Legal

Privacy Policy

Effective date: August 16, 2026  ·  The Path Out LLC

TPO Budget is a privacy-first personal finance app. This policy explains what the app does and does not do with your data.

Data we collect

None, by default. The app does not transmit your financial information to us or to any third party.

All transactions, accounts, budgets, categories, merchants, recurring schedules, and assistant history are stored locally on your device in an encrypted SQLite database (SQLCipher, AES-256). The database is unlocked using a device-bound key protected by the iOS Secure Enclave / Android Keystore and your device biometrics or passcode.

Permissions and why we ask

The app only requests permissions it needs for features you use:

• Face ID / Touch ID / device biometrics — to unlock the app and decrypt your local database.
• Camera — to scan QR codes for Household Sync pairing, and (if you choose) to take a photo to use as your in-app wallpaper. Images stay on your device and are never uploaded.
• Photo Library — only if you pick a photo from your library to use as your in-app wallpaper. The photo you select stays on your device and is never uploaded. (Exported reports are shared through the system share sheet and do not require photo-library access.)
• Microphone + Speech Recognition — only if you use voice input. Audio is processed by the platform speech API and is not retained by TPO Budget.
• Local Network — only if you opt in to Household Sync, which pairs two devices on the same Wi-Fi using an end-to-end encrypted peer connection. No sync data leaves your local network.
• iCloud — only if you opt in to encrypted iCloud backup. Backup blobs are encrypted on your device before upload; Apple receives only ciphertext.

You can revoke any permission at any time in your iOS or Android system settings.

Optional integrations

Some features are opt-in and, if enabled, cause data to leave your device through Apple- or vendor-provided channels. They are off by default.

• Bank sync (Plaid) (optional): if you connect a bank, we use Plaid to link your account and import balances and transactions. Plaid is a third-party data provider that connects to your bank on your behalf under its own terms and privacy policy. So that our bank-provider API credentials never ship inside the app, this traffic passes through a small relay server we operate. The relay only passes bank data through in transit — it does not store, log, or inspect your account names, balances, or transactions; it keeps just a per-install token so it can tell registered app installs apart. Imported data is written to the encrypted database on your device. (Accounts connected through our former provider, Teller, were converted to local-only manual accounts when that integration was retired — their data stayed on your device. Reconnecting a bank uses Plaid.)

  Disconnecting a bank removes the connection at Plaid as well as on your device. Removing it at Plaid requires that connection's access token, so if that step fails — for example because you are offline — the app keeps that one token in separate, removal-only secure storage and retries each time it opens. It cannot be used to sync or retrieve anything, and it is erased as soon as the removal succeeds, or after seven days at the latest, or when you erase app data. If it expires without succeeding, the app tells you and points you to my.plaid.com to remove the connection yourself.

• Apple FinanceKit (iOS 17.4+, when available): read-only access to transactions and balances you explicitly authorize in the Wallet app. Data is delivered by Apple directly to the app on your device and stored locally. TPO Budget does not send this data anywhere else.
• Bring-your-own-key AI assistant (optional): the in-app assistant runs on your device by default. If you add your own API key for a third-party model (OpenAI, Anthropic, OpenRouter, Groq, or a custom OpenAI-compatible endpoint you choose), requests you initiate are sent directly from your device to that provider under your own account and their privacy policy. We do not proxy, log, or store these requests. Only the text needed to answer is sent — by default that is your typed or spoken question, not your financial records. A separate, off-by-default setting lets you also send an anonymized, rounded financial summary (no account names, no individual transactions) to your chosen provider for better answers; it requires its own explicit consent. You can remove the key at any time.
• Cloud text-to-speech (ElevenLabs) (optional): if you turn on cloud voice replies and add your own ElevenLabs API key, the assistant's reply text is sent to ElevenLabs to generate speech, under your account and their privacy policy. That reply is what the assistant says out loud, so it can contain financial details — amounts, merchant names, account names, balances, and category totals. Unlike the anonymized financial summary described above, this text is not tokenized or rounded; it is sent as spoken. No microphone audio is sent; the generated audio is played and then deleted from a temporary cache. You can turn this off or remove the key at any time.
• Live investment pricing (optional): if enabled, only ticker symbols / coin IDs are transmitted to public market-data providers (Yahoo Finance, Stooq, CoinGecko) — no account details, balances, or personal information.

App updates

Unlike the integrations above, this one is not optional and cannot be switched off inside the app. Each time TPO Budget starts, it asks the Expo update server whether a newer version of the app code is available, so fixes can reach you without waiting for an App Store release. That request happens automatically, without any action from you.

It sends:

• the platform (iOS or Android), the app version, and the release channel;
• the id of the update currently installed — the version of the app code itself, which the update mechanism tracks separately from the App Store version above;
• a random per-install identifier, generated on your device and not tied to your name, email, or any account;
• if the previous run ended in a crash, the error message from that crash, so it can be diagnosed.

It does not send transactions, balances, account names, categories, or any contents of the encrypted database. Expo processes the request under its own privacy policy.

Crash reports and diagnostics

TPO Budget does not ship a third-party analytics or crash-reporting SDK. If Apple TestFlight or the App Store sends anonymized crash diagnostics, those reports are controlled by Apple and your device settings (Settings → Privacy & Security → Analytics & Improvements). They do not contain your financial data.

Apple is not the only recipient of a crash signal, though: as described under App updates above, if the previous run ended in a crash, that error message is attached to the next update check. It is an error message, not your financial data.

Children

TPO Budget is not directed to children under 13 and does not knowingly collect information from them.

Waitlist

If you join the waitlist on this website, we store only your email address — solely to send you one notification when TPO Budget launches. When you sign up you will receive a confirmation email containing a one-click unsubscribe link. Clicking it permanently deletes your email address from our system. You may also request removal at any time by emailing contact@thepathout.com and we will process your request within 30 days.

Your rights and controls

Because your data stays on your device, you control it directly:

• Export all data to CSV or an encrypted backup at any time (Settings → Data).
• Delete all data by uninstalling the app or tapping "Erase all data" in Settings.
• Disconnect optional integrations (bank sync, FinanceKit, iCloud backup, Household Sync, AI assistant) at any time.

If you have an encrypted iCloud backup and want it removed, delete the app from all your devices and remove its iCloud data in iOS Settings → Apple ID → iCloud → Manage Storage → TPO Budget.

Security

• Database encryption: SQLCipher, AES-256-CBC with HMAC-SHA512 page authentication.
• Key storage: iOS Keychain with kSecAttrAccessibleWhenUnlockedThisDeviceOnly / Android Keystore, bound to device biometrics.
• Transport: Any optional network traffic (BYOK AI providers, iCloud) uses TLS 1.2+.
• Household Sync: End-to-end encrypted peer channel over the local network; no relay server.

No system is perfectly secure, but because we keep no financial data on our servers, there is no server-side breach surface for it.

Changes to this policy

If this policy changes in a way that affects how your data is handled, we will update the effective date above and note the change in the app's release notes. Because we do not collect your contact information, please re-check this page before major app updates.

Contact

Questions or privacy requests:  contact@thepathout.com