The short version

• Peony stores the budget you put into it, plus what it needs to sign you in, and uses them only to run the app.
• No ads, no analytics, no tracking. I never sell your data or share it for marketing.
• Everyone in your household can see your household's budget. Nobody else can.
• Face ID, notifications, and your device settings stay on your device.
• Delete Account removes your account from Peony's servers straight away.

1. What Peony collects

Your account

• Email and password. If you sign up with email, your address is stored with your account. Your password is stored only as a salted hash, so nobody, including me, can read it.
• Sign in with Google (optional). If you choose it, Google shares your name, email address, and a link to your profile photo, and they're saved with your account. Peony uses the name and photo to fill in your display name and avatar. It never gets your Google password or access to anything else in your Google account.
• Sign in with Apple (optional, on iPhone). If you choose it, Apple shares a private user ID and an email address, and they're saved with your account. The first time only, Apple also shares your name if you choose to, and Peony saves it with your account and uses it to fill in your display name. If you pick Hide My Email, Apple gives Peony a private relay address that forwards to your real one, and Peony never sees your real address. Peony never gets your Apple ID password.
• Account records. The basics any login system keeps, like when you signed up, when you last signed in, and which sign-in method you use.

Your household's budget

This is whatever you and your household type into Peony:

• your household's name, and its private join code (the "invite code")
• transactions: the amount, date, description, category, payment method, savings goal, the display name of whoever added it, and which member's account added it
• categories and monthly budgets, recurring bills and paychecks with their schedules, and savings goals with their target amounts and goal dates
• payment method names, like "Apple Card" or "Checking". These are just labels. Peony never asks for card numbers or bank details, and it doesn't connect to your bank.
• the member list: who belongs to the household, whether they're the owner or a member, and when they joined
• household settings, like whether the owner has started next month early
• the household's high score in Roadrunner, the little game hidden in Settings, and the display name of whoever set it, plus each member's own best score and the display name they set it under
• reactions: the emoji you put on a transaction (swipe right on it), which transaction it's on, which member's account added it, and when

Peony Plus, if you subscribe

Peony is free to download. Peony Plus is an optional subscription, and one subscription covers everyone in your household. If you subscribe, your iPhone sends Peony's server Apple's signed record of the purchase. Peony checks Apple's signature, then keeps only what it needs to know whether your household has Plus: the subscription's transaction numbers, which plan it is, when it renews or expires, whether it's set to renew, and whether it was refunded or cancelled. That record is saved against your login, not your household, because the subscription follows the person who pays.

Apple also tells Peony's server directly when a subscription renews, lapses, is refunded or is cancelled, so your household stays right even if nobody opens the app for months. None of this includes your name, your Apple ID or your payment details, and Peony never sees them - Apple handles the payment. Households that were using Peony before it went on sale keep Plus for free, and need none of this.

Custom themes

If you design your own theme, it's saved to your account so it follows you to your other devices. Only you can see your custom themes.

Transactions added without a connection

If you add an income or expense while your device can't reach Peony's servers, Peony keeps it on that device until it can, then sends it and deletes the copy on the device. While it waits, it's kept in Peony's own app storage on iPhone, or in your browser's local storage on the web. Signing out leaves it waiting for you to sign back in on that device, and deleting your account removes it.

Technical information

When your device connects to Peony's servers, the services that run them (see section 5) process your IP address and basic details like your browser or device type and the time of the request. They need this to deliver the service and keep it secure, and they keep short-lived logs of it, including sign-in events. I don't use any of it to profile or track you.

If Peony runs into an error while you're signed in, it sends me a short error report so I can fix it: the error message, the first few lines of where in Peony's code it happened, whether it was the iPhone app or the web, which version, and which screen you were on. It's tied to your account so one misbehaving device can't flood it. Before it leaves your device, Peony strips out anything that looks like an email address or an amount of money, and a report never includes your transactions, notes, or names. Error reports are deleted after 30 days, or straight away if you delete your account.

Peony doesn't use cookies for tracking. The web app keeps your sign-in session and your device settings in your browser's local storage, which it needs in order to work. This website sets no cookies at all.

2. What stays on your device

These never leave your phone or computer, and they never reach Peony's servers:

• Face ID and Touch ID. The App Lock is handled entirely by iOS. Peony only learns "yes, unlock" or "no". It never sees your face or fingerprint data.
• Notifications. Bill reminders, the weekly summary, and household activity alerts ("Sam added a transaction") are built and scheduled on your iPhone. There is no push notification server.
• Home Screen widgets. When you open Peony on iPhone, it saves a small summary for its widgets (safe to spend, upcoming bills, top categories) in storage that only Peony and its widgets can read. The widgets never go online. Signing out clears it.
• Background refresh. A few times a day, iOS may briefly wake Peony on iPhone to fetch your household's budget from Peony's servers, the same data it loads when you open it, so the widgets, reminders, and household activity alerts stay current. Nothing new is collected or sent anywhere else. You can turn it off in iOS Settings > General > Background App Refresh.
• Device settings: your theme choice, text size, visual effects, where the menu sits, App Lock, haptics, notification and widget settings, the items you've pinned to the top of a list, whether Roadrunner's sound is muted, and whether you've seen the welcome tour.
• Your display name and avatar are kept on each device, too. One exception: when you add a transaction, the display name on that device is saved with it as "entered by", so your household can see who added what.
• Roadrunner scores. Scores stay on your device, except a new household record, which is sent to Peony's servers with your display name so your household can see it. A record set without a connection waits on the device until it can be sent.
• Exports and backups. CSV reports and backup files are created on your device and go only where you choose to save or share them.

3. How it's used

Only to provide Peony to you:

• to sign you in and keep your account secure, including emails that confirm your address or reset your password
• to store your household's budget and keep it in sync, live, across your devices and your household's members
• to show who added each transaction, and, if they've turned on notifications, to let the rest of your household know when you add one
• to check whether your household has Peony Plus, which includes the web app
• to find and fix bugs, using the error reports described in section 1
• to answer you when you email for help

That's the whole list. Peony has no advertising, no analytics or tracking tools, and no third-party SDKs that collect data. It doesn't track you across other companies' apps or websites. I don't sell your information, rent it, or share it for anyone's marketing.

4. Who can see it

Your household

Everyone in your household can see the household's budget: every transaction, category, recurring item, savings goal, and payment method, plus who entered each transaction and who reacted to it. Members can also see each other's email addresses in the member list. Only the household owner can see and share the invite code, remove members, export or restore a full backup, and delete all transactions.

Your personal budget, if you start one

You can also keep a personal budget next to your household's. Only you can see it - not your household, not anyone else. It can't be shared, and nobody can join it. It's stored the same way as your household's budget, and it's deleted if you delete it in Settings or delete your account. If your household has Peony Plus, that covers your personal budget too. If you leave your household, or its owner removes you, Peony starts an empty personal budget for you so you're never left with nothing; you can delete it in Settings like any other.

Nobody outside it

The database enforces this with row-level security. A signed-in person can read a household's data only if they're a member of that household.

Me

As the person who runs Peony, I have technical access to the database. I only look at your data when you ask me to help with something, when it's needed to keep Peony secure and working, or when the law requires it.

When the law requires it

I may disclose information if I'm legally required to, for example by a valid court order, or when it's needed to protect someone's safety.

If Peony changes hands

If Peony is ever transferred, for example to a company I set up to run it, your data would move with it and stay covered by this policy. I'll post a notice here first.

5. Services Peony relies on

These companies run parts of Peony for me. They process data only to provide their service, under their own privacy and security terms.

Peony's fonts and images are served from Peony's own domain, so just opening the app or this website doesn't send anything to a font service or anyone else.

6. Payments

Peony is free to download, with an optional Peony Plus subscription sold through the App Store. Apple handles the payment, and I never see your card or billing details. Apple gives developers sales reports, but they don't identify you. The only purchase information Peony keeps is the subscription record described in section 1. Your subscription renews automatically until you cancel it, and you cancel it with Apple, in Settings > Apple ID > Subscriptions on your iPhone.

7. Keeping and deleting your data

Your data stays in Peony for as long as you have an account. You can delete your account yourself at any time, from Settings > Danger Zone > Delete Account, or on the web from the screen that asks you to get the iPhone app. What it removes depends on your role:

• If you own a household: your login, and the whole household with it. That's every transaction, recurring item, category, savings goal, payment method, and custom theme in it, plus every member's access. If you share your household, consider exporting a backup first (see section 8).
• If you're a member: your login, your membership, and your custom themes. The transactions you added stay with the household, because they're part of its shared history, and they keep the "entered by" name they were saved with. Their link to your account is cleared. If you hold the household's Roadrunner record, the score stays and your name is removed from it. Your own Roadrunner best and your reactions on transactions are deleted. Leaving a household also takes your best off its Roadrunner board.
• Either way, if you subscribe to Peony Plus: deleting your account deletes Peony's record of your subscription, and the household stops getting Plus from you. It does not cancel the subscription - Apple bills it, so only Apple can stop it. Cancel it in Settings > Apple ID > Subscriptions on your iPhone first if you mean to.

Deletion happens straight away, all at once, and can't be undone. Peony also clears its saved settings from the device you delete from. If you signed in with Apple, Peony asks you to confirm with Apple once more, then tells Apple to end Peony's access to your Apple ID, just like turning off Sign in with Apple for Peony in your iPhone's Settings. Two things aren't instant:

• Backup copies of the database, kept for disaster recovery, hold deleted data for up to 7 days before it ages out.
• Server logs (IP addresses and sign-in events) expire on the providers' own schedules.
• Error reports (see section 1) are deleted automatically after 30 days, and right away with your account.

Can't get into the app? Email support@peonybudget.com from the address on your account, and I'll delete it for you.

If you leave a household, or the owner removes you, your account stays, but you lose access to that household's data.

8. Your choices

• See and download it. Everything Peony stores about your household is visible in the app. Anyone in a household with Peony Plus can download a month as a CSV from Activity, or any search across your whole history from Lifetime, and on every plan the owner can export the whole household from Settings > Data > Export All Data.
• Fix it. You can edit or delete anything in the app.
• Delete it. See section 7.
• Ask me. For anything else, including a copy of the account details Peony holds about you, email support@peonybudget.com. I'll answer within 30 days.

Depending on where you live (for example California, Canada, the EU, or the UK), the law may give you more rights over your data. I'll honor these requests wherever you live. Peony doesn't sell or share personal information, as California law defines those terms.

9. Security

• All traffic to and from Peony is encrypted (HTTPS/TLS), and Supabase encrypts stored data.
• Passwords are stored only as salted hashes. When you choose a new one, Supabase checks it against a list of known leaked passwords (Have I Been Pwned) using a method that sends only a small, anonymous piece of a hash, never your password.
• Row-level security in the database keeps each household's data to its own members, and deleting a whole household can only happen through a checked, owner-only path.
• On iPhone, you can lock Peony behind Face ID, and it hides your numbers in the app switcher while the lock is on.
• Peony's Home Screen widgets hide their amounts while your iPhone is locked. You can also turn widget amounts off entirely in Settings, and they start off that way if you use App Lock.

No system is perfectly secure. If a breach ever affects your data, I'll tell you as the law requires.

10. Children

Peony isn't meant for children under 13, and I don't knowingly collect data from them. If you think a child under 13 has an account, email support@peonybudget.com and I'll delete it.

11. Where your data lives

Peony is offered in the United States and Canada, and its servers are in the United States. If you use Peony from Canada or anywhere else outside the US, your data is sent to and stored in the US, where it's protected as this policy describes but may be reachable by US authorities under US law.

12. Changes and contact

If this policy changes, I'll post the new version here with a new date. If a change makes a real difference to how your data is handled, I'll also tell you in the app or by email before it takes effect.

Questions, requests, or something that doesn't look right? Write to Jacob Davis at support@peonybudget.com. Peony is based in New Mexico, USA.