Privacy
Isomoira holds financial data for two people who have chosen not to merge their finances. That makes privacy the product, not a policy page — so this describes what we actually do, in the order that matters to you.
The short version
We do not sell your data, share it with data brokers, or use it for advertising. There are no third-party analytics or advertising SDKs in the app.
Your partner sees only what the privacy tier you set on each account allows — and you can change any tier whenever you like.
You can export everything, and delete everything, from inside the app.
What we collect
Financial information
Transactions (merchant, amount, date), account names, types and the last four digits, balances, your budgets, and the shared ledger between you and your partner. If you connect a bank, this arrives automatically; in manual mode you enter it yourself.
We never receive your bank credentials. Connecting a bank happens inside Plaid's own interface. We hold only an access token per institution, encrypted at rest, and bank access is read-only — it can read transactions and can never move money.
Statement files you import
If you import a bank or card statement instead of connecting, the file is read on your device and never uploaded. The transactions it contains are then stored exactly like ones you typed by hand.
What you type
Notes and memos on transactions, the names you give accounts and budgets, and comments you write to your partner on a shared expense. Comments are visible to whoever can see the transaction they are attached to, by the same rule as the transaction itself, and nothing either of you writes is deleted by the other's reclassification. All of this text is encrypted at rest.
Payment handles
Optionally, a Venmo username or Cash App cashtag, so your partner's true-up can open the right app with the amount filled in. They are encrypted at rest, shown to your partner at settlement time, and appear on a settlement page only if you tick that box.
Your name
The display name from Sign in with Apple, so your partner sees who carried an expense. We do not store your email address — Sign in with Apple's relay address is not retained.
Identifiers
Your Apple sign-in identifier, your member and household identifiers, a push notification token so the app can sync in the background and send the reminders you have turned on, and an App Attest key identifier used to verify that requests come from a genuine copy of the app.
Purchases
Signed transaction records from the App Store, used to work out whether the household has an active subscription. Apple handles payment; we never see card details.
How the app is used
A small number of first-party events — which path you chose at setup, that a bank link completed, that a first expense was classified, that a subscription started. These carry counts and choices only: no amounts, no merchant names, no account names. They go to our own servers and nowhere else.
When something goes wrong
The app sends us a diagnostic event: an event name, an outcome code, and the app and OS version. These follow the same rule as everything else we log — identifiers and outcomes. The event names are fixed in the app's code and the details travel in a short, closed set of fields, so there is no place in them for an amount, a merchant, or anything you typed. You can turn this off in Settings; local logging and the app itself are unaffected.
Referrals
Every household has a permanent link for recommending Isomoira to other couples. When someone signs up through yours, we record that their household was referred by yours — identifiers only, no names in either direction. If their household later pays for a subscription, we also record the days that earns you and when they were added to your own subscription, which means telling Apple to extend your renewal date. The page a referral link opens shows nothing about you; you see a count and the days earned, and the referred household sees nothing at all. The Terms describe the reward.
If your partner does not have an iPhone
When an invite link is opened on an Android phone, the page offers to take an email address so we can say if an Android version ships. That address is the one thing we hold that is not tied to an account: it is stored on its own, used for that single purpose, kept for twelve months, and deleted on request. It is never linked to any household's financial data.
What we do not collect
- Location, of any precision
- Contacts, photos, audio, messages, or files
- Browsing or search history
- Health or fitness data
- Your email address (see the Android note above for the one exception, which is not yours)
- Your bank credentials or card numbers
Tracking
Isomoira does not track you across other apps or websites, and does not ask for permission to, because there is nothing it would do with it. No advertising identifiers, no ad networks, no data brokers.
What your partner can see
Every account you add carries one of three tiers, and you choose it:
| Tier | Your partner sees |
|---|---|
| Fully shared | Transactions and balance |
| Balance only | The balance, never the transactions |
| Just me | Nothing — the account is invisible to them, while still counting toward your own budgets |
Tiers are enforced on our servers, not in the app, so a modified copy of the app cannot reveal more than the tier allows. You can preview the app exactly as your partner sees it before committing to a tier, and you can change a tier at any time.
How it is protected
Sensitive text — merchant names, account names, the last four digits, your notes, comments and payment handles — is encrypted at rest with a key belonging to your household. Amounts, dates and categories are stored unencrypted so the app can add them up; we would rather state that plainly than imply an encryption guarantee we do not provide.
Traffic between the app and our servers is encrypted and certificate-pinned. The app can optionally require Face ID to open, and hides its contents in the app switcher and whenever the screen is being recorded, mirrored or shared to another display.
Our own logs record identifiers and outcomes only — merchant names, balances and tokens are structurally excluded, not filtered out afterwards.
The full account — what is encrypted and what is not, who we defend against and how, and the trade-offs we made — is published at isomoira.com/security.
Our servers are in the United States. Backups are encrypted before they leave our servers, and the company that stores them cannot read them.
Who else is involved
- Plaid connects your bank at your request and handles your credentials in its own interface, under its own privacy policy.
- Apple handles sign-in, payment and push notifications.
- Cloud infrastructure providers run our servers and store our encrypted backups. We rent capacity from DigitalOcean, Amazon Web Services and Backblaze in the United States; they process data only on our instructions and have no right to use it for themselves.
- Cloudflare serves this website and the invite, referral and settlement pages, and stores the waitlist.
That is the complete list. No analytics vendors, no advertising networks, no data brokers, no one who has paid to be here. We do not share your data with anyone else unless the law compels us to, and if it does we will tell you unless we are legally prevented from doing so.
Settlement links
When you settle up, you can send a link showing what is owed. It contains only the fields you chose to include, its address is stored hashed rather than in the clear, and you can revoke it instantly.
This website
isomoira.com sets no cookies and runs no analytics. If you join the waitlist we keep the email address you gave, which page you gave it on, the country your request came from and the time; we use it only to tell you when Isomoira launches, and delete it when you ask. The calculators run entirely in your browser: the numbers you type are never sent to us. The site's typefaces are loaded from Google Fonts, so your browser requests them from Google under Google's privacy policy; that request carries your IP address and nothing about you from us.
Getting your data back, and deleting it
Export gives you exactly what your device holds, from Settings.
Deletion is also in Settings, and it is real. If you are the only member of your household, every row is erased from every table. If you have a partner, your name and everything you typed are erased, while the shared amounts remain with them — otherwise deleting your account would rewrite their ledger. Encrypted backups age out within thirty days. A record that a deletion happened is kept, containing identifiers only.
Deleting your account also revokes Isomoira's Sign in with Apple token and removes our access to any connected bank.
Your rights
Wherever you live, you can see what we hold about you (export), correct it (edit it in the app), delete it (Settings), and take it with you (the export is yours to keep). Anything you cannot do from the app, ask for at hello@isomoira.com; we answer within 30 days and we do not treat you differently for asking. Residents of some U.S. states have specific rights under their state's privacy law; we honor those requests from anyone, regardless of where they live.
How long we keep things
Your data stays while your account exists, because the app is a running picture of your finances and needs the history. When you delete your account it goes, as described above. Bank access tokens are removed when you unlink an institution, when a subscription has been lapsed for 30 days, when you leave a household, and when you delete your account.
If something goes wrong
If we learn that your data has been exposed, we will tell you without unreasonable delay and within the time the law requires, say what happened and what we are doing about it. Because we do not hold your email address, notice arrives in the app and by push notification, and is posted on this site.
Children
Isomoira is for adults. You must be 18 or older to use it, and we do not knowingly collect data from anyone younger. If we learn that we have, we delete it.
Changes
If this changes in a way that affects what we collect or who can see it, we will update the date at the top and tell you in the app before it takes effect.
Contact
Questions, requests for your data, or anything that looks wrong: hello@isomoira.com. Help with the app is at isomoira.com/support; the agreement that governs it is at isomoira.com/terms.