Privacy Policy
Draft. Effective date: to be set.
The short version. Your transactions, balances, and budgets are stored on your iPhone, not on our servers. Our server keeps only what it needs to connect to your bank. We don't use analytics, ads, or tracking of any kind, and we never sell your data.
Who we are
Isosceles is an iPhone app for people in the United States. "We" means the developer of Isosceles. Contact: support@isosceles.app.
What stays on your iPhone
Your transactions, account names and balances, categories, budgets, and anything you type in yourself are stored in the app on your iPhone. They are not synced to iCloud or to our servers. Your sign-in session is kept in the iPhone's Keychain.
Connecting your bank (Plaid)
We use Plaid to connect to your bank. You log in to your bank through Plaid; we never see your bank username or password. Plaid's handling of your data is described in the Plaid End User Privacy Policy.
When the app fetches your transactions, they pass through our server on the way to your iPhone. Our server does not save them. It keeps only:
- an encrypted access token for your bank connection (stored in an encrypted vault, never sent to your iPhone);
- Plaid's identifiers for the connection, the bank's name, and the connection's status and dates (for example, when it was connected or removed, or whether it needs you to log in again).
Merchant logos in the app are loaded from Plaid's servers, which see your device's IP address when they're loaded.
The free snapshot
With the free plan, we bring in your bank history once and then end the connection: we tell Plaid to remove it and destroy our access token. Your history stays in the app on your iPhone.
So that each person gets one free snapshot, we keep a record that your account has used it. Where your bank provides a permanent account identifier, we also keep a one-way, scrambled (hashed) version of it, not linked to your account, so the same bank account can't get another free snapshot. It can't be turned back into the identifier.
Isosceles+
With Isosceles+, your bank connection stays open so new transactions keep arriving. Payments are handled by Apple; we never see your payment details. We keep a record of your plan and when it ends. If your subscription ends, we remove the bank connection; what's already on your iPhone stays.
Signing in
You only sign in when you connect a bank. You can use Sign in with Apple (you may choose to hide your email address; Apple then gives us a private relay address) or a one-time code sent to your email. We keep your email address and a user ID so your bank connection stays tied to you. There are no passwords.
Sign-in codes are sent by our email provider, Resend, which processes your email address to deliver them.
Notifications
The only notification is a budget alert, when you're close to or over a monthly limit. It's created on your iPhone from data on your iPhone; nothing is sent to a server to make it. You can turn it off in the app's Settings or in iOS Settings.
No analytics, ads, or tracking
The app contains no analytics, advertising, or tracking code, and neither does this website (no cookies, no scripts). We don't sell or share your data for advertising.
Service providers
- Plaid: connects to your bank.
- Supabase: hosts our server, its database, and sign-in. Like most hosting services, it keeps short-lived technical logs (such as IP addresses and request times) for security and reliability.
- Resend: sends sign-in code emails.
- Cloudflare: hosts this website and forwards email sent to our addresses.
- Apple: Sign in with Apple and, for Isosceles+, payments.
We don't log your transactions, balances, or account numbers.
Export and delete your data
- Export: Settings → Export to CSV saves a copy of your transactions.
- Disconnect your bank: Settings → Disconnect. We remove the connection at Plaid and destroy our access token.
- Delete everything on your iPhone: Settings → Delete all my data disconnects your bank, erases all data in the app, and signs you out. Deleting the app also erases its data.
- Delete your account on our server (your email address and connection records): email support@isosceles.app from the address you signed in with.
How long we keep data
We keep your account and connection records while you have an account. Access tokens are destroyed as soon as a connection ends. The anonymous free-snapshot records described above are kept to prevent repeated free snapshots.
Security
Data travels over encrypted connections (HTTPS). Bank access tokens are stored encrypted on our server and are never sent to your iPhone. Your data on your iPhone is protected by iOS.
Children
Isosceles is not meant for children under 13, and we don't knowingly collect their data.
Your rights
You can ask what data we hold about you, ask us to correct it, or ask us to delete it by emailing support@isosceles.app.
Changes
If we change this policy, we'll update this page and its effective date. If a change affects how your data is handled, we'll tell you in the app first.