Privacy Policy

Last updated: July 29, 2026

1. Introduction

Welcome to Zentally ("we," "our," or "us"). We are committed to protecting your privacy. This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights and choices you have when you use our mobile application and related services. If you do not agree with this policy, please do not use the app.

2. Information We Collect

2.1 Information You Provide

  • Account Information: Your email address and password when you create an account, and your name and optional profile photo (avatar) if you add them.
  • Financial Data: Expense and income amounts, categories, vendor names, dates, notes, budgets, savings goals, bills, and reminders you enter manually, by voice, or through receipt scanning.
  • Receipt & Document Images: Photos you scan or upload. These are usually purchase receipts, but the scanner also recognises documents that record money you received — such as a payslip, a paid invoice, or a deposit slip — so it can create an income entry instead of an expense. The image is stored in your account and processed by AI to extract the transaction details (see Section 4). Documents like payslips can contain sensitive information we neither need nor use, such as a national insurance or social security number, an employee number, or a home address. We recommend covering or cropping those parts before scanning. Whatever is visible in the image is sent to our AI provider and kept in your account until you delete the image or your account.
  • Voice Recordings: Audio captured when you use voice expense entry, used to produce a transcript (see Section 4).
  • AI Assistant Conversations: The messages you send to the in-app AI assistant and its replies, which are stored in your account so you can revisit them.
  • Household Invitations: If you invite someone to a shared household (Family plan), we collect the email address you provide for that person in order to send them an invitation.
  • Support Communications: Information you include when you contact us for support.

2.2 Information Collected Automatically

  • Device & Usage Data: Device type, operating system, app version, and in-app feature usage and interactions, used for product analytics.
  • Diagnostics: Crash reports and performance data used to fix problems and improve stability.
  • Push Notification Token: If you enable notifications, a device push token so we can deliver the reminders and alerts you configure.
  • Subscription Data: Your subscription status plus limited purchase metadata (product, price, currency, store, and trial/renewal/expiration dates) received from the app stores via our subscription provider.

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and secure the Zentally service
  • Extract expense and income details from scanned documents and voice input using AI
  • Generate personalized spending insights and AI assistant answers
  • Send the bill reminders, budget alerts, and notifications you enable
  • Manage your subscription and entitlements
  • Diagnose crashes, analyze usage, and improve the app
  • Provide customer support and respond to your requests
  • Comply with legal obligations

4. AI Processing

Zentally uses artificial intelligence to power receipt scanning, voice entry, spending insights, and the AI assistant. The following describes how your data is processed:

  • Receipts & documents: When you scan an image, it is sent to Google Gemini to determine whether it records money you paid or money you received, and to extract details such as the vendor or payer, amount, date, category, and line items. If Google is unavailable or returns an error, the image is sent to OpenAI instead so the scan can still complete. You always review and can correct the result — including whether it is an expense or income — before anything is saved. Scanned images are also stored in your account so you can view them later (your "receipt vault").
  • Voice: Voice entries may be transcribed on your device by your operating system's speech recognition (in which case only the resulting text is sent to us). When on-device transcription is unavailable, the audio recording is sent to Deepgram for transcription. Audio is processed only to produce a transcript.
  • AI Assistant & Insights: The AI assistant uses OpenAI to answer questions based on your recent financial data, and daily insights are generated from your data. Your assistant conversation history and generated insights are stored in your account until you delete them or delete your account.

Our AI providers (Google, Deepgram, and OpenAI) process this data only to return a result to you and do not use it to train their models.

5. Data Storage and Security

Your data is stored using Supabase infrastructure. We implement:

  • Encryption in transit (TLS) and encryption at rest
  • Row-level security so you can only access your own data
  • Biometric app lock (Face ID / fingerprint), processed on your device and never collected by us

Profile photos: If you set a profile photo (avatar), it is stored in a publicly-accessible location and served via a public link, which means anyone who has the direct image URL can view it. Please avoid using a sensitive image as your profile photo. Your profile photo is deleted when you delete your account.

6. Third-Party Services

We share data with the following service providers only as needed to run these features:

  • Supabase: Database, authentication, and file storage.
  • Google (Gemini): Receipt and document understanding and spending-insight generation.
  • Deepgram: Cloud speech-to-text for voice entry, when on-device transcription is not used.
  • OpenAI: The AI assistant, using your recent financial context to answer questions; and receipt understanding as a fallback when Google is unavailable.
  • RevenueCat: Subscription management; we receive purchase status and limited transaction metadata.
  • Apple App Store / Google Play: Payment processing for subscriptions.
  • Expo, Apple Push Notification service, and Google Firebase Cloud Messaging: Delivery of push notifications you enable; they receive your device push token and the notification content.
  • PostHog: Product analytics, processed in the United States. Events are linked to your account identifier so we can attribute and improve usage; financial values and contact details are removed before they are sent.
  • Sentry: Crash and error diagnostics. Personal information is disabled; events are associated only with your account identifier.

Analytics and diagnostics help us run and improve the app. If you would like us to limit this processing for your account, contact us at support@zentally.app.

7. How Your Data Is Shared

We do not sell your personal data and we do not use it for cross-app advertising or tracking. We share data only:

  • With the service providers listed above, to process your requests
  • With household members you join or invite (Family plan): financial data within a shared household is visible to accepted members, and the household owner can remove members
  • When required by law or valid legal process
  • To protect our rights, safety, or property, or those of others

8. Your Privacy Rights

Depending on where you live, you may have rights under laws such as the EU/UK GDPR and the California Consumer Privacy Act (CCPA/CPRA), including the right to:

  • Access the personal data we hold about you
  • Export your expense and income data
  • Correct inaccurate data
  • Delete your account and associated data
  • Restrict or object to certain processing

California residents have the right not to receive discriminatory treatment for exercising these rights; because we do not sell or share personal information for cross-context behavioral advertising, no "Do Not Sell" action is required. To exercise any right, delete your account in the app (Settings → Account → Delete Account) or contact us at support@zentally.app. See also our Account Deletion page.

9. Data Retention

We retain your data while your account is active. Free accounts retain 3 months of transaction history; Pro and Family accounts retain full history. When you delete your account, your personal data — including your stored receipt images and profile photo — is permanently removed within 30 days. We retain anonymized billing records (no longer linked to you) for accounting and to meet legal obligations.

10. International Data Transfers

We and our service providers may process your data in countries other than where you live, including the United States. Where required, we rely on appropriate safeguards for these transfers.

11. Children's Privacy

Zentally is not intended for children under 13 (or the minimum age required in your country), and we do not knowingly collect personal information from them. If you believe a child has provided us data, please contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the app or by email. Your continued use of Zentally after changes take effect constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or your data, contact us at support@zentally.app.