Privacy Policy

BalanceWright is a phone app for iPhone and Android. It is built for phones. It is not designed or tested for tablets.

This policy covers both, and nearly all of it is the same either way: your register is stored the same, the same services are used, and the same one switch turns the crash reports and the anonymous counts off. What genuinely differs is which company’s backup your register is included in, which folders a copy of it can be written to, and the permissions the Google Play listing has to declare. Where they differ, the paragraph says which phone it is talking about. You should not have to guess which half of a sentence applies to you.

Every account, entry, payee, category, statement and backup you create is stored on your own device. We never receive it. We could not look at your register if we wanted to.

There is no sign-in, so there is nothing to be signed out of. We never ask for your name, your email address, your bank, or your card.

Every copy of your register that leaves your phone goes to you — into your own account or your own folder — and never to us. Your phone’s own backup is the first of them. It does the same job on either phone, but through a different company’s account, so both are written out here. You should be able to see which account of yours holds a copy of your register without having to work out which half of a sentence is about you.

We do not have access to either one. They are your backups, in your account, under your control.

The app makes its own backups too, and keeps them on your phone. You can also point it at a folder you pick, so a copy lives somewhere you can see it. That much is the same on either phone.

Your register lives on your own phone, and the app keeps rotating copies of it by itself.

• On iPhone, if you are signed in to iCloud with iCloud Drive turned on, every copy is also written to the app’s own iCloud Drive folder, by itself. If you are not, the Backup screen tells you so rather than claiming a copy it did not make.
• On Android, the register is included in the phone’s own backup, and you can pick a folder for the app to write its copies into — one that syncs to Google Drive if you want it to.

On Android 10 and newer, there is one more copy, and it is the only one that needs nothing from you: the app writes those same copies into a BalanceWright folder inside Documents on the phone itself. Nothing leaves your phone because of it. But it does sit outside the app, where your phone’s Files app can open it, and it stays there after the app is removed — which is why it is in “Deleting your information” below.

You can also save a copy anywhere you like and restore from it — your own folder, a file you emailed to yourself, or iCloud Drive on an iPhone.

Wherever a copy you send out of the app lands, it lands somewhere of yours, not of ours. If you choose an iCloud Drive folder, or a folder on Android that syncs to Google Drive, that copy is held in your own Apple or Google account, under their terms rather than ours.

three services help keep the app working. None of them ever receive your register: not your balances, not your entries, not your payees, not your amounts.

• Sentry — Crash reports — device model and what the app was doing when it stopped. The report says which device and which system version, and where in the code it broke. Personal information and screen recording are switched off.
• PostHog — Anonymous counts, such as "a statement was reconciled". There is an off switch in Settings. The counts are tied to a random install number, never to you. Screen recording is switched off, and no personal profile is created.
• RevenueCat — Records the one-time purchase so it can be restored on a new phone. The store handles the payment. We never see your card.

Settings has one privacy switch, and it is on when you install the app. Turning it off stops both the crash reports and the anonymous usage straight away, and it stays off until you turn it back on. It is one switch on purpose, because a switch that only stopped half of it would be misleading.

One honest detail: if the app crashed the last time you used it, that earlier crash report may be sent while the app is starting up, before it has read your setting. After that, nothing.

The purchase record is not on that switch, because the app has to be able to recognize your unlock again on a new phone. That is the whole of what it is for.

The app never shows you a permission prompt, on either phone. It does not ask for your contacts, your location, your photos, your microphone or your camera.

On Android, the Google Play listing shows a few standard permissions. None of them ever prompts you, and none of them is used to send your register anywhere:

• Internet — used by the crash reports, the anonymous counts described above, and the one-time purchase check. That is all it is used for.
• Vibrate — comes with the standard Android build. The app does not use it. It never vibrates.
• File access on Android 12 and older — comes with the file tools the app is built from. Choosing a backup folder uses Android’s own folder picker, which does not need it.

It works with no internet connection. There is no bank login, so there is no password of yours to lose and no sync to break.

This site has no accounts and no advertising trackers. Our host, Cloudflare, counts page views for us; that count is anonymous and is not joined to anything about you. We also count page views and a few button presses ourselves, with PostHog, the same service the app uses. It keeps no cookie and stores nothing in your browser. It records the page, the page you came from and which button was pressed, tied to a random number that changes on every visit. We see totals, never people.

That counting is done by Cloudflare Web Analytics, which loads a small script on each page. It records the page, the referrer, and rough device and country information. It sets no cookie, it does not follow you to other websites, and it does not build a profile of you. We see totals, never people.

PostHog records a few things on this site as well: the page, the page you came from, which button you pressed, and a rough idea of the kind of device you are using. It sets no cookie and stores no identifier in your browser, and it does not follow you to other websites. It never sees anything you type into the calculator on this site, and it does not work out your location from your address, because that setting is switched off on our project. It honours your browser’s Do Not Track signal, and PostHog processes this information on servers in the United States.

If you write to us, we use your address to answer you and for nothing else. It is never added to a mailing list, never sold, and never passed on.

There are no ads, before you pay or after, because there is no ad code in the app at all.

We do not sell your information to anyone. We do not track you across other apps or websites, and we do not use advertising identifiers.

BalanceWright is made for adults managing their own money. It is not directed at children, and we do not knowingly collect information from them.

Your register stays on your phone until you delete it or delete the app. Crash reports and anonymous usage counts are kept for a limited retention period by the services named above and are not tied to your identity. Purchase records are kept for as long as needed to honor your purchase.

Deleting the app removes the register from your phone. A copy of it can outlive the app in the places below, and every one of them is yours to remove:

• If you turned on your phone’s own backup, remove that copy in your phone’s settings — on iPhone under your name, then iCloud; on Android under Google, then Backup.
• On iPhone, if you are signed in to iCloud with iCloud Drive on, the app has been keeping its own BalanceWright folder there, made to survive the app being removed. Open the Files app and delete that folder.
• On Android 10 and newer, the app has been keeping the same kind of folder on the phone itself: BalanceWright, inside Documents. Those files outlive the app too, and once the app is removed it can no longer see them, so this one is yours alone to clear. Open your phone’s Files app, then Documents, then BalanceWright.
• If you saved backup files to a folder of your own, on either phone, delete those files.

If you want the anonymous usage and crash data associated with your install removed, write to support@balancewright.com and include the install number, which is on the Get help screen inside Settings (called Diagnostics before version 1.0.1). That number is what the reports are filed under, and without it there is nothing to look up. Because the switch starts on, there is normally a number there to copy. If you turn the switch off, that screen says so in place of the number from the next time you open the app — and an install that has only ever run with the switch off has never filed anything to remove.

If this page changes, the date at the top changes with it.