Privacy policy.

When you join the waitlist

We collect your email address and, if you provide it, your first name. We use these to send Ipon launch updates.

We also save the referral source supplied in the page address (utm_source or ref) and the referring page address provided by your browser, if available. This helps us understand how people found Ipon. The source is limited to 40 characters and the referring address to 200 characters.

The waitlist is stored in Supabase. The public form can submit a signup but cannot retrieve the list. We keep your signup for launch communications until you ask to be removed or we no longer need it for that purpose. To leave the waitlist or request deletion, email support@iponapp.com.

Information used by the app

You provide records when you type, import a backup, select an image, or request a feature. Sign-in and usage records are generated when you use the service.

• Account information: email address, an account identifier, authentication credentials handled by Supabase Auth, verification status, and account/sign-in timestamps, for authentication and account security. If you sign in with Apple or Google, Ipon also receives that provider’s account identifier and the email address it shares (with Apple this can be a private relay address) and, the first time you use Apple, the name you choose to share.
• Financial records: transaction amounts, dates, names, categories, tags, notes, recurring bills, budgets, and related edit records, for tracking, sync, and your change history.
• Credit card metadata: bank name, nickname, last four digits, credit limit, statement date, and due date, for bill tracking.
• Images and AI input: selected bill or statement images, pasted text, questions, conversation context, and relevant ledger information included in an AI request. The original image is not saved to Ipon’s database; extracted records you save become part of your ledger. Provider processing is described below.
• Preferences and access: settings, templates, and Pro entitlement status, source, expiry, product and transaction identifiers where applicable, to provide the correct features. Apple handles App Store payment details; Ipon does not receive your full payment-card number.
• Optional product analytics: only if you turn it on, the app sends a random installation identifier, event names such as app opened, screen viewed, entry saved, or feature used, and limited properties such as app version, platform, environment, entry type, and a small set of feature or screen labels. The identifier is generated for analytics on that device and is not your Ipon account ID.
• AI usage records: your account identifier, request time, feature, model, token counts, an estimated cost, and success or failure status, for your plan’s AI limits, service operation, and cost monitoring. They never contain your question, photo, pasted text, or the answer. These are not advertising analytics.
• Support communications: your email and the information you choose to send, so we can resolve your request.

Information we don’t ask for

Ipon does not connect to bank accounts or ask for bank passwords, full card numbers, contacts, location, or advertising identifiers. Optional product analytics never includes amounts, entry names, notes, tags, categories, bank or card details, photos, AI prompts, email addresses, account IDs, or transaction IDs. Ipon does not use an analytics SDK, advertising tracker, or cross-app identifier.

We do not sell your data, share it with advertisers, or track you across other companies’ apps and websites. A document or note you submit can nevertheless contain sensitive details. Please redact full card or account numbers, security codes, bank passwords, and unrelated personal information before uploading. Ipon cannot promise that an unredacted image contains only the fields it needs.

Storage, access, and service providers

Supabase provides authentication, database storage, and server functions. The app database and waitlist are hosted in Singapore (ap-southeast-1). Row-level security separates ordinary users’ account data. Authorized operator access is separate: the private dashboard shows account and plan information, the waitlist, and AI usage metadata. Administrative access is restricted to operating, securing, and supporting Ipon, not advertising.

The app also stores records on your device for offline use. Signing into sync sends account records to Supabase. Session credentials are stored on your device to keep you signed in; the private dashboard uses tab-scoped session storage. These are functional storage, not advertising cookies.

PostHog processes the optional, minimized product-analytics events described above in the United States. Ipon sends events directly without PostHog’s app SDK, automatic page or interaction capture, session replay, or person profiles. PostHog receives the event request’s network information as a service provider. We use the aggregate results to understand whether core features work and where the app needs improvement, not for advertising.

Google processes optional AI requests through the Gemini API, only after you allow it in the app, as described below.

Cloudflare hosts and secures the website and dashboard. Network requests disclose technical data such as IP addresses and request/browser information to the services receiving them. Providers may process security logs and operational data outside Singapore. Website fonts are self-hosted, and the website has no analytics scripts.

Apple handles App Store distribution and, when enabled, subscription purchases and billing under its own policies. Our support email provider processes messages you send us. We may disclose information when legally required or necessary to protect accounts and respond to abuse, limited to the relevant purpose.

For public release, service providers must protect user information at least as strongly as the commitments in this policy and Apple’s applicable privacy requirements. We must verify suitable contractual and technical safeguards before enabling a provider. We do not authorize a provider to use your financial records for advertising. A provider change that needs new permission must be disclosed before data is sent.

Support access: To help you when you contact us, Ipon support can view your account’s details, such as your email address, sign-in methods, plan and AI usage, but not your financial records.

Optional cloud AI and your permission

Ask Ipon, Photo scan, Paste text, and smarter Fill are optional AI features of Ipon Pro. They use Google Gemini. The app sends each request to Ipon’s own server function on Supabase, which checks your plan and AI limits and then forwards the request to Google. The app never contacts Google directly and does not contain Ipon’s Google key.

What is sent, and why: Ask Ipon sends your question, the last few messages of that conversation, and a summary of your budget: this month’s entries and totals, last month’s totals, and your categories, budgets, bills, repeating entries, and card balances. Photo scan sends the one photo you choose. Paste text sends the text you paste; the basic paste-text reader works on your device and sends nothing. Smarter Fill sends the note you typed with your category, tag, and template names. Each request is used only to answer it: to reply, to read the photo or text, or to fill the entry. It is not used for advertising.

Your permission comes first: the first time you use one of these features, Ipon shows what will be sent and to whom, and asks once for your permission. Nothing is sent to Google until you tap Allow. Buying Pro, accepting terms, or granting camera access is not that permission. If you decline, manual entry and the basic on-device Fill keep working.

Turning it off: go to Settings → Privacy & data → Ask Ipon permission and turn off Send to Google Gemini. This stops all future AI sharing from your account on that device, and Ipon asks again before the next use. It cannot undo requests already processed. For help with information you already sent, email support@iponapp.com.

Google’s handling: Ipon uses Google’s paid Gemini API service. Under the Gemini API terms for paid services, Google does not use your prompts or responses to improve its products. Google may keep limited logs to detect abuse and meet legal requirements, and may process data outside the Philippines. This is not a promise of zero retention.

AI limits: Pro includes 40 AI uses a month, up to 5 a day. Pro+ includes 100 a month, up to 12 a day. Each Ask Ipon question, photo scan, paste read, or smarter Fill counts as one use. Monthly uses reset on the 1st of each month and daily uses at midnight, Philippine time. To keep the service sustainable, AI can also pause until the next month if your account reaches a fixed monthly AI cost limit. Ipon shows how many uses you have left and when they reset. There is no extra per-use charge.

Device permissions and choices

Camera or photo access is used only for the capture or selection you request. You can decline these permissions or change them in iOS Settings and continue with manual entry. Notification permission is optional for reminders and can also be changed in iOS Settings. A device permission does not authorize sending a photo to an AI provider.

Product analytics is off by default. You can turn it on or off in Settings → Privacy & data → Share anonymous app activity. Turning it off stops future analytics, removes the analytics identifier and queued events from that device, and does not affect app features. It cannot undo events already processed by PostHog.

Retention, backups, and account deletion

Synced records, account details, entitlement data, and account-linked AI usage logs remain while needed to operate your account, until you remove them or delete the account. Optional analytics events are kept only while reasonably needed to evaluate and improve the app and meet security or legal obligations. The 30-day dashboard view is a reporting window, not an automatic deletion period. We keep support correspondence only as needed to resolve requests and meet legitimate security or legal obligations. Waitlist retention is described above.

You can export a backup from Settings. To delete your account, go to Settings → Danger zone → Delete account. The deletion flow removes the authentication account and associated live database records, including transactions, cards, templates, settings, edit history, entitlements, and AI usage logs. It is account deletion, not temporary deactivation. Anonymous analytics events are not linked to that account and therefore are not removed automatically with it.

Files you exported and documents in your photo library remain under your control. Provider-managed backups and security logs may retain residual information until their retention periods expire; legally required records may be kept for the required period. They are not available as an active Ipon account. We do not claim that account deletion instantly erases all copies held by Apple or an AI provider.

Deleting your account does not cancel an App Store subscription. Manage that separately in iPhone Settings → your name → Subscriptions. You do not have to wait for a subscription to expire to request account deletion. Removing an app account and leaving the website waitlist are also separate requests.

If you cannot access the app, contact support@iponapp.com. Support is a fallback, not a replacement for in-app deletion.

Your privacy rights

You can ask to access, correct, export, or delete your information, and withdraw optional consent, by emailing support@iponapp.com. We may verify that the request concerns your own data. Depending on the law that applies to you, you may also have rights to object to or restrict processing and complain to a privacy regulator. Withdrawing waitlist consent does not prevent you from using Ipon.

Age and audience

Ipon is not directed at children. Ipon’s Gemini-powered AI features are for adults aged 18 or older, subject to Google’s eligibility requirements. Contact us if you believe a child has submitted information that should be removed.

Operator, contact, and policy updates

Remzon Bret Constantino, Philippines, operates Ipon and is responsible for the personal information handled for the purposes described here. For privacy questions, correction requests, or deletion help, email support@iponapp.com. We may need to verify that a request concerns your own account.

Changes will appear on this page with a revised effective date. We will provide appropriate notice of material changes and ask for new consent where required. The Terms of Service cover use of the service and subscriptions.