Privacy Policy — Plutus

Last updated: 1 October 2026
App: Plutus (iOS bundle ID and Android package: com.plutus.budgettracker)
Version covered: 1.0.0

1. Summary

Plutus is a local-first, offline-capable personal finance app. It has no backend, no user accounts, no analytics, no advertising, no crash reporting and no cloud sync. Everything you enter stays on your device.

• We do not collect, receive, store, sell, share or have access to your personal or financial data.
• The app only ever makes read-only download requests to public servers. It never uploads your data.
• There are exactly two kinds of network requests (see Section 5):
  1. Exchange rates — downloaded from a public currency CDN. Only a public currency code (for example usd) appears in the request. No data about you is sent.
  2. Optional AI model download — a one-time file download of the on-device AI model from Hugging Face. No data about you is sent.
• Your balances, transactions, voice recordings, AI questions and AI answers never leave your device.

2. Who is responsible

Plutus is developed by Alexander Aluf (the "Developer", "we", "us").

Because Plutus has no backend and we never receive your data, you are the only party that holds and controls the data in the app. In practice, the Developer is not a "controller" or "database holder" of your personal information in the sense of GDPR or the Israeli Protection of Privacy Law, as we do not determine the purposes or means of processing data that we never receive. We publish this policy anyway, to be transparent and to meet the requirements of app stores and privacy laws.

Contact for privacy questions:

• Email: alexacdem@gmail.com
• GitHub: https://github.com/alexanderaluf/Plutus

3. Data that is stored on your device

All data below is created by you, lives only in app-private storage on your device, and is never transmitted by Plutus.

The app does not require you to enter your real name, email, phone number or any government identifier. Anything you choose to type (including details about other people such as contacts or bill-split participants) is stored only on your device.

Sensitive information

Financial information, and information about other people that you may enter, can be sensitive. Plutus stores it locally only and offers a "hide amounts" setting that masks monetary values on screen. Plutus does not currently provide an app-lock, passcode or encryption of its own database; it relies on your device's lock screen, operating-system sandboxing and device encryption to protect it (see Section 9).

4. Device permissions

Plutus requests only the permissions needed for features you actively use. Permissions are optional unless noted, and the app works without them.

Not used: camera (explicitly removed), location, contacts, calendar, advertising ID, health data, Bluetooth, background location, or any device identifier.

You can revoke any permission at any time in your device settings.

5. The only network requests the app makes

Plutus has no server of its own. The app code issues only download (GET) requests to the public endpoints below. No request carries your financial data, profile, identifiers, prompts, recordings or any content you created.

5.1 Exchange rates (currency CDN)

5.2 AI model download (Hugging Face) — optional

5.3 What third parties can technically see

Like every internet request, connecting to these hosts exposes technical connection metadata to the host and its infrastructure providers: your IP address, approximate network location derived from it, the time of the request, your device's user-agent string, and the requested URL (which reveals the currency code or the model file). We do not receive or control this information, and we cannot link it to you. These providers have their own privacy policies:

• jsDelivr — https://www.jsdelivr.com/terms/privacy-policy-jsdelivr-net
• Cloudflare — https://www.cloudflare.com/privacypolicy/
• Hugging Face — https://huggingface.co/privacy

If you do not want to make these requests, you can keep the device offline (or in airplane mode) and enter exchange rates manually where supported; the core app works fully offline. Using a VPN will hide your IP address from these hosts.

5.4 Links you tap

The Credits section contains links to GitHub pages and developer websites. Tapping a link opens your device's browser, which is then governed by the privacy policy of that website. Nothing from the app is attached to the link.

6. On-device AI assistant ("Plutus AI")

• The AI model (Google's open-weights Gemma 4 via the LiteRT-LM runtime) runs entirely on your device.
• Your questions (typed or spoken), the financial facts the app gathers to answer them, and the answers never leave the device.
• The model can only read your data through a fixed set of read-only, app-controlled tools. It cannot access the database, the file system or the network directly. People tools never expose phone numbers or email addresses to the model.
• The model cannot change your data by itself. It can only propose a change, which is applied only if you confirm it on screen.
• Voice messages are recorded to a temporary file, transcribed locally and deleted immediately afterwards. Leaving the screen or backgrounding the app cancels recording and deletes the audio.
• AI chat history is held in memory only and is not saved.
• AI answers are generated by a machine-learning model, may be inaccurate, and are not financial, tax, legal or investment advice.

7. Backups, export, import and sharing

• Exporting a backup (ZIP, JSON or CSV) creates a file on your device and opens the system share sheet. You decide whether to save it, email it or send it to another app or cloud service. Once you share a file, the receiving app or service is responsible for it under its own privacy terms. Plutus does not upload backups anywhere.
• A temporary copy of the exported file is written to the app cache so it can be shared.
• Backup formats: ZIP (all data and attachments), JSON (data only, images removed), CSV (transactions only). Backups are not encrypted by Plutus; store and share them carefully.
• Importing a backup replaces or merges local data only after your explicit confirmation. Imported files are validated and processed locally.
• Optional Google Drive backup may be added in the future as an opt-in destination. It is not implemented in this version, and the app's reserved cloud-provider setting remains empty. If it is ever added, this policy will be updated before release and the feature will require your explicit consent.
• Operating-system backups: On Android, the app is marked as eligible for the system's automatic backup (for example Google device backup), and iOS may include app data in iCloud or device backups according to your device settings. These are performed by Apple/Google under your device settings and their privacy policies, not by Plutus. You can disable them in your device settings.

8. What we do not do

• No servers, accounts, logins or user profiles on our side
• No analytics, usage tracking, telemetry, A/B testing or crash-reporting SDKs
• No advertising, ad identifiers or ad networks
• No selling, renting, sharing or disclosing personal data
• No profiling or automated decisions with legal or similar effect
• No cross-app or cross-site tracking (Apple "App Tracking Transparency" does not apply)
• No fingerprinting or collection of device identifiers
• No location tracking
• No remote code updates (over-the-air updates are disabled)

9. Security

• Local storage in the app sandbox: the database and attachments are kept in app-private storage, which other apps cannot normally access.
• No transmission surface for your data: because the app has no backend, your records are not exposed to server breaches.
• Integrity safeguards: atomic, serialised database writes; pre-upgrade checkpoints and recovery mode so data is never silently replaced by defaults; validation of imported files (path-traversal, size and file-count limits, missing-attachment checks).
• Verified downloads: the AI model is size- and SHA-256-verified before use. All requests use HTTPS.
• Your responsibility: Plutus does not encrypt its database or add its own lock. Please protect your device with a screen lock and device encryption, keep your operating system updated, and handle exported backups as sensitive files. If your device is lost, shared, rooted or jailbroken, or an unencrypted backup is shared, your data may be exposed.

No system is perfectly secure, and we cannot guarantee absolute security.

10. Data retention and deletion

• Data stays on your device until you delete it. We cannot access or delete it for you because we do not have it.
• Delete records: delete individual items inside the app.
• Delete everything: uninstall the app (this removes the app's database, attachments and downloaded AI model from the device), or clear the app's storage in your device settings. Copies you exported or that were included in system/cloud device backups or shared files must be deleted separately by you.
• Temporary voice recordings are deleted automatically. Chat history is cleared when the chat closes.

11. Your rights

Because Plutus does not collect or hold your data, requests to us for access, correction, deletion or portability cannot be fulfilled by us — there is nothing for us to retrieve. You already have direct, full control:

Depending on where you live, you may have the following rights under applicable law, which are respected by design:

• Israel: under the Protection of Privacy Law, 5741-1981 (as amended, including Amendment 13) you may review, and ask for correction or deletion of, information held about you in a database.
• EU / EEA / UK (GDPR / UK GDPR): rights of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with your supervisory authority.
• California (CCPA/CPRA) and other US states: rights to know, delete, correct and opt out of sale/sharing. We do not sell or share personal information and do not collect it.
• Brazil (LGPD), Canada (PIPEDA), Australia, and others: equivalent rights of access, correction and deletion.

If you believe we hold any data about you, or you have a privacy question, contact us at the address in Section 2 and we will respond within a reasonable time (and within statutory deadlines, where they apply).

12. Legal basis and compliance statements

12.1 Israel

• Protection of Privacy Law, 5741-1981, and Amendment 13 (in force from 14 August 2025) and the Protection of Privacy Regulations (Data Security), 5777-2017.
• The Developer does not collect, hold or process personal information about users in a database, and therefore does not hold a database that requires registration with the Privacy Protection Authority. Data created by you stays under your sole control on your device. No personal information is transferred outside Israel by the Developer. The only outbound requests are the data-free downloads in Section 5.
• Use of the app does not require you to provide information. You decide what to enter, and nothing you enter is delivered to us.
• Information about other people that you enter (contacts, bill-split participants) is kept only for your own personal use on your device.

12.2 European Union / EEA / United Kingdom

• Personal data you enter is processed solely on your device and for your own purely personal or household purposes, which falls outside the scope of the GDPR (Art. 2(2)(c)). The Developer does not receive that data.
• To the extent GDPR applies to any technical connection data exposed by the download requests in Section 5, the processing is carried out by the hosting providers acting as independent controllers, and our request is necessary to deliver the feature you asked for (Art. 6(1)(b)) and in our legitimate interest in providing a working app (Art. 6(1)(f)). The app sends no personal data in these requests.
• We do not transfer your personal data to third countries. Hosting providers may route requests through global networks; see their policies.
• Optional device permissions are used only after you grant them (Art. 6(1)(a)).

12.3 United States

• CCPA/CPRA and other US state laws: We do not collect, sell or share personal information, and we do not use or disclose sensitive personal information.
• Do Not Track / Global Privacy Control: not applicable, since there is no tracking.

12.4 App store disclosures

• Apple App Store (Privacy "Nutrition" Label): Data Not Collected. Data entered in the app is not collected by the Developer.
• Google Play (Data safety): no data collected or shared by the Developer; data is processed on-device. Network requests are encrypted in transit (HTTPS). Data deletion: uninstall the app or delete in-app.

12.5 Children

Plutus is a general-purpose budgeting tool and is not directed at children under 13 (or under 16 where required by local law, such as in parts of the EU). We do not knowingly collect any data from anyone, including children. Parents or guardians should supervise minors' use of finance and AI features.

13. Open source and third-party components

Plutus is source-available under the PolyForm Noncommercial 1.0.0 licence so that anyone can inspect the code and verify the statements in this policy. The app uses open-source libraries (for example Expo, React Native, SQLite, LiteRT-LM, Gemma model weights, papaparse, fflate) that run locally. None of them is configured to send analytics or user data. The Gemma model is provided by Google under its own terms of use.

The code that performs network requests is limited to:

• src/data/exchange-rates/exchange-rate-service.ts (currency CDN requests)
• modules/plutus-local-ai/ (AI model download)

14. International users and data transfers

The Developer does not transfer, store or process your data on any server in any country. Your data remains on your device wherever you travel. The only cross-border element is the data-free file downloads in Section 5, which are served by global CDNs.

15. Changes to this policy

If the app's data practices change (for example, adding an optional cloud backup), we will update this policy and the "Last updated" date before that change is released, and will request your consent for any new data processing where required by law. Material changes will be announced in the app's release notes. Previous versions are available in the project's Git history.

16. Contact and complaints

Questions, requests or concerns about this policy:

• Email: alexacdem@gmail.com
• GitHub issues: https://github.com/alexanderaluf/Plutus

You also have the right to complain to your local privacy regulator, including:

• Israel: the Privacy Protection Authority (הרשות להגנת הפרטיות), Ministry of Justice
• EU/EEA: your national data protection authority
• UK: the Information Commissioner's Office (ICO)
• California: the California Attorney General / California Privacy Protection Agency