purpose.

To stop: set books sync back to Off (More ▸ Settings on the iPhone; Settings on Windows). That stops anything further being sent. It does not delete what is already stored. To remove it, delete your account (see Keeping and deleting your data).

3. Your subscription, if you buy one

The iPhone app sells two optional plans, Basic and Pro. We never see your payment details. The purchase happens entirely inside Apple's App Store: Apple charges your Apple Account, and the app passes us Apple's signed record of the subscription. We do not receive your card number, your billing address, or your name from Apple.

What we store is the identifier Apple gives the subscription, the product bought, the plan it gives, when the current period ends, whether it was a test (sandbox) purchase, and which Addtivity Command account it belongs to — held by Supabase in the United States. That record exists so our server can tell which plan your account is on, for example whether it may store document files with Everything sync. Apple's own handling of the transaction is governed by Apple's privacy policy.

Your first 14 days in the iPhone app have no document limit. That allowance is kept on the phone, needs no payment, involves no data sent to us, and never turns into a subscription.

4. Update checks in the iPhone app

When the iPhone app starts, it asks our update provider, Expo (u.expo.dev), whether a newer version of the app's code is available. That request carries a random identifier for this installation of the app and the app's runtime version. It carries no account information and no financial data. We do not link that identifier to your account.

Signed out, with books sync off, this update check and the price lookups described next are the only requests the iPhone app makes on its own. Purchases and restores go through Apple's App Store.

5. Investment prices in the iPhone app

The iPhone app can show the investments you have recorded at today's prices. While you hold shares and Live prices is on (More ▸ Assets), the app asks Yahoo Finance (query1.finance.yahoo.com) for the symbols you hold: about once a minute while the Assets page or the Dashboard's Assets card is open, and once a day for each holding's price history. The request carries those symbols and nothing else — no account, no quantities, no amounts, no name. It goes from your phone to Yahoo directly, with no server of ours in between, so Yahoo sees your phone's connection the way any website you visit does. Yahoo's handling of it is governed by Yahoo's privacy policy.

The prices come back to your phone and stay there: they are not part of books sync and never reach our servers. They are shown as information, about a minute delayed, and the app places no orders. Turn Live prices off on the Assets page and nothing is asked; your holdings then count at what you paid. The Windows app does not fetch prices.

6. Bank connections (Pro)

Addtivity Finance can connect to your bank through Plaid, so transactions arrive on their own instead of from a statement. Not every build offers it: the app shows a Banks page when it does (Settings ▸ Banks on Windows, More ▸ Banks on iPhone), and nothing in this section happens until you connect one. The iPhone app on the App Store does not offer it yet. It is part of the Pro plan, it needs an account with two-factor authentication turned on, and before the first connection the app shows you what connecting means and records your agreement, in the words you saw and with the date (see Consent).

What Plaid receives. You finish at your bank on Plaid's own page, in your browser. Your bank credentials go to Plaid and to your bank, never to us or to the app. We ask Plaid for one thing only, its transactions product: the connection it gives us can read, and cannot move money, make a payment or change anything at your bank. To start a connection our server gives Plaid your account identifier, so Plaid can tell your connections from everyone else's; not your email address, and nothing from your books. Plaid's handling of what you give it is governed by Plaid's End User Privacy Policy.

What we receive, and where it goes. When a connection completes, Plaid tells our server the institution's name and, for each account you chose, its name, type, the last four digits of its number and its balance at that moment. Our server keeps those, together with Plaid's token for the connection, held by Supabase in the United States (US East) in a table that no app and no person can read directly. They exist so the server can fetch your transactions when you ask, and so the Banks page can name your accounts. The transactions themselves are fetched a page at a time and handed to the device that asked, which files them in your books there like any other record; our server keeps only its place in Plaid's list, not the transactions. They reach your account only if books sync is on, under the rules in section 2.

Disconnecting. Each connection has a Disconnect button on the Banks page. It revokes the connection at Plaid, not only in the app, and deletes what our server held for it. Transactions already imported stay in your books, because they are yours. Deleting your account revokes every connection the same way (see Keeping and deleting your data). Withdrawing your agreement on the Banks page is recorded, as the agreement was.

7. Optional lookups (Windows)

Some conveniences in the Windows app call out to the internet when you use them — product images, map geocoding for the errands route, and fuel prices. These send the specific thing you asked about (a product name, an address you typed) and nothing else about you. They are not required and the app works without them.

8. Diagnostics

In the Windows app, crashes are written to a log file on your computer. They are not transmitted anywhere. If you choose to send one to support, that is you sending us a file.

The iPhone app contains no crash-reporting or analytics service. If you have chosen in iOS Settings to share analytics with app developers, Apple may give us crash reports under Apple's own policy.

9. The waitlist, if you join it

The waitlist form on this website stores the email address you enter and the time you entered it, held by Supabase — nothing else. It is used for one purpose: telling you when Addtivity Finance reaches a new platform. It is not linked to any account or to anything in the app, and it is write-only from the website — the form can add an address but nothing on the internet can read the list back.

To come off the list, email us at the address below and we will remove you.

What we do not do

• We do not sell your personal information. To anyone, for any purpose, at any price.
• We do not share it with advertisers or data brokers, and there is no advertising in either app.
• We do not use your financial data to train machine-learning models. Categorisation runs on your own device against a fixed list, and what it learns from your corrections stays there.
• We do not use your synced books for anything but syncing them. If you turn on books sync, your records and documents are stored so your own devices can fetch them. We do not analyse them, and another account cannot read them.

Consent

Books sync on the iPhone. Before your books leave the phone for the first time, the app tells you what will be sent, where it is stored, and how to stop, and asks you to agree. The app records what you were shown, which version of that wording it was, and when you agreed — so that if the wording changes, you are asked again rather than assumed to have agreed to something you never read. Setting sync back to Off withdraws that agreement, and the withdrawal is recorded too: a consent you took back should not be indistinguishable from one you were never asked for.

Books sync on Windows starts switched off, and nothing is sent until you choose a setting on the Settings card that describes it. You can switch it off at any time.

Bank connections, in either app, are asked about the same way: before the first connection you are shown what connecting means, and your agreement is recorded with the wording and the date. Withdrawing it on the Banks page is recorded too.

Keeping and deleting your data

We keep your records until you delete them. Nothing is aged out automatically, because a receipt from four years ago is still a receipt you may need for a tax question, and deleting somebody's records on a timer is not a feature.

Deleting records from a device

On Windows, Settings ▸ Account ▸ Delete my financial data deletes the records and stored images on that computer, and revokes at Plaid any bank connection an earlier test version made on it. It does not delete copies already synced to your account; to remove those, delete your account as described below.

On the iPhone, records stored on the phone are deleted when you delete them in the app or delete the app.

Deleting your account

You can delete your Addtivity Command account from inside either app — on the iPhone under More ▸ Settings ▸ Addtivity Command account ▸ Delete my account, and in the Windows app under Settings ▸ Account ▸ Delete my Addtivity Command account — or by emailing us at the address below from the account's email address.

Deleting the account removes from our systems:

• the account record and profile (including any name and profile-picture address from Google);
• your device list and your preferences;
• your plan record and the verified purchase records;
• your synced records and synced documents;
• your sync devices and sync activity; and
• any bank connection made with an earlier test version, which is revoked at Plaid.

Every device signed in to the account is signed out.

Deleting the account does not cancel an App Store subscription. Apple keeps billing until you cancel it in Settings ▸ your name ▸ Subscriptions on your iPhone. It also does not delete records stored on your devices; you delete those yourself, as described above.

Deletion is permanent and cannot be undone by you or by us. Files are removed as part of the deletion, and anything that cannot be removed at that moment is retried automatically afterwards.

Your rights

Depending on where you live you may have rights to access, correct, delete or export your personal information, and to object to certain processing.

In practice: your financial data is already in your possession, in a database on your own device. You can read it, copy it, or delete it without asking us. For the account information we hold, and for any books you have synced, contact us at the address below and we will act within the timeframe the applicable law requires — or delete it all yourself by deleting your account.

We will never charge you for exercising a privacy right, and never treat you differently for it.

Children

Addtivity Finance is not directed at children under 13, and we do not knowingly collect their information.

Changes

If this policy changes materially we will say so in the app rather than quietly updating the page, and where the change affects what you previously agreed to, we will ask again.

Contact

Addtivity Data LLC
hello@addtivitycommand.com