Privacy Policy

Effective 2026-10-07

Penny is a personal memory app: you capture thoughts, photos, voice notes, lists, and links, and Penny organizes and resurfaces them for you. Your memories are yours. This policy explains what Penny stores, how it is used, and the controls you have.

1. What Penny stores

• Your memories — the text, photos, voice recordings and their transcriptions, lists, links, and people tags you capture, together with the categories, reminders, and metadata Penny derives to organize them.
• Your account — your email address (a Penny account is required to use the app), how you signed in (an email code, or — if you used Sign in with Apple or Sign in with Google — that provider's account identifier), authentication credentials (stored hashed, never in plain text), your time zone (used to schedule your briefs and reminders in your local time), and your settings. If you signed in with Apple and chose to share your name, Penny stores it (Apple only shares it on your first sign-in with a given Apple ID); Penny does not store a name from Google sign-in. The nickname you type in Settings ("What Penny calls you") stays on your device only — it is never sent to Penny's servers.
• Calendar context — if you grant calendar access, Penny reads event titles, times, and (when present) location and attendee names to match memories to upcoming events. Matched event details are stored on Penny's servers in a rolling per-account cache — used only to avoid re-flagging the same event twice across scans and to keep a short record of why a note was or wasn't linked to an event. Cached events are deleted automatically once a scan stops seeing them for 14 days, and immediately when you delete your account. The one exception: an event that is linked to one of your notes is kept, with that link, for as long as the link is active. Penny's servers do not keep a general archive of your calendar. If you've allowed AI processing in Settings, an event's title may be sent to OpenAI to power embedding-based matching; for a closer judgment call on your own candidate notes, the event's title, start time, and the text of those notes may also be sent to Anthropic's Claude, which decides whether a specific note is really about that event. Both are under the same no-training terms described below, and both only happen if you've allowed AI processing.
• Subscription state — your plan and entitlement status, billed through Apple's App Store with RevenueCat managing subscription entitlements. To do that, RevenueCat receives your Penny account ID, your App Store purchase records, and your device's vendor identifier (IDFV, an Apple-provided ID that is not used for advertising). Penny never stores payment information.
• Notes you choose to share — if you share a note, Penny creates a public, read-only link for it. Anyone with that link can see the note's title, text, checklist items, and photo (if it has one); the page also shows your first name as the byline if Penny has a name on file for your account (see "Your account" above), and otherwise shows no byline. You can revoke a share link at any time by locking the note or deleting it — once locked or deleted, the link stops working.
• Technical & device data — like any internet service, Penny's servers and the providers that host them receive the IP address your requests come from. Penny uses it to keep the service secure and prevent abuse (for example, capping how many sign-in codes an address can request per hour), never to build a profile of you. Crash reports and feedback you send include your app version, iOS version, and device type. If you enable notifications, Penny stores a device push token to deliver your reminders and briefs through Apple's push service; it is deactivated when you sign out and permanently removed when you delete your account.
• Where it's hosted — Penny's app servers and database run on Fly.io; photos and voice recordings are stored in Cloudflare R2 (S3-compatible object storage); this legal site and Penny's app update checks are also served through Cloudflare; sign-in codes and feedback emails are sent via Resend; subscriptions are managed with RevenueCat; push notifications and purchases are handled by Apple; and the AI providers described below (OpenAI, Anthropic, ElevenLabs) process content transiently as described there. Analytics run through Google Analytics, and crash reporting through Sentry.

2. How your memories are used

• Your memories are used for exactly one purpose: making Penny work for you — organizing, searching, resurfacing, and briefing.
• Your memories are never used for AI model training. Penny calls three AI providers to make your memories useful: OpenAI (its Whisper models transcribe your voice recordings, and its embedding models power search and calendar matching), Anthropic (its Claude models categorize your notes, read photos you capture, help find your memories, and judge whether a note relates to a calendar event), and ElevenLabs (which synthesizes Penny's spoken voice). What you type into search is part of this: with AI processing on, your search words are sent to OpenAI, and to Claude together with the notes being ranked. With AI processing off, searches stay on Penny's servers. These calls are made with server-side keys under contracts that prohibit training on your data, the providers process your content transiently, and Penny itself never trains models on user memories. Your audio, photos, and text are stored only with your note, in your Penny account, until you delete the note or your account. You can decline or switch off AI processing at any time in Settings.
• No third-party ads, and your memories never leave Penny. Penny shows no third-party ads and never sells, rents, or shares your memories, photos, voice recordings, transcripts, or searches with anyone for their own purposes. What's inside your notes is only ever touched by the service providers who store or process it on Penny's behalf — the AI providers described above (under contracts that forbid training on your data) and the hosting/storage providers named in "Where it's hosted" above — never an outside party with a use of its own for your content.

  Penny sends a small amount of content-free activity and diagnostic information to two service providers, Google Analytics and Sentry. This is on by default, and both switch off the moment you turn off Settings → Usage analytics:

  • Google Analytics learns that something happened — you opened the app, created an account, completed an onboarding step, captured a memory, opened a brief, ran a search, viewed a category, set a reminder, or tapped a buy-now link — plus a few structural details like counts and categories, a session id, and a timestamp. It never learns what you wrote, said, searched for, or photographed. Instead of your account, Google sees a one-way scrambled code unique to you: it can tell your activity apart from someone else's, but it cannot turn that code back into your name, email, or account.
  • Sentry, our crash-reporting service, receives the error and a cleaned-up stack trace when the app crashes, and an error code when a purchase or restore fails — never your memories or any personal information. Separately, Penny's own servers also keep a brief, content-free crash record for our own reliability metrics — the error type, app version, platform, and a redacted stack signature, linked to your account — never a raw trace, message, or any note content.

  Turning off Settings → Usage analytics stops all of the above, and also asks Google to delete what it already has about you. Permanently deleting your account does the same. One thing continues either way, because we need it to keep the service working: if a background task on Penny's servers fails for good, a report with the kind of task, a random task id, and the error type goes to Sentry. It contains none of your content and no account details.

  Commerce shortcuts are not enabled in the current release, so no data is shared with commerce partners today. If they are enabled in a future version, the only data shared will be anonymous, aggregate intent patterns — never an individual user's memories or identity.

• Feedback you send us. When you use Settings → Send feedback, the message you type, your account email and account ID, and your app version, OTA build, iOS version and device type are emailed to the Penny team via Resend (our transactional email provider, already used for sign-in codes). Don't include note content you'd rather keep private; feedback is kept in our mailbox only as long as needed to act on it.
• Voice-capture timing (temporary). If you have started a voice capture since the app last opened — whether or not it became a saved note, and including attempts that ended because microphone permission was refused — the same feedback email may also carry timings for those attempts (they are dropped when your own message needs the space): how many milliseconds passed between pressing the coin and the microphone producing its first sample, whether the microphone permission was granted or denied, and the reason codes iOS reported for any audio-route change (for example, switching to a car's Bluetooth). This is measurement only — no audio, no transcript, and no note content of any kind, and nothing is written to storage; it is held in memory and discarded when the app closes or you sign out. It exists to diagnose a lag before the microphone opens on car Bluetooth, and will be removed from the app once the cause is found.

3. Your controls

• Export at any time — you can export all of your data at any time from Settings → Export All Data (or, once your free period has ended and you have not subscribed, from the plans screen: Export my data). The export includes every memory, list, and attachment in a portable format.
• Permanent deletion at any time — you can permanently delete all of your data at any time from Settings → Delete Account & All Data (or, once your free period has ended and you have not subscribed, from the plans screen: Delete account). Deletion is irreversible and removes your memories, derived metadata, and account records from Penny's servers.
• Note Lock — individual memories can be locked behind Face ID / passcode; locked content is masked everywhere it would otherwise surface.
• Calendar access — granted and revoked by you in Settings at any time.
• Usage analytics — on by default; turn it off (or back on) at any time in Settings → Usage analytics. Off stops the Google Analytics and Sentry reporting described above and asks Google to delete what it holds about you.
• Commerce shortcuts — not enabled in the current release. If they ship in a future version they will be optional, and you will be able to disable them globally or per retailer in Settings → Commerce.

4. Affiliate disclosure

Retailer shortcuts are not enabled in the current release, so Penny earns no affiliate commission today. If they ship in a future version, some may use affiliate links and Penny may earn a commission at no extra cost to you. Affiliate relationships will be disclosed here and in the Commerce settings screen. Penny never stores payment information, and affiliate partners never receive your memories or identity.

5. Security

• API keys for Cowork integration are never stored in plain text (hashed per-user keys, TLS-only transport).
• AI provider keys are held server-side only — never embedded in the app.
• Data in transit is encrypted via TLS; data at rest is encrypted on Penny's infrastructure.

6. Compliance

Penny is designed to be GDPR and CCPA compliant from day one: the export and permanent-delete controls above implement the corresponding access and erasure rights, and Penny processes only the data described in this policy.

7. Contact

Questions about this policy or your data: penny@penny-thoughts.com.