Privacy Policy — ValenOS

ValenOS is a personal finance app for people who manage money across multiple currencies. It is built privacy-first: your financial data lives only on your device and in your own iCloud. We never store it on our servers.

• Your transactions, accounts, balances, and statement files stay on your device and in your personal iCloud. We never store them on our servers.
• We show no ads, use no advertising identifiers, and never track you across other apps or websites.
• We never connect to your bank with a login. We do not use Plaid or any account-aggregation service. Data enters ValenOS only through files you choose to import.

• Statement files (CSV, Excel, PDF) — Parsed on your device. We never receive the file itself.
• Transactions, accounts, categories, notes — Stored on your device and your personal iCloud (Apple). Never on our servers.
• Identity — ValenOS uses Sign in with Apple. We receive an anonymous Apple identifier, never your email address or password, used only to apply usage limits to your account.

A few narrow requests pass through our backend, which is a stateless proxy that stores nothing:

• AI categorization — For a single transaction, its description, amount, date, and your own category names are sent via our backend to our AI provider (Mistral AI, located in the EU) to suggest a category. Processed per request, not stored, and not used to train AI models.
• Statement-format detection — When a file layout is new, a value-free masked sample (digits replaced with #, letters with X — no amounts, names, or account numbers) is sent once to detect the column layout, then cached on your device.
• Exchange rates — Only currency codes and dates (never amounts) are sent to fetch historical exchange rates.

We rely on the following providers, each governed by its own privacy policy:

• Apple — App distribution, Sign in with Apple, iCloud sync, and crash reporting — https://www.apple.com/legal/privacy/
• Mistral AI (EU) — AI categorization (per-request transaction text; not retained, not used for training) — https://mistral.ai/terms/
• Cloudflare — Backend infrastructure (request metadata only; no statement content) — https://www.cloudflare.com/privacypolicy/
• European Central Bank rate data, via Frankfurter — Public currency-data source — receives only currency codes and dates, no personal data — https://frankfurter.dev/

• No ads, no ad SDKs, no advertising identifier (IDFA), no App Tracking Transparency prompt — because we do not track you.
• No analytics SDKs of any kind (no Google Analytics, Firebase, Mixpanel, Amplitude, Facebook or TikTok pixels).
• No selling or sharing of your data. No bank-login aggregators.

Your financial data is on your device and your iCloud, so you control it directly: delete the App or its iCloud data to remove it, and export your data to CSV at any time from Settings. Depending on where you live (e.g., EEA/UK under GDPR, California under CCPA/CPRA), you may have rights to access, correct, or delete your data. Because we do not store your financial data, most requests are satisfied by these on-device controls; for the limited account and usage data, contact us at the address below. We do not sell personal information.

We do not retain your financial data — it is never on our servers. Backend logs carry correlation identifiers only, never statement content. Limited account and usage state is kept while your account is active and removed when you delete your account.

ValenOS is intended for a general audience and is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

We may update this policy; the Effective date above reflects the latest version.