Privacy policy

1. Controller and scope

Sebastián Villa, an individual, develops and operates Amy and is responsible for data processing managed by the service. Contact: villalodeveloper@gmail.com.

This policy covers the app and aimymoneyapp.com. Apple and other providers also have their own terms, depending on their role.

Amy's public website

The home page, support and public documents are informational pages: they do not sign you in, load financial history or include advertising or user analytics. Icons and fonts are served by this website.

The /admin panel requires an authorized account and verifies permissions on the server. It uses Supabase to authenticate and access information needed for users, support, campaigns and diagnostics. In a browser, it keeps the session in tab storage; when opened from the app, it receives the session through a channel restricted to Amy's domain and keeps it in memory. Chat diagnostics follow the seven-day retention described in this policy. The panel remembers the theme preference without using it for advertising tracking.

Hosting may process technical connection data to deliver and protect the site. Links to App Store, Instagram, TikTok, Apple and support email are also subject to those providers' practices.

2. Information we process

Account and profile: email, name, sign-in identifier and information you choose to provide, such as date of birth, occupation, goals and preferences. With Sign in with Apple, we receive the identifier and email Apple supplies, including a private relay address.

Finances: accounts, currencies, categories, transactions, amounts, spending limits, savings, loans, debts, installments, recurring records and shared-space information you enter.

Content: messages, voice instructions and photos, receipts or documents you choose to send. Audio may be transcribed; documents are processed according to the feature used. Chat history may be stored on your device.

Service: app version, technical device information, session activity, preferences and notification tokens, feature usage and subscription status. Hosting providers receive technical connection information such as an IP address.

We do not request banking credentials or connect to your bank. Do not include unnecessary third-party data or sensitive information.

3. Purposes and authorization

We process information to authenticate you, store and display records, synchronize shared spaces, interpret content you send, generate answers and summaries, manage access and subscriptions, deliver notices, resolve issues and protect the service.

Microphone, photo and notification permissions depend on your choices and the operating system. You can revoke them on your device, although some features will become unavailable. Where the law requires authorization, it must be obtained validly; this policy does not replace that requirement.

We do not sell or rent your personal information or use it for third-party advertising.

4. Providers and recipients

Supabase provides authentication, databases, server functions and storage where a feature uses it.

Google provides web hosting and notifications through Firebase. Versions using Gemini may send it content for inference. Versions using Luna use OpenAI through the Supabase server for responses, content interpretation and, where relevant, voice transcription. Enabled structured decisions may use TypeSafe AI's Jev through Vercel AI Gateway with limited request context.

RevenueCat receives user identifiers, subscription information and profile data such as name and email to associate and manage access. Apple manages sign-in, App Store purchases and Apple Intelligence capabilities used by the app.

Not every provider is involved in each request. Their obligations and retention depend on the service and its terms. We do not promise a retention or training policy that we cannot verify.

Information may also be disclosed to meet legal obligations or valid requests from authorities.

5. AI and chat diagnostics

Messages, transcriptions, documents and necessary financial context may be sent to AI to interpret your instructions. Routing and providers depend on the version, configuration and feature. Apple Intelligence may process tasks on-device or, where supported by the feature, through Apple's Private Cloud Compute. Cloud tasks or fallbacks may use remote providers. Local AI does not prevent synchronization or mean that all information always stays on your phone.

To investigate errors, we store limited chat diagnostics in Supabase. They may include excerpts of requests and responses, tool results containing financial information and technical errors. Read access is restricted to authorized administrators; traces older than seven days are automatically purged. They are not a complete chat history and do not include binary attachments, credentials or the model's internal reasoning.

AI can make mistakes. Check records and estimates before using them.

6. Shared information

Members can access shared-space data according to their permissions. Share only information you are authorized to disclose. Leaving a space does not mean its records or copies obtained by other people are deleted.

7. Processing outside your country

Providers may process information in countries other than your country of residence. Location depends on the provider, infrastructure and service configuration; we do not claim that all data is stored in one particular country.

International processing must comply with the requirements and safeguards of applicable law. You can ask the privacy contact for information about recipients and processing of your data.

8. Retention and account deletion

Records are kept while necessary to provide the service and meet applicable obligations. Chat diagnostics follow the seven-day purging process described above.

You can request account deletion from your profile. Deletion removes the sign-in account and data linked through the deletion process. A limited record of the deleted sign-in identity, including its provider identifier and originally associated email, may be retained to prevent relinking. You can request review or deletion of that record by email where legally appropriate.

Shared-space records, copies held by other members, backups and information providers must retain for legal or purchase obligations may be handled differently. We do not promise immediate deletion of every copy. Deleting your account does not cancel your Apple subscription.

9. Security measures

We use authentication, encrypted connections and data access controls. We restrict access to chat diagnostics and avoid including private financial content in general logs.

No system guarantees absolute security. Protect your device and credentials, and notify support if you notice unauthorized access.

10. Your rights and how to exercise them

You can request to know, access, update and correct your information, obtain information about its use and authorization, request a copy, and seek deletion or revocation where applicable. Send requests to villalodeveloper@gmail.com; we will verify your identity and respond within legal deadlines. The app offers record editing and account deletion; it does not promise an automatic tool to export all information.

In Colombia, you may contact the Superintendence of Industry and Commerce after the relevant inquiry or complaint procedure. Where other legislation applies, additional rights such as objection, restriction or portability are respected. A legal or contractual obligation may limit deletion of particular information.

11. Minors

The service is not directed to children under 13. Users below the age of majority need appropriate authorization from their legal representative. The store's age rating does not replace these conditions.

If you believe a minor's data has been processed without valid authorization, contact the controller so the case can be reviewed and appropriate measures taken.

12. Policy changes

We will publish the current version and date here. When a change requires additional information or new authorization, that requirement must be met before the relevant processing. Features and providers may change between versions; consult this policy and the app's notices.

13. Contact

Controller: Sebastián Villa. Privacy and support: villalodeveloper@gmail.com. Official website: https://aimymoneyapp.com.