Privacy overview

Built for your money—
not your data.

Sumstead is offline first. Your ledger, receipts, budgets, search, and analysis live on your device unless you explicitly export them or enable optional Premium iCloud Sync.

No Sumstead account

The app does not require an app-owned identity or financial-data backend.

No tracking SDKs

No analytics, advertising identifiers, or bank connection are included.

No forced cloud

Optional Premium iCloud Sync is off by default and uses your private iCloud database.

Local first

What stays on your device

Your financial records use protected local storage and remain fully usable without a network connection. That includes accounts, balances, categories, transactions, budgets, search, insights, planning records, and receipt processing.

  • Money is represented with exact minor-unit values, not floating-point approximations.
  • Receipt images are sanitized, protected, and stored outside the main database.
  • The app hides sensitive snapshots when it becomes inactive.
  • Device-owner authentication protects exports, restores, lock changes, and destructive actions.
Receipt privacy

OCR happens on your iPhone

Receipt scanning uses Apple Vision technologies on-device. You review the merchant, date, total, tax, account, and category before anything is saved. Sumstead does not send receipt photos or extracted values to an app-owned recognition service.

Optional sync

How iCloud Sync works

Premium iCloud Sync is optional, off by default, and requires a deliberate opt-in. When enabled, eligible records and protected receipt assets are stored in your private iCloud database and count toward your iCloud storage. The local ledger remains canonical.

If Premium ends, sync stops but your local data remains. You can still turn sync off and remove Sumstead's cloud copy. Sumstead does not describe CloudKit data as end-to-end encrypted beyond the guarantees Apple provides for your exact account configuration.

Limited network use

When the app may connect

The core app works offline. Network access is limited to Apple StoreKit product loading, purchase, restore, and verification, plus optional Premium iCloud Sync when you enable it. Sumstead does not include its own financial-data server.

Your exports

You control portability

CSV files are plaintext and should be handled carefully. Local backup archives are password-derived and encrypted. Exported files leave Sumstead's protected storage, so their privacy depends on where you save or share them.

Your choices

Access, correction, and deletion

You can view, edit, delete, and export local records from the app. Sumstead does not operate an account database from which it can retrieve your local ledger. If optional iCloud Sync is enabled, the app provides a protected path to disable sync and delete its iCloud copy.

Status

Before public release

This page describes the current local release candidate and will be updated with the final App Store privacy policy, production support address, effective date, and any required regional disclosures before distribution.

Privacy question