Legal

Privacy Policy

Effective date: July 16, 2026 · The Path Out LLC

TPO Budget is a privacy-first personal finance app. This policy explains what the app does and does not do with your data.

TPO Budget is local-first. Your financial data lives on your device.
We run no servers that store, read, or monetize your financial data. Optional bank sync routes through a thin relay we operate that keeps and inspects none of it (see Optional integrations below).
We do not sell, rent, share, or monetize your data. Ever.
We do not use your data to train machine-learning models.
We have no advertising, no trackers, and no third-party analytics SDKs.

Data we collect

None, by default. The app does not transmit your financial information to us or to any third party.

All transactions, accounts, budgets, categories, merchants, recurring schedules, and assistant history are stored locally on your device in an encrypted SQLite database (SQLCipher, AES-256). The database is unlocked using a device-bound key protected by the iOS Secure Enclave / Android Keystore and your device biometrics or passcode.

Permissions and why we ask

The app only requests permissions it needs for features you use:

Face ID / Touch ID / device biometrics — to unlock the app and decrypt your local database.
Camera — to scan QR codes for Household Sync pairing, and (if you choose) to take a photo to use as your in-app wallpaper. Images stay on your device and are never uploaded.
Photo Library — only if you pick a photo from your library to use as your in-app wallpaper. The photo you select stays on your device and is never uploaded. (Exported reports are shared through the system share sheet and do not require photo-library access.)
Microphone + Speech Recognition — only if you use voice input. Audio is processed by the platform speech API and is not retained by TPO Budget.
Local Network — only if you opt in to Household Sync, which pairs two devices on the same Wi-Fi using an end-to-end encrypted peer connection. No sync data leaves your local network.
iCloud — only if you opt in to encrypted iCloud backup. Backup blobs are encrypted on your device before upload; Apple receives only ciphertext.

You can revoke any permission at any time in your iOS or Android system settings.

Optional integrations

Some features are opt-in and, if enabled, cause data to leave your device through Apple- or vendor-provided channels. They are off by default.

Bank sync (Plaid) (optional): if you connect a bank, we use Plaid to link your account and import balances and transactions. Plaid is a third-party data provider that connects to your bank on your behalf under its own terms and privacy policy. So that our bank-provider API credentials never ship inside the app, this traffic passes through a small relay server we operate. The relay only passes bank data through in transit — it does not store, log, or inspect your account names, balances, or transactions; it keeps just a per-install token so it can tell registered app installs apart. Imported data is written to the encrypted database on your device. (Bank accounts you linked before we switched providers may re-authenticate through Teller instead; the same relay and the same guarantees apply.)
Apple FinanceKit (iOS 17.4+, when available): read-only access to transactions and balances you explicitly authorize in the Wallet app. Data is delivered by Apple directly to the app on your device and stored locally. TPO Budget does not send this data anywhere else.
Bring-your-own-key AI assistant (optional): the in-app assistant runs on your device by default. If you add your own API key for a third-party model (OpenAI, Anthropic, OpenRouter, Groq, or a custom OpenAI-compatible endpoint you choose), requests you initiate are sent directly from your device to that provider under your own account and their privacy policy. We do not proxy, log, or store these requests. Only the text needed to answer is sent — by default that is your typed or spoken question, not your financial records. A separate, off-by-default setting lets you also send an anonymized, rounded financial summary (no account names, no individual transactions) to your chosen provider for better answers; it requires its own explicit consent. You can remove the key at any time.
Cloud text-to-speech (ElevenLabs) (optional): if you turn on cloud voice replies and add your own ElevenLabs API key, the assistant's reply text is sent to ElevenLabs to generate speech, under your account and their privacy policy. No microphone audio is sent; the generated audio is played and then deleted from a temporary cache. You can turn this off or remove the key at any time.
Live investment pricing (optional): if enabled, only ticker symbols / coin IDs are transmitted to public market-data providers (Yahoo Finance, Stooq, CoinGecko) — no account details, balances, or personal information.

Crash reports and diagnostics

TPO Budget does not ship a third-party analytics or crash-reporting SDK. If Apple TestFlight or the App Store sends anonymized crash diagnostics, those reports are controlled by Apple and your device settings (Settings → Privacy & Security → Analytics & Improvements). They do not contain your financial data.

Children

TPO Budget is not directed to children under 13 and does not knowingly collect information from them.

Waitlist

If you join the waitlist on this website, we store only your email address — solely to send you one notification when TPO Budget launches. When you sign up you will receive a confirmation email containing a one-click unsubscribe link. Clicking it permanently deletes your email address from our system. You may also request removal at any time by emailing contact@thepathout.com and we will process your request within 30 days.

Your rights and controls

Because your data stays on your device, you control it directly:

Export all data to CSV or an encrypted backup at any time (Settings → Data).
Delete all data by uninstalling the app or tapping "Erase all data" in Settings.
Disconnect optional integrations (bank sync, FinanceKit, iCloud backup, Household Sync, AI assistant) at any time.

If you have an encrypted iCloud backup and want it removed, delete the app from all your devices and remove its iCloud data in iOS Settings → Apple ID → iCloud → Manage Storage → TPO Budget.

Security

Database encryption: SQLCipher, AES-256-CBC with HMAC-SHA512 page authentication.
Key storage: iOS Keychain with kSecAttrAccessibleWhenUnlockedThisDeviceOnly / Android Keystore, bound to device biometrics.
Transport: Any optional network traffic (BYOK AI providers, iCloud) uses TLS 1.2+.
Household Sync: End-to-end encrypted peer channel over the local network; no relay server.

No system is perfectly secure, but because we keep no financial data on our servers, there is no server-side breach surface for it.

Changes to this policy

If this policy changes in a way that affects how your data is handled, we will update the effective date above and note the change in the app's release notes. Because we do not collect your contact information, please re-check this page before major app updates.

Contact

Questions or privacy requests: contact@thepathout.com