Privacy & your data

When you tap “Back up now”, a copy of the following is uploaded:

• Your name (if you set one), currency, theme and budget-period settings, and monthly income if entered
• Your accounts: nickname, type, bank, currency, credit limit, statement and due dates
• Every transaction: date, amount, category, description, merchant, payment method, tags, any notes you wrote, and whether a spend is a business claim and when it was paid back
• Your categories, monthly limits, subscriptions and instalment plans
• Card rewards setup: earn rates, points balances, and miles goal
• Your savings goal: its name, target, and how much you have put aside
• Your trips: name, dates, the currency you logged in, and the tag they stamp on entries
• Split data: the names you entered for other people, who owes whom, and settlements

Your email address and a hashed form of your password are also stored, because that’s what signing in requires. If you sign in with Apple, Apple shares only your name and an email address, which can be a private relay address if you choose Hide My Email; no password is stored. If you sign in with Google on Android, Google shares your name and your Google account’s email address, and no password is stored either.

Paying for Plus. Apple takes the payment on iPhone and Google Play on Android. PiggyBank never sees your card or bank details; the phone only learns from the store that Plus is active.

Invites. If you invite a friend, the server keeps your invite code, which friend used it, and, for the 30 days after they join, a count of the days they logged something: a date and a number, never what they spent. Your friends see only your first name; you see only the name they chose. That name is the one you set in the app, kept with your account once you share an invite or use one. Nothing from your address book is ever read.

Receipt photos, with Plus. A photo you keep with a business expense stays on the device that took it. If you have Plus and back up, the photo is kept with your backup too, in a folder only your account can read, so a restore on another device brings it back. It leaves the backup when you remove it from the spend, and with everything else when you delete your account. Without Plus, nothing about a receipt is uploaded.

On Supabase, a hosted database service, in the Singapore region. Supabase encrypts data in transit and at rest. They host it on my behalf and don’t use it for anything of their own. Receipt photos go there only with Plus and only when you back up; on the phone itself they are files inside the app, and on the web they sit in your browser’s own storage for this site.

Your data is locked to your account, so no other PiggyBank user can reach it. That’s enforced by the database itself, not just by the app.

Being straight with you about the exception: I built and run PiggyBank, so I technically can read what’s in the database. I don’t, and my commitment is that I only ever look if you ask me to help with something specific, such as a backup that failed or data that came back wrong. That’s a promise about how I behave, not something the system stops me from doing, and you deserve to know the difference.

Nobody else has access. Your data is never sold, shared, or used for advertising. There is no tracking or analytics of any kind in this app.

Split lets you record what you owe friends, which means you may enter other people’s names. When you back up, those names and the amounts attached to them are uploaded too.

Those people aren’t PiggyBank users and haven’t agreed to anything, so please only enter as much as you actually need. A first name or a nickname is plenty. If someone asks you to remove their name, edit or delete those entries in the app and back up again: the backup is replaced by what is on your phone, so the name goes with it.

Everything above is about data only you (and I) can see. Barns are different by design: a barn is a shared space, and the people in it see each other’s barn data. Joining one, whether by creating a barn or redeeming an invite code, is how you agree to that.

• Barnmates see the nickname you chose for that barn (never your account name or email), your critter, and where you put it in the yard
• They see every expense and settlement logged in that barn: descriptions, amounts, dates, and who paid
• They see nothing else: not your budget, transactions, other barns, or anything from the rest of the app

Barn data lives only on the server (that’s what makes it shared) and is not part of your backup. Leaving a barn stops you seeing it and it seeing you, but the expenses you logged stay, because the others’ balances depend on them.

Barn alertsare off until you switch them on. On, a barnmate’s new bill reaches your phone as a notification carrying their barn nickname, the bill’s name, the barn’s name and your share; it travels through Apple’s push service on iPhone, or Google’s (Firebase Cloud Messaging) on Android, to get there. To send it, the app keeps a push token for this phone on the server; switching alerts off or signing out deletes it.

If you allow it in Android’s settings, PiggyBank reads notifications from a short list of bank and wallet apps (such as DBS, PayLah!, OCBC, UOB, HSBC, Citi and Google Wallet) to log your payments for you. It keeps only a notification that names an amount, reads the amount, the shop and the card’s last four digits from it, and makes a row in your ledger on the phone. The notification itself is never sent anywhere or kept once its row is made, and notifications from every other app are never read. A screenshot you share to PiggyBank is read the same way, on the phone. Switch notification access off in Android’s settings at any time; the rest of the app works without it. Log by voiceuses your phone’s own speech service: it hears you and hands PiggyBank the words, never the recording.

Settings → Tell Piggy sends what you typed: the note itself, whether you marked it a bug, idea, praise or something else, the app version and whether you were on the phone app or the web. If you are signed in, your account comes with it so a reply is possible; if you are not, the note arrives with no name attached and that is fine. On its own the note carries nothing else — no amounts, no categories, nobody you split with — unless you attach a picture that shows them. A copy stays on your device under your own feedback list, which is yours to delete. Deleting it there does not unsend the note, the same way deleting a sent email doesn’t.

Attachments are yours to add, and they go with the note. Shaking the phone, or taking a screenshot, offers a picture of PiggyBank’s own screen — the app draws that one itself rather than reading your Photos. Add a screenshotis the other way: it opens your photo library so you can pick an image yourself, and whatever you pick is sent. Either way you see the picture before you send, and a picture of a PiggyBank screen shows whatever was on it — amounts, categories, names.

A voice note is recorded on the phone and turned into text on the phone; no speech service hears it. Both the recording and that text are sent with the note. Attachments are kept for 90 days, the note itself for as long as it is useful, and only the developer can read either — no other person using PiggyBank can reach them. So that a note is seen the day it arrives, each one is also delivered to the developer’s own phone as a private message (through Telegram), with its screenshot and voice note; that copy sits in the developer’s private chat and nowhere else.

If the app hits an unexpected error, it sends a technical report: the error message, where in the code it happened, which screen you were on, the app version, and a random id that tells one install’s reports apart from another’s. Before anything is sent, the report is scrubbed: web addresses are stripped of anything after a “?”, long runs of digits and email addresses are masked, so an amount, a card number, or a search you typed can’t ride along even by accident. Reports are not tied to your name or account, no one can read them back out of the app, and they are used for exactly one thing: fixing bugs.

To delete your PiggyBank! account, in the app: Settings → Backup & Sync → Delete my cloud backup. That removes the uploaded copy and closes your account, including any Split names in it. It happens immediately and can’t be undone. Everything on your device is left alone. You can keep using PiggyBank exactly as before, or create a new account later.

What goes, at once:your account and sign-in, the cloud copy of your ledger (spends, cards, budgets, subscriptions, trips, split entries and settlements, miles), receipt photos in the backup, your seats in barns, the bills you posted in them (your barnmates’ balances change to match), barns you raised (for everyone in them), your referral record, and the notification token for your phone.

What stays:crash reports and feedback notes you sent, with the link to your account removed. They carry a random device code, never your name or email, and are kept only to fix the bug they describe: attachments for 90 days, the note for as long as the fix takes. Delete a note yourself under Settings → Tell Piggy. Nothing else is retained, and there is no backup of the backup.

This page previously warned that backup only ever added, so a transaction you deleted could linger in the cloud copy. That is fixed. Backing up now replaces the stored copy with exactly what is on your device, so a deletion here is a deletion there. It also means the newest backup is the only one. There is no history of earlier versions to go back to.

Deleting is yours to do, and it needs no one else. To correct something, change it in the app and back up again; the copy follows your phone. For a copy of what is stored, Settings → Import & export → Export writes it out as a file. If you have deleted the app, reinstall it, sign in, and the same controls are there.

You never have to make an account. Everything that tracks your money works without one, and it always will. The trade-off is simply that if you delete the app, clear its data, or lose the device, nothing can be recovered.

Send a note from Settings → Tell Piggy. It reaches me directly, whether or not you have an account. Ask anything about how your data is handled. Removing it, correcting it and taking a copy are all done in the app, above, and never need a request.