Privacy Policy

Last updated: October 19, 2026

The short version

  • Penny Isle never asks for bank logins and never moves money.
  • We do not sell your personal information, and we do not show ads.
  • Your financial entries are visible only to you. Analytics never include amounts, balances, notes, or names.
  • You can export or permanently delete your data at any time from Profile.

Information you give us

Account. If you create an account, we store your email address and, if you sign in with Google, your Google account’s name and email. Passwords are handled by our authentication provider and are stored only in hashed form.

Your entries. Expenses, income, categories, notes, account names and balances, savings goals, coins, and your island layout. These are used only to run the app for you.

Trying without an account. If you use Penny Isle without signing in, everything stays in your browser’s local storage and is never sent to our servers. Clearing your browser data deletes it.

Usage analytics (optional)

With your consent, we send usage events to Mixpanel (EU data residency) to learn which features are used, for example “expense logged” or “building placed.” Events carry only fixed labels such as the type of entry or the screen name. We never send amounts, balances, notes, category or goal names, or your email. IP-based location is turned off. If you sign in, events are linked to a random account ID so we can measure retention across devices. You can decline on the banner or turn analytics off anytime in Profile, after which no events are sent.

Service providers

  • Supabase stores your account and entries. Rows are protected so only your account can read or change them. Data is encrypted in transit and at rest.
  • Vercel hosts the website and may keep standard server logs, such as IP address and browser type, for security and reliability.
  • Google handles sign-in, only if you choose “Continue with Google.”
  • Mixpanel provides product analytics, only with your consent.
  • Paddle (Paddle.com Market Ltd) is our reseller and Merchant of Record for Penny Isle Plus. Paddle processes your payment, billing address and tax details under its own privacy policy. We receive your subscription status and a customer ID, never your full card number.

These providers process data on our behalf and may store it in the United States or the European Union.

Cookies and local storage

We use browser local storage to keep you signed in, save your progress, and remember your language and consent choices. We do not use advertising cookies or cross-site tracking.

Retention and deletion

We keep your data while your account exists. Profile → “Delete my account and data” permanently deletes your account and all entries from our database. Backups are overwritten within 30 days. Profile → “Download activity as CSV” exports your entries.

Your rights

Depending on where you live, including California (CCPA/CPRA), the EU and UK (GDPR), and Turkey (KVKK), you may have the right to access, correct, delete, or export your personal information and to object to or restrict certain processing. We do not sell or “share” personal information for cross-context behavioral advertising. To make a request, email hello@pennyisle.com. We will not discriminate against you for exercising your rights.

Children

Penny Isle is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us information, contact us and we will delete it.

Security

We use encryption in transit (HTTPS), access controls that limit each account to its own data, and reputable infrastructure providers. No system is perfectly secure. Please use a strong, unique password.

Changes

If we make material changes, we will update this page and the date above, and notify you in the app where appropriate.

Contact

Questions or requests: hello@pennyisle.com