Legal

Privacy Policy

Last updated 22 October 2026 · version 2026-10-22

Preview draft, pending legal review. This policy describes how the preview of the Apps handles personal information today. It has not yet been reviewed by our lawyers. If it changes, we will tell you in the App before the change applies.

This policy is a notice. It tells you what we collect, why, who we share it with, how long we keep it, and what you can do. It is not a contract, and you are not asked to agree to it. Where a feature needs your consent, the App asks you when you turn that feature on.

1. Who we are

Janisis, Inc. ("Janisis", "we", "us") publishes the Sum∗ suite of apps, including SumMoney, and the SumOne account service (the "Apps"). We are a company incorporated in Delaware, United States, at 4023 Kennett Pike #50222, Wilmington, DE 19807, USA.

Privacy contact: privacy@sumone.app. General support: support@sumone.app.

We handle personal information in line with the Australian Privacy Principles, and with the other privacy laws described in section 12, whether or not each law strictly applies to a company of our size.

2. The short version

• Your ledger lives on your devices. Most figures are worked out on your device.
• Ledger sync is end-to-end encrypted. If you turn on sync, your ledger records are encrypted on your device before they leave it. Only your devices hold the keys. Our sync service cannot read them, and we cannot recover them.
• Some features are not end-to-end encrypted. Bank connections, receipts you forward by email, items from the Outlook add-in, your account email, AI and voice requests, address lookups and diagnostics all reach our servers or our providers in a form they can read, or in a form our servers can unlock. Section 4 explains each one.
• No tracking and no ads. We use no advertising identifiers and no third-party analytics tools. We do not sell or share personal information for advertising.
• Optional means optional. Diagnostics, Suite voice, summaries for the assistant, Enhance with AI and location are all off until you turn them on.

3. Using the Apps without an account

You can use the Apps without a SumOne account. Without one, we receive only:

• the signed record of the terms you accepted (section 9);
• diagnostics, only if you turn them on (section 4.12); and
• the information that any internet request carries, such as your IP address, which our hosting provider handles to deliver the request.

4. What we collect, feature by feature

4.1 Your SumOne account

• What: your email address, an account number we create, the date you joined, your trial and plan status for each App, and how you sign in.
• Sign-in: we email you a 6-digit code through our email provider. We keep only a scrambled form of the code, for 10 minutes. We keep session records that hold your email address and an identifier for the device that signed in.
• Security records: to stop abuse, we keep counters keyed to email addresses and IP addresses.
• Invite-only preview: if someone tries to sign in with an address that is not invited, we send no email, but we may keep a short record of the attempt.
• Why: to create and run your account, keep it secure, and contact you about it.

4.2 Sync, devices and sharing

• What: encrypted copies of your recent ledger changes and encrypted snapshots. We cannot read them. We also keep a log of which accounts and device public keys belong to each ledger, and basic details such as when each snapshot was made.
• Sharing: if you share a ledger, the people you share with receive what you share on their devices.
• Contributions: if an App lets you invite someone to send you something, their contribution is encrypted to your key in their browser before it reaches us. We keep the encrypted item for up to 90 days so your device can collect it. We keep the sender's IP address for 2 days to limit abuse. If we email the invitation, we use the invitee's address and the names in it only to send that one email.
• Why: to keep your devices in step and to let you share.

4.3 Bank connections (Mac only)

• Plaid (US and Canada): you sign in to your bank through Plaid's own secure screen, never through us. Plaid sends us your account names, the last digits of account numbers, balances, account types and transactions (amount, currency, description, date, direction and status). We pass these to your Mac and do not store them on our servers. We keep the access Plaid gives us, encrypted, plus the bank's name and a position marker so we only fetch new transactions. We give Plaid an identifier made from your account number, not your email. Plaid handles your data under its own End User Privacy Policy (<https://plaid.com/legal/#end-user-privacy-policy>).
• Revolut Business: our server creates a key for your Revolut Business certificate. We store that key and the access Revolut gives us, encrypted. Your account and transaction data, including payee details, pass through our servers to your Mac. Our connection log keeps the last 50 events for each connection, and an event may include up to 200 characters of a payee's address.
• How we hold connection access: encrypted at rest on our servers with a key our servers hold. We use it only to fetch your data when your App asks. We do not use it for anything else.
• Australian open-banking feeds are not available in the Apps.
• Disconnecting: see the Deletion and Export notice (https://sumone.app/legal/deletion-export). Disconnecting Plaid tells Plaid to end our access, then deletes what we stored. Disconnecting Revolut deletes the access we stored, but not yet the key; remove the certificate in Revolut Business too.
• Why: to bring your transactions into your ledger at your request.

4.4 Receipts you forward by email

• What: we give you a private forwarding address. When you forward a receipt to it, we keep the whole email as plain email on our servers. We read it to pull out the sender, sender name, subject, business, amount and currency, so the App can show you what arrived.
• Who can send: we accept mail only from senders you approve, and only if it passes standard sender checks. Mail from a sender you have not approved is held for you to review. We keep your list of approved senders.
• How long: the email is deleted when your App collects it, or after 14 days, or after 90 days if it came from a sender you have not yet approved.
• Please do not forward medical or other sensitive receipts. See section 11.
• Why: to add receipts to your records.

4.5 The Outlook add-in

• What: items you send from Outlook: title, note, a reference to the message, due date, amount, the sender's email address, and one attachment.
• How we hold it: readable on our servers, up to 500 items, each kept for up to 60 days, then deleted.
• Why: to hand the item to your App.

4.6 Mailbox scanning (not available yet)

Connecting a Gmail, Outlook, Zoho or other mailbox to scan for receipts is not available yet. Any mailbox screen in the preview uses sample data and connects to nothing.

4.7 Voice

• Device voice: by default, the App hears you and speaks back using your device's own speech services. Nothing leaves your device.
• Suite voice: off until you turn it on. When it is on, audio of what you say may be sent through our servers to our speech provider, ElevenLabs, to turn it into text. The reply text, which can include figures from your records, is sent to ElevenLabs to be spoken. What you say, as text, goes to our AI provider, Anthropic (section 4.8).
• We do not store your audio or the replies on our servers. We keep a monthly count of voice turns for each account.
• Reported answers and learned phrasings: when you tap "That's not right", the report keeps what you said, the answer, and how it was understood. Learned phrasings keep the shape of what you asked. Both stay in your ledger and sync end-to-end encrypted. We see a report only if you export it and send it to us.
• Full details: AI and Voice notice (https://sumone.app/legal/ai-voice).

4.8 Assisted answers

• What travels: your question (up to 600 characters), your last 10 exchanges (up to 500 characters each), and the App, date, language and currency.
• Summaries for the assistant: only if you turn on "Show summaries to the assistant" (off by default), and only when you ask a question about your money. The App then also sends totals, counts and category names for the period you asked about. Never account numbers, statements or documents.
• We do not store these requests. Our logs record only whether a request worked.
• Why: to understand your question and word the answer.

4.9 Enhance with AI and business lookups

• When: only if you turn on the Enhance with AI setting. When it is on, it also runs in the background for new transactions, without a tap.
• What travels: for each transaction, its description as your bank wrote it, amount, date, direction (money in or out), currency and country, sent to Ntropy. We send it under one shared identifier for our whole service, not one for you. Some lookups also send the business name, amount, currency and location to Plaid's enrichment service. Business-name searches and the region go to Google. Australian business names or ABNs go to the Australian Business Register. Website names go to a Google service to fetch logos.
• Note: bank descriptions can include people's names.
• What we keep: lookup results, with the description they were made for, in a shared lookup cache with no set expiry, so the same business is not looked up twice.
• Why: to name and label the businesses in your records.

4.10 Address lookups

When you check an address, the address lines and region are sent from our servers to Google Maps Platform. The request comes from us, without your account or device details. We do not keep the address. We count lookups.

4.11 Location

If you allow location, your device sends its location to Apple's maps services to suggest a place for a purchase. It does not come to us. The visit history stays on your device for up to 90 days, is not synced, and may be included in your device's own backup. If you save a place with a transaction, its location syncs end-to-end encrypted with your ledger.

4.12 Diagnostics

Off unless you turn them on. One choice covers the whole Sum∗ suite and all your signed-in devices. Diagnostics carry a random install identifier, not your account. Details: Diagnostics notice (https://sumone.app/legal/telemetry).

4.13 Subscriptions

Paid plans are not on sale yet. When they open, they will be sold on the web through Stripe's Managed Payments, with Link (Stripe's consumer payment service) as the seller of record. Link collects your name, email, billing address, payment details and tax information to take payment, work out tax, issue receipts and handle refunds. It does this as a business in its own right, under Link's own privacy policy, not on our behalf. Stripe processes the subscription for us. We will receive your plan status, any add-ons, your billing email and country, and a customer reference, never your card number. We use your billing country to check that plans are offered where you are. If you subscribe with a promotion, invite or affiliate code, we keep which code was used with your subscription, to apply the discount, give the referring member their reward and pay the affiliate. A referring member is told only that their reward was earned, and an affiliate sees only counts and amounts, never your name or email. If you buy a gift card, we keep your email so we can resend the code, and we keep a record of who redeemed it. We will update this policy before billing opens.

4.14 Support and feedback

If you email us, we keep your message, your email address and our reply, to help you and to improve the Apps.

5. Data on your devices

• Your ledger is stored on your device and protected by your device's own security.
• The App keeps up to 5 local snapshots of your ledger, and deleted items stay in Recently Deleted for 30 days.
• Your device's own backups, such as iCloud Backup, may include the App's data.
• You can choose a folder, including a cloud drive, for receipt files. That provider's terms then apply to those files.

6. How we use personal information

We use it only to:

• provide the features you choose;
• keep the Service and your account secure, and prevent abuse;
• keep evidence of our agreement with you;
• fix problems and improve the Apps, using diagnostics only if you turn them on; and
• follow the law.

We do not use your records for advertising. We do not train AI models on your records or your voice. We do not send marketing email. If we ever do, we will ask first and every message will let you unsubscribe.

7. Legal bases (EU and UK)

• Contract: your account, sync, bank connections, receipt forwarding and the Outlook add-in.
• Consent: diagnostics, Suite voice, summaries for the assistant, Enhance with AI, and location. You can withdraw consent at any time in Settings.
• Legitimate interests: security, abuse prevention, and the record of your acceptance.
• Legal obligation: records we must keep by law.

8. Who we share with

We share personal information only with:

• Service providers who run parts of the Service for us. The current list, with what each receives and where, is in our Subprocessors notice (https://sumone.app/legal/subprocessors). Each one may use the information only to provide its service to us. We require each to protect it at least as well as this policy does.
• Services you connect, such as Plaid and Revolut, which act under their own privacy policies.
• People you share with, such as members of a shared ledger.
• Authorities, where the law requires it. We will tell you unless the law forbids it.
• A buyer of our business, who must honour this policy.

We will update the Subprocessors notice before we start using a new provider.

9. The record of your acceptance

When you accept our terms, and each time you accept a new version, your device sends us a record signed by its own key. It holds: what you did (accepted), which document and version, a fingerprint of the text, the App, the platform, the trial length, the time on your device, and your device's public key. We add the time we received it and the two-letter country code of your connection. We do not store your IP address in it. When you create an account, a separate record links your device key to your account.

We keep these records as evidence of our agreement, separate from diagnostics. They are kept even if you delete your account, because they prove which terms applied. We keep them for the longest period in which a claim about our agreement could be brought, plus one year. You can ask for a copy at privacy@sumone.app.

10. Where your information is held

Janisis is based in the United States. Our servers run on Cloudflare, which may process data in the United States and other countries where it has data centres. Our providers process data in these countries:

• United States: Cloudflare, Anthropic, ElevenLabs [confirm region], Ntropy [confirm region], Google, Plaid, Stripe and Link (when billing opens), and Apple.
• New Zealand or other regions [confirm]: SMTP2GO, which sends our emails.
• United Kingdom or European Economic Area [confirm]: Revolut, if you connect Revolut Business.
• Australia: our affiliated company that currently holds our hosting account, and the Australian Business Register for business lookups.

If you are in Australia, this means your information goes overseas. We take reasonable steps to make sure overseas recipients handle it in line with the Australian Privacy Principles, and we remain accountable for how our service providers handle it.

11. Health and other sensitive information

We do not ask for health information. Your medications register stays in your ledger on your devices and, if you sync, travels only end-to-end encrypted. But receipts you forward or send from Outlook can reveal health details, such as a pharmacy or clinic visit. Please do not forward medical or pharmacy receipts, or other receipts that reveal sensitive details, to your receipt address or the Outlook add-in. Add them in the App on your device instead. If sensitive details still reach us this way, we use them only to show you the receipt, and we delete them on the schedule in section 13.

12. Your rights and choices

12.1 Everyone

• See and export your records: in the App, at any time, including in read-only mode. See the Deletion and Export notice for what each platform can export today.
• Access and correction: ask us at privacy@sumone.app for a copy of what our servers hold about you, or to correct it. We reply within 30 days.
• Deletion: delete your account in the App, under Settings, Account, "Delete account". Section 14 explains the process.
• Withdraw consent: turn off Diagnostics, Suite voice, Show summaries to the assistant, Enhance with AI, or location in Settings. Turning a feature off stops future sending.
• Verification: we may ask you to confirm a sign-in code sent to your account email before we act.

12.2 Australia

You can complain to us at privacy@sumone.app. We will acknowledge your complaint within 7 days and respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC), on its website or on 1300 363 992.

12.3 United States

We give these rights to all US users, whether or not your state requires it.

• Categories we collect: identifiers (email, account and device identifiers, IP address for security); financial information passed through from banks you connect, and encrypted connection access; commercial information (plan and trial status; forwarded receipts); audio, if you use Suite voice; health information only if you send it to us in a receipt; and diagnostics tied to a random install identifier. We draw no inferences about you.
• Sources: you, your devices, the banks and services you connect, and the senders of receipts you forward.
• Sensitive information: used only to provide the feature you asked for. We do not use it to infer things about you.
• Sale and sharing: we do not sell personal information or share it for cross-context behavioural advertising, and have not done so in the last 12 months. We honour Global Privacy Control signals.
• Your rights: to know, access, correct, delete and get a portable copy, and to opt out of sale, sharing, targeted advertising and profiling (we do none of these). We will not treat you differently for using them.
• How to ask: email privacy@sumone.app. An authorised agent can ask with your signed permission. We respond within 45 days, and may extend once by 45 days if we tell you why.
• Appeals: reply to our decision to appeal. If we deny your appeal, you can contact your state attorney general.
• California: we do not share personal information with third parties for their direct marketing.
• Consumer health data:

12.4 European Union and United Kingdom

You have the rights of access, correction, deletion, restriction, objection and portability, and you can withdraw consent at any time. You can complain to your local data protection authority.

13. How long we keep it

• Encrypted sync copies of your own ledger: up to 7 days, or up to 30 days on a paid plan, never more than 90 days.
• Encrypted snapshots: the 4 most recent, within the same window.
• Encrypted copies for shared ledgers: no time limit yet; deleted when the share is closed.
• List of devices and members for each ledger: kept while the ledger exists.
• Contributions sent to you: up to 90 days. Sender IP address: 2 days.
• Account record: until you ask us to delete your account.
• Sign-in codes: 10 minutes, or until used.
• Session records and security counters: no automatic expiry yet; deleted when you delete your account.
• Connection access for Plaid and Revolut: until you disconnect or delete your account. The Revolut key is kept until you delete your account.
• Bank and Revolut transactions: not stored on our servers.
• Connection event log: the last 50 events per connection.
• Forwarded receipts: until your App collects them, or 14 days, or 90 days from a sender you have not approved.
• Approved senders and your forwarding address: until you change them or delete your account.
• Outlook add-in items: up to 60 days.
• Voice audio, replies and assistant requests: not stored by us. Our providers' retention is in the AI and Voice notice.
• Monthly voice usage counts: no automatic expiry yet; deleted when you delete your account.
• Business lookup cache: no set expiry. Address lookups: not kept; we keep daily counts only.
• Diagnostics: see the Diagnostics notice. Events: 180 days. Receipt-read reports: 90 days.
• Record of your acceptance: see section 9.
• Short operational logs (for example, whether a request worked, and provider reference numbers, never your records' content):.

14. Deleting your account

• How: in the App, on iPhone, iPad or Mac, under Settings, Account, "Delete account". You confirm with a code we email to your account address.
• What happens: we end our access at your connected providers, then delete what we hold. If something cannot finish, nothing is deleted and the App asks you to try again. If it keeps failing, email privacy@sumone.app from your account email address and we will delete your account by request, within 30 days.
• What survives: some records are kept after deletion, and some sit outside our control. These are the record of your acceptance, data held by providers you connected, records on your devices and your sharers' devices, contributions that have not yet expired, and diagnostics that are not linked to your account.
• Full details: Deletion and Export notice (https://sumone.app/legal/deletion-export).

15. Security

• Ledger sync: end-to-end encrypted with keys only on your devices.
• Bank and Revolut connection access: encrypted at rest (AES-GCM) with a key our servers hold.
• Data in transit: data travelling to and from our servers uses encrypted (TLS) connections.
• Sign-in: codes expire after 10 minutes, work once, and lock after 5 wrong tries. Access sessions last one hour and refresh securely.
• On the Mac: your device's owner check (such as Touch ID) is required before you connect a bank.
• Our apps: they contain no third-party analytics or advertising code.

No system is perfectly secure. Our servers can read forwarded receipts, Outlook add-in items and your account email, and can unlock connection access. Only the small team that runs the Service can reach these systems.

16. If there is a data breach

If a breach of our systems is likely to cause you serious harm, we will tell you without undue delay: by email if you have an account, and in the App. We will also tell the regulators the law requires, such as the OAIC in Australia, and include what happened, what information was involved, and what you should do.

17. Automated processing

The Apps use automated processing to:

• sort transactions into categories;
• match receipts to transactions and spot duplicates;
• read receipts;
• look up businesses (if you turn on Enhance with AI); and
• word assistant answers.

These help you keep records. None of them makes a decision about you that has a legal or similarly significant effect. Read-only mode after the trial follows a fixed, published rule, not an assessment of you. You can review and change any automated result.

18. Children

The Apps are for people aged 16 and over and are not directed at children. If we learn that we hold personal information from a child under 16, we will delete it.

19. Changes to this policy

We will post each version at https://sumone.app/legal/privacy with its date, and keep earlier versions there. If we make a change that matters, we will tell you in the App before it applies. If a change needs your consent, we will ask for it.

20. Contact

Janisis, Inc., 4023 Kennett Pike #50222, Wilmington, DE 19807, USA

• Privacy: privacy@sumone.app
• Support: support@sumone.app