Privacy
Isomoira holds financial data for two people who have chosen not to merge their finances. That makes privacy the product, not a policy page — so this describes what we actually do, in the order that matters to you.
The short version
We do not sell your data, share it with data brokers, or use it for advertising. There are no third-party analytics or advertising SDKs in the app.
Your partner sees only what the privacy tier you set on each account allows — and you can change any tier whenever you like.
You can export everything, and delete everything, from inside the app.
What we collect
Financial information
Transactions (merchant, amount, date), account names, types and the last four digits, balances, your budgets, and the shared ledger between you and your partner. If you connect a bank, this arrives automatically; in manual mode you enter it yourself.
We never receive your bank credentials. Connecting a bank happens inside Plaid's own interface. We hold only an access token per institution, encrypted at rest, and bank access is read-only — it can read transactions and can never move money.
Your name
The display name from Sign in with Apple, so your partner sees who carried an expense. We do not store your email address — Sign in with Apple's relay address is not retained.
Identifiers
Your Apple sign-in identifier, your member and household identifiers, a push notification token so the app can sync in the background, and an App Attest key identifier used to verify that requests come from a genuine copy of the app.
Purchases
Signed transaction records from the App Store, used to work out whether the household has an active subscription. Apple handles payment; we never see card details.
How the app is used
A small number of first-party events — which path you chose at setup, that a bank link completed, that a first expense was classified, that a subscription started. These carry counts and choices only: no amounts, no merchant names, no account names. They go to our own servers and nowhere else.
What we do not collect
- Location, of any precision
- Contacts, photos, audio, messages, or files
- Browsing or search history
- Health or fitness data
- Your email address
- Your bank credentials or card numbers
Tracking
Isomoira does not track you across other apps or websites, and does not ask for permission to, because there is nothing it would do with it. No advertising identifiers, no ad networks, no data brokers.
What your partner can see
Every account you add carries one of three tiers, and you choose it:
| Tier | Your partner sees |
|---|---|
| Fully shared | Transactions and balance |
| Balance only | The balance, never the transactions |
| Just me | Nothing — the account is invisible to them, while still counting toward your own budgets |
Tiers are enforced on our servers, not in the app, so a modified copy of the app cannot reveal more than the tier allows. You can preview the app exactly as your partner sees it before committing to a tier, and you can change a tier at any time.
How it is protected
Sensitive text — merchant names, account names, the last four digits, your notes — is encrypted at rest with a key belonging to your household. Amounts, dates and categories are stored unencrypted so the app can add them up; we would rather state that plainly than imply an encryption guarantee we do not provide.
Traffic between the app and our servers is encrypted and certificate-pinned. The app can optionally require Face ID to open, and hides its contents in the app switcher.
Our own logs record identifiers and outcomes only — merchant names, balances and tokens are structurally excluded, not filtered out afterwards.
Who else is involved
- Plaid connects your bank at your request and handles your credentials in its own interface, under its own privacy policy.
- Apple handles sign-in and payment.
That is the complete list. No analytics vendors, no advertising networks, no data brokers, no one who has paid to be here.
Settlement links
When you settle up, you can send a link showing what is owed. It contains only the fields you chose to include, its address is stored hashed rather than in the clear, and you can revoke it instantly.
Getting your data back, and deleting it
Export gives you exactly what your device holds, from Settings.
Deletion is also in Settings, and it is real. If you are the only member of your household, every row is erased from every table. If you have a partner, your name and everything you typed are erased, while the shared amounts remain with them — otherwise deleting your account would rewrite their ledger. Encrypted backups age out within thirty days. A record that a deletion happened is kept, containing identifiers only.
Deleting your account also revokes Isomoira's Sign in with Apple token and removes our access to any connected bank.
How long we keep things
Your data stays while your account exists, because the app is a running picture of your finances and needs the history. When you delete your account it goes, as described above. Bank access tokens are removed when you unlink an institution, when a subscription lapses past its pause window, when you leave a household, and when you delete your account.
Children
Isomoira is not directed to children and we do not knowingly collect data from anyone under 13.
Changes
If this changes in a way that affects what we collect or who can see it, we will update the date at the top and tell you in the app before it takes effect.
Contact
Questions, requests for your data, or anything that looks wrong: hello@isomoira.com.