Privacy Policy

Last updated September 25, 2026

1. What we collect

Your money records. Iponista saves your transactions, balances, budgets, goals and reminders in your device's private storage. To keep them safe and on all your phones, the app syncs an encrypted copy to your account: before anything leaves your phone it is locked with a random key (AES-256-GCM). That key is itself locked by your password and by a recovery key only you are shown. Our servers store the locked copy and the locked key, never the key itself, so we cannot read your entries, balances or amounts.

Your account. We keep your name, email address, your password as a one-way Argon2id hash (we can't read it), whether you confirmed your email, your profile photo if you add one (re-encoded, with location and camera details removed), your approximate time zone and country (from your device's time zone setting, not GPS), and when you joined, last signed in and last synced. For each device you sign in on we keep its name (for example "Chrome on Android"), browser details, IP address and when it was last used, so you can see and sign out your devices and so we can warn you about a sign-in from a new device. We keep a short security log of account actions (such as password changes). If you turn on two-step sign-in, we keep its secret encrypted and your recovery codes only as hashes.

Certificates. When you earn an Iponista Academy certificate, its number, course, date and the name printed on it are saved to your account so anyone you share it with can check it at iponista.com/verify. The check page shows only what is printed on the certificate.

Help and chat. Messages you send us through Help & feedback or the website chat, and the name or email you give there, are kept so we can answer you.

Visit statistics. We count page views on this website and app without cookies and without storing IP addresses: a visitor is a one-way code made from the connection and browser that changes every day. We keep the page, the referring website, the device type and the approximate area (from the time zone), and delete the raw visits after about a year.

Emails. We send account emails (welcome and confirmation, password resets, security alerts such as a new-device sign-in or a password change, account deletion notices) and, if you allow it, course and certificate news. These go through our own mailbox on our hosting provider.

2. Optional features you choose

Money summary email. If you turn on the daily summary or weekly recap (More → Account & security), your phone shares a few totals when it syncs so we can write the email: what you spent and received (today, yesterday, this week, this month), your top category, upcoming bills (name, date, amount) and your logging streak. Never your individual entries. Turning it off stops this and deletes the numbers we kept.

Smarter Ponpon (online). Asking Ponpon about your own money is answered on your device. If your version of the app offers the online mode and you switch it on, questions Ponpon can't answer offline are sent — the question text only, never your balances, entries, name or accounts — to our server and processed by an AI provider (Groq) to write a reply. It is off by default.

Voice input uses your browser's or phone's speech service, which may process your voice online; typing never leaves your device. If you turn on fingerprint or Face ID unlock, the check happens on your device; Iponista never receives your fingerprint or face data.

3. Who helps us run Iponista

We don't sell or share your data for advertising. A few services process it for us: Hostinger hosts our website, database and mailbox (so your account details and the encrypted copy of your book are stored there), and Dropbox stores our encrypted nightly database backups. If you use Smarter Ponpon, Groq processes the question text. We may disclose data if the law requires it.

4. How long we keep it

Account data and the encrypted copy of your book stay while you have an account. Signed-out device records are removed after about two months, one-time email links after a week, and sent-email records after about three months. Database backups rotate out after about a month. When you delete your account, everything in section 1 that belongs to it is erased; backups that already contain it expire within about a month.

5. Your rights (Data Privacy Act of 2012)

Under Republic Act No. 10173, you have the right to be informed, to access, correct and erase your personal data, to object, and to data portability. You can do most of this yourself: edit or delete entries in the app, export a backup at any time, change your name, password and email settings and sign out devices in More → Account & security, and delete your account there. Deletion happens 7 days after you ask (sign in and tap “Keep my account” to cancel), then your account, encrypted book, certificates, messages and photo are erased. For a copy of your account data or anything else, email us and we'll answer within 30 days. You may also complain to the National Privacy Commission.

6. Security

Your synced book is encrypted on your device before upload. Passwords are stored only as Argon2id hashes, sign-in tokens only as SHA-256 hashes, and all traffic uses HTTPS. Staff accounts must use two-step sign-in, and staff can never see your balances or entries. You can also protect the app with a PIN (stored only as a salted hash) and hide amounts in the app switcher. Keep your recovery key private: with it and your account, someone could unlock your synced book. Anyone with full access to your unlocked device may still be able to read your data, so keep your phone secure.

7. Children

Iponista is for general audiences and is not directed at children. If you believe a child created an account, email us and we'll delete it.

8. Changes and contact

If this policy changes, we'll update the date above and, for material changes, tell you in the app or by email. Questions or requests? Email our privacy contact at privacy@iponista.com.

See also our Terms of Use.