Privacy Policy

Last updated October 11, 2026

1. What we collect

Your money records. Iponista saves your transactions, balances, budgets, goals and reminders in your device's private storage. To keep them safe and on all your phones, the app syncs an encrypted copy to your account: before anything leaves your phone it is locked with a random key (AES-256-GCM). That key is itself locked by your password and by a recovery key only you are shown. Our servers store the locked copy and the locked key, never the key itself, so we cannot read your entries, balances or amounts.

Your account. We keep your name, email address, your password as a one-way Argon2id hash (we can't read it), whether you confirmed your email, your profile photo if you add one (re-encoded, with location and camera details removed), your approximate time zone and country (from your device's time zone setting, not GPS), and when you joined, last signed in and last synced. For each device you sign in on we keep its name (for example "Chrome on Android"), browser details, IP address and when it was last used, so you can see and sign out your devices and so we can warn you about a sign-in from a new device. We keep a short security log of account actions (such as password changes). If you turn on two-step sign-in, we keep its secret encrypted and your recovery codes only as hashes.

Certificates. When you earn an Iponista Academy certificate, its number, course, date and the name printed on it are saved to your account so anyone you share it with can check it at iponista.com/verify. The check page shows only what is printed on the certificate.

Help and chat. Messages you send us through Help & feedback or the website chat, and the name or email you give there, are kept so we can answer you.

Visit statistics. We count page views on this website and app without cookies and without storing IP addresses: a visitor is a one-way code made from the connection and browser that changes every day. We keep the page, the referring website, the device type and the approximate area (from the time zone), and delete the raw visits after about a year.

Emails. We send account emails (welcome and confirmation, password resets, security alerts such as a new-device sign-in or a password change, account deletion notices) and, if you allow it, course and certificate news. In your first two weeks we also send a few short getting-started emails about using the app. The Ipon Club emails (money tips, challenges and news, about two a month) go only to people who say yes, either with the optional box when signing up or the "Yes, send me tips" link in an email; we record when you said yes. Every one of these emails has a one-click unsubscribe link, and you can change each kind in More → Account & security. Emails go through our own mailbox on our hosting provider.

Email opens and clicks. Getting-started, Ipon Club and announcement emails contain a tiny image and links that pass through iponista.com, so we can count how many people opened an email and clicked its button. We use this only to see which emails are useful and to write better ones: the counts are shown per email, not as a profile of you, and account and security emails are not tracked. Your mail app can block this by not loading images. The records are deleted after about three months.

2. Optional features you choose

Household books. If you start or join a shared family book, we keep who is in the household (account ids, names as shown to the other members, roles, when each joined and last synced), the invite links you make (stored hashed, single-use, 72 hours), each member's public household key, the family book's key wrapped so that only each member's own phone can open it, and the family book itself as ciphertext, with its size and version. The key that unlocks the book only ever travels from one member's phone to another's; we never have it, so we cannot read a household book. When someone leaves or is removed, the owner's phone makes a new key for the people who remain. Deleting a household erases its synced copy; deleting your account removes you from your household (an owner's household passes to the longest-standing editor, or is closed and the members told by email).

Money summary email. If you turn on the daily summary or weekly recap (More → Account & security), your phone shares a few totals when it syncs so we can write the email: what you spent and received (today, yesterday, this week, this month), your top category, upcoming bills (name, date, amount) and your logging streak. Never your individual entries. Turning it off stops this and deletes the numbers we kept.

Smarter Ponpon (online). Ponpon understands and answers your messages on your device, and never saves anything you haven't checked on a card first. If you're signed in and Ponpon can't understand a message on the phone, it sends that message and the names of your wallets, categories and bills (never amounts from your records, balances or history) to our server, where an AI provider (Groq, or Google Gemini as a backup) reads it. For a long message or a follow-up it also gets the last few lines of this chat and the unsaved card on screen, so it knows what “divide it” means. For a how-to or money question it answers only from Iponista's own help pages, Academy guides and blog, with the sources linked. The AI's reply goes back to the app and is checked like anything you type; our server doesn't store the message. It's on for signed-in accounts; switch it off anytime in Settings. Your chat with Ponpon is kept on your device until you tap “New chat”.

Help improve Ponpon. When Ponpon can't answer a question, or you mark an answer 👎, we keep the question (and Ponpon's answer) so our team can write a better one, and when you change what quick-add understood before saving, we count the word and what you changed it to (for example “raket: expense → income”). These are stored without your name, account or device, with numbers, emails, phone numbers and links removed, and are deleted within 12 months unless they became a published answer. It's on by default for signed-in accounts; switch off “Help improve Ponpon” in Settings and nothing is kept.

Voice input uses your browser's or phone's speech service, which may process your voice online; typing never leaves your device. If you turn on fingerprint or Face ID unlock, the check happens on your device; Iponista never receives your fingerprint or face data.

Applications to work with us. If you apply to become an advisor, send an advertising inquiry or propose a partnership, we keep what you send in the form (your name, email, mobile number, organisation or city and province, your answers, and any PDF you attach) so our team can review it and reply. Only Iponista staff can see it; the PDF is never public. We don't use it for marketing emails and don't share it with anyone else. Applications we decline or archive, and their files, are deleted 12 months after our last update; you can ask us to delete yours sooner by replying to our confirmation email or writing to hello@iponista.com.

3. Who helps us run Iponista

We don't sell or share your data for advertising. A few services process it for us: Hostinger hosts our website, database and mailbox (so your account details and the encrypted copy of your book are stored there), and Dropbox stores our encrypted nightly database backups. If you use Smarter Ponpon, Groq (or Google Gemini as a backup) processes the message text. We may disclose data if the law requires it.

Ads on the blog. Our blog (never the app) may show sponsor ads, clearly marked “Sponsored”. They are plain images and links from our own server: they set no cookies, and we only count how many times each ad was seen and clicked, as daily totals, never who saw it. The blog may also show Google AdSense ads. Google may use cookies to choose and measure those ads; see how Google uses information from sites that use its services. Visitors in the EEA, UK and Switzerland only get Google ads after they answer Google's consent message. The app never loads any ad or ad tracker.

4. How long we keep it

Account data and the encrypted copy of your book stay while you have an account. Signed-out device records are removed after about two months, one-time email links after a week, and sent-email records after about three months. Database backups rotate out after about a month. When you delete your account, everything in section 1 that belongs to it is erased; backups that already contain it expire within about a month.

5. Your rights (Data Privacy Act of 2012)

Under Republic Act No. 10173, you have the right to be informed, to access, correct and erase your personal data, to object, and to data portability. You can do most of this yourself: edit or delete entries in the app, export a backup at any time, change your name, password and email settings and sign out devices in More → Account & security, and delete your account there. Deletion happens 7 days after you ask (sign in and tap “Keep my account” to cancel), then your account, encrypted book, certificates, messages and photo are erased. For a copy of your account data or anything else, email us and we'll answer within 30 days. You may also complain to the National Privacy Commission.

6. Security

Your synced book is encrypted on your device before upload. Passwords are stored only as Argon2id hashes, sign-in tokens only as SHA-256 hashes, and all traffic uses HTTPS. Staff accounts must use two-step sign-in, and staff can never see your balances or entries. You can also protect the app with a PIN (stored only as a salted hash) and hide amounts in the app switcher. Keep your recovery key private: with it and your account, someone could unlock your synced book. Anyone with full access to your unlocked device may still be able to read your data, so keep your phone secure.

7. Children

Iponista is for general audiences and is not directed at children. If you believe a child created an account, email us and we'll delete it.

8. Changes and contact

If this policy changes, we'll update the date above and, for material changes, tell you in the app or by email. Questions or requests? Email our privacy contact at privacy@iponista.com.

See also our Terms of Use.