Privacy Policy

Coffer is built on a simple principle: your financial ledger belongs to you. It is stored on your device and, when iCloud sync is active, in your private iCloud database. Coffer does not operate a server that receives your ledger.

Last updated: August 1, 2026

1. What Coffer Is — and Isn't

Coffer is a manual-entry money and budget tracker — with optional tracking for stocks, gold, and crypto you hold on the side. You type in what you own; Coffer organises and displays it. There is no bank linking, no screen-scraping, no integration with Plaid, Yodlee, or any other aggregator. Coffer never asks for your bank password or account credentials, and it never will.

2. Data Stored on Your Device

Everything you add in Coffer — accounts, holdings, lots, transactions, custom categories — is stored locally on your device using Apple's SwiftData framework. This on-device store is the source of truth. The app is fully usable offline; no network connection is required to view or edit your data.

You can optionally set a display name for the greeting. That name and your app preferences are stored on the device; they are not used to create a Coffer account or sent to Coffer.

3. iCloud Sync (Optional)

If you are signed in to iCloud on your device, Coffer can sync your data across your iPhone and iPad using Apple's CloudKit. This sync works as follows:

• Private to your iCloud account. SwiftData stores synced records in the app's private CloudKit database. They are protected by Apple's iCloud security and account controls and are associated with your Apple ID, not a Coffer account.
• Not sent to a Coffer backend. Coffer operates no backend that receives a copy of your ledger. The developer does not receive your private CloudKit records through the app's normal operation.
• Optional. If you prefer to keep data on one device only, sign out of iCloud or disable iCloud for Coffer in iOS Settings → [Your Name] → iCloud.

Your iCloud data is governed by Apple's Privacy Policy. Coffer's privacy policy applies to the app itself.

4. Limited Network Services

Prices and foreign exchange

When Coffer refreshes market prices or exchange rates, it makes HTTPS requests to Yahoo Finance for listed securities and gold, CoinGecko for supported crypto assets, and Frankfurter for foreign-exchange rates. A request can include a ticker or coin identifier and the relevant currency codes. It does not include your units, purchase cost, balances, account names, transaction notes, transaction history, or portfolio total.

Like any internet service, these providers may receive ordinary connection information such as an IP address and request headers. Their handling, retention, and any use of that information is governed by their own policies. Coffer itself uses their responses only to provide the requested price or exchange-rate functionality.

Foreign-exchange data comes from European Central Bank reference rates via Frankfurter. Coffer inverts or cross-calculates those rates for your selected home currency. They are indicative only and are available free of charge from the ECB.

Before the first successful reference-rate refresh, Coffer may use bundled fallback estimates so offline totals remain usable. The app labels those estimates stale and indicative; it does not present the app-launch time as though it were an ECB update time.

What Coffer does not do

• No bank credentials or full financial ledger are sent to a Coffer server.
• No ads, tracking pixels, or advertising identifiers are built into Coffer.
• The developer does not create advertising profiles, sell data, or act as a data broker.
• No Coffer account registration is required. A name is optional and local; an email address or phone number is not required to use your ledger.

5. CSV Import & Export

Importing a CSV or XLSX file into Coffer processes the file entirely on your device. The file is never uploaded anywhere. Exporting produces a CSV that stays in your device's Files app or share sheet until you choose what to do with it — that choice is yours, not ours.

6. On-Device AI (Quick Log)

Coffer can optionally help you log a transaction faster: type a plain-English description (e.g. “lunch 450 from HDFC”) and Coffer pre-fills the amount, account, category, and date for you to review and confirm before anything is saved. This parsing runs entirely on-device using Apple's on-device Foundation Models — your text is never sent to Coffer's servers (there are none) or to any third party. This feature is strictly data-entry assistance: it never offers financial advice, recommendations, or insights, and it never saves anything without your confirmation.

7. Crash Diagnostics

Coffer relies solely on Apple's standard crash-reporting infrastructure (built into iOS). Crash logs may be shared with Apple and, optionally, with the developer, but only if you have enabled “Share with App Developers” under iOS Settings → Privacy & Security → Analytics & Improvements. This setting is controlled entirely by you. Standard reports generally contain diagnostic details such as the device model, OS and app versions, and a stack trace. Coffer does not intentionally attach your ledger contents to crash reports.

8. Subscriptions & Payments

Apple processes Coffer Pro purchases through the App Store. Your payment-card and Apple Pay details are handled by Apple and are never seen or stored by Coffer or RevenueCat.

Coffer uses RevenueCat, a third-party subscription service, to reconcile App Store purchases and determine whether Pro features are unlocked. RevenueCat receives App Store purchase and entitlement information, an automatically generated anonymous app-user identifier, Apple's vendor-scoped device identifier (IDFV), ordinary connection information such as an IP address, and app/device details such as the app version, OS version, device model, locale, and storefront country. It does not receive your Coffer ledger or payment-card details. Coffer uses this service to administer Pro access and understand subscription performance, not for advertising or cross-company tracking. See RevenueCat's Privacy Policy.

To manage, cancel, or restore your subscription, go to iOS Settings → [Your Name] → Subscriptions, or visit the App Store.

9. Data Retention & Deletion

Your ledger lives on your device and, when sync is active, in your iCloud account. Purchase records and support messages are separate from that ledger. To delete data:

• Start fresh: Open Coffer → Settings → Start fresh. Coffer deletes the financial records in its local SwiftData store, then creates an empty default book and cash account so the app remains usable. Export anything you want to keep first.
• Remove synced records from iCloud: When Coffer is using CloudKit, those deletions are sent to iCloud the next time sync completes. This may not be immediate while the device is offline. You can also manage Coffer storage in iOS Settings → [Your Name] → iCloud → Manage Storage.
• Delete the app: Deleting Coffer removes its local app data from that device. It does not by itself cancel a subscription or guarantee removal of synced iCloud records; manage those separately through Apple's settings.

App Store purchase history is controlled by Apple. RevenueCat may retain the anonymous purchase and entitlement record needed to administer access and meet legal obligations. That record is not part of your Coffer ledger. Contact support if you have a question about a RevenueCat record.

10. Children's Privacy

Coffer is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has entered personal data, you can erase it using the steps above.

11. Changes to This Policy

If we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you through the app. Continued use of Coffer after a policy update constitutes your acceptance of the revised terms.

12. Contact

If you email support, the developer receives the email address, message, attachments, and ordinary email metadata you choose to send. That information is used to reply, troubleshoot, and maintain support records. Please remove real financial details from screenshots or CSV samples before sending them. You can ask us to delete a support conversation, subject to legal or security requirements.