Privacy Policy

Last updated: October 6, 2026

Introduction

Ruply ("we", "us", "Ruply") is a personal expense tracker built and operated by Mehul Bhargava, an independent developer based in India. We've built Ruply with one principle that everything else flows from: your money data belongs to you. We hold it only to run Ruply for you, and nobody else ever gets a copy.

This Privacy Policy explains, in plain language, what data Ruply handles, where it lives, and what you can do about it. We've tried to keep it short. If anything here is unclear, email mebhargava02@icloud.com.

1. The short version

• Your personal finance data — expenses, budgets, income, EMIs, envelopes, categories, and the cards and bank accounts you name — lives with your Ruply account on servers we operate. From version 2.10 this is where it lives (earlier versions kept it on your iPhone and in your iCloud), so signing in with Apple on any iPhone brings everything back. It is stored solely to run Ruply for you. No one at Ruply reads, accesses, or uses your data, and we never sell or share it with anyone, ever.
• Data you share with other people — your household and your splits — is stored on our own servers so it can reach them. It is stored solely to run those features. No one at Ruply reads, accesses, or uses your data, and we never sell or share it with anyone, ever.
• Splits are stored on our servers in readable form — that is what lets balances stay correct on every phone, update instantly, and survive a lost device. They are stored solely to run Splits. No one at Ruply reads, accesses, or uses them, and they are never sold or shared.
• We keep an account for you, created when you Sign in with Apple (or with Google on Android). It holds your identity — a one-way hash of your Apple ID, your email, and your name — and it is what your personal data is stored under, so it can follow you to a new phone. See Sections 3, 7b and 7c.
• A few features rely on external services (Apple Push Notifications, our stateless AI proxy, anonymous app-usage analytics, our minimal subscription-verification record). Each is described below.
• You can delete everything we hold about you, from inside the app, at any time.

2. Data we handle

2.1 Data you provide directly

• Your name — captured during onboarding so the app can greet you and label your household/splits identity. Stored on your device and with your Ruply account on our servers (Section 3).
• Monthly budget and monthly income — optional, used to compute the home-screen budget bar and EMI-to-income ratio. Stored on your device and with your Ruply account on our servers (Section 3).
• Expense data — amount, category, payment method, merchant, date, optional note. Stored on your device and with your Ruply account on our servers (Section 3).
• Receipts you scan — the photo is sent through our AI proxy for one-time text extraction (see Section 4) and then discarded by the proxy. The parsed expense is saved like any other expense — your device and your Ruply account.
• Bank statement PDFs you import — same handling as receipts. Sent through our AI proxy for one-time parsing, never stored by us.
• Friend and household member details — names, emoji avatars, and (if you choose) profile photos. Stored on your device and with your Ruply account. Household members are synced through our household service (Section 5), and splits friends through our splits service (Section 5b).
• Location (optional). If you grant location permission and tap a location for an expense, Ruply stores latitude, longitude, and a human-readable name on that expense record. Location is used only to power the Spending Map in the Analytics tab. It is stored wherever the expense itself is stored — including your Ruply account on our servers — and is never used for anything but showing you your own map. You can revoke location permission anytime in iOS Settings → Ruply → Location.
• Microphone audio (Log by Voice). When you tap the mic, audio is captured on your device and sent through our AI proxy for transcription. The audio file and the transcript are not stored by the proxy after the response is returned. See Section 4 for details.

2.2 Data Apple provides to Ruply

• Your Sign in with Apple identifier. When you sign in with Apple, Apple provides a stable identifier and (on first grant) your name and an email address. We store these locally on your device. From app version 2.3.3, the email address is also stored in a minimal contact record on our server (Section 7b). We use the identifier, only after applying a one-way SHA-256 hash, as the key for your account (Section 7c) and your subscription record (Section 7).
• Apple Push Notification service device token. Used to deliver push notifications to other household members and split friends when you take an action affecting them. The token is held on our splits service alongside your hashed identifier so it can wake your friend's device the moment you share or settle a split (Section 5b and Section 6).

2.3 What we do NOT collect

• We do not collect your bank account number, credit card number, debit card number, CVV, UPI PIN, OTP, or any other financial credential. Ruply does not connect to any bank. The only card detail Ruply keeps is the last 4 digits of a card, and only if you type them in to tell your cards apart.
• We do not collect your contacts list. The "Add from Contacts" picker for friends opens iOS's native picker, and only the friend you tap is stored locally on your device.
• We do not collect your call history, SMS history, browsing history, or any data from other apps. When you share a bank SMS to Ruply, it is read on your phone to fill in the expense; the message itself is not sent to us.
• We do not use cookies, fingerprinting, IDFA, or any cross-app tracking.

2.4 On Android (from version 3.0)

Ruply for Android uses the same account and servers as Ruply for iPhone, and everything else in this policy applies to it. These are the Android-specific details:

• Sign-in. Sign in with Google shares your name, email address and Google account identifier with Ruply (from Google's sign-in token). Like the Apple identifier, the Google identifier is stored only as a one-way SHA-256 hash, and if the verified email matches a Ruply account you already have (for example from iPhone), you sign in to that same account. You can also Sign in with Apple on Android.
• Location (only if you allow it). Used only when you add a place to an expense or open Pick Location. The place name comes from the phone's geocoder, and the map is shown with the Google Maps SDK.
• Microphone (only if you allow it). Once you are signed in, voice logging on Android works as on iPhone: the recording is sent through our AI proxy for transcription and then discarded (Section 4). During first-time setup, before you sign in, Android uses the phone's own speech recognition service (provided by Google) and nothing is sent to Ruply.
• Photos and bills. Ruply has no camera or photo-library permission on Android. Bill scanning uses Google's ML Kit document scanner, and photos come through the system photo picker, so Ruply only receives the image you pick. A scanned bill or an imported bank-statement PDF is sent through our AI proxy for one-time extraction, exactly as on iPhone (Section 4).
• Bank SMS. Ruply has no SMS permission in version 3.0. An SMS is only read when you share or paste it into Ruply, and it is parsed on your phone.
• Notifications. Your daily reminder is scheduled on the phone. For splits, households and account events, Ruply's server sends a message to your phone through Firebase Cloud Messaging (a Google service), using a device token your phone registers with Ruply (Section 6). You can turn notifications off in Android Settings → Apps → Ruply → Notifications.
• App lock uses your phone's biometrics, on the device. Ruply never receives your fingerprint or face data.
• Analytics (from version 3.0.1). Android uses PostHog under the same rules as iPhone (Section 8): no expense amounts, merchants, notes or other financial data, no automatic screen capture or session replay, and you can switch it off in Settings → Data → Help Improve Ruply. Firebase is used only to deliver push messages; there is no Firebase Analytics, no Crashlytics and no TelemetryDeck on Android. Google Play may collect its own app-performance statistics under Google's policies.
• Purchases. Ruply+ on Android is bought through Google Play Billing, processed by RevenueCat on our behalf (Section 7).

3. Where your data lives

From version 2.10, your personal finance data lives with your Ruply account. Here is where it is:

• On servers we operate (on Cloudflare), tied to your Ruply account and a one-way hash of your Apple ID. This is the main copy: signing in with Apple on a new or reset iPhone brings your complete data back. It is encrypted in transit and at rest. It is not end-to-end encrypted — the server must be able to hand your data back to any device you sign into — so we protect it with the same rule as everything else we hold: no one at Ruply reads, accesses, or uses it, and it is never sold, shared, or used to train AI — ever.
• On your device, as a working copy so Ruply is quick and works offline. Anything you change offline is sent to your account when you are back online.
• Earlier versions also synced this data through your iCloud private database. From 2.10, once a phone's data is safely on your account, Ruply stops using iCloud on that phone. What is already in your iCloud stays there, under your Apple ID and your control, until you remove it (iOS Settings → your name → iCloud → Manage Storage).

The data we hold on our servers is: your personal data (above), your household's shared data (Section 5), your splits (Section 5b), a minimal account and contact record (Sections 7b, 7c), your subscription record (Section 7), and anonymous usage analytics (Section 8). Each is stored solely to run that feature. No one at Ruply reads or uses your data, and none of it is ever sold or shared — with anyone, ever.

Two kinds of data live on our servers because they have to reach other people: your household (Section 5) and your splits (Section 5b). Both are held in readable form so the shared features actually work — the server is what keeps every member's balance consistent. No one at Ruply reads or uses this data, and it is never sold or shared.

If you delete the app, your device copy is removed; your data stays with your Ruply account, so signing in again brings everything back. Deleting your account from inside Ruply (Settings → Delete Account & Data) deletes your data from your device and from our servers. Older Ruply data in your iCloud, from before 2.10, can be removed in iOS Settings → your name → iCloud → Manage Storage.

4. AI features and our stateless proxy

A handful of Ruply features use cloud AI: AI Quick Add, Ask Ruply, Receipt Scanning, Bank Statement Import, Money Story, AI Compare, and Log by Voice. These features send a single request to our AI proxy, which is a stateless Cloudflare Worker that:

• Receives your request from the app.
• Adds the secret API key for the AI provider on the server side (so the key never lives in the app binary).
• Forwards the request to the AI provider — Anthropic's Claude for text features, and Sarvam Saaras V3 for multilingual speech-to-text.
• Returns the AI provider's response back to your device.
• Does not store, log, or retain the request or response after the call completes.

What is sent depends on the feature:

• AI Quick Add / Log by Voice: the text you typed or the audio file from the mic, plus a small block of your recent merchants/categories so the model can disambiguate Indian brand names. No expense history is sent.
• Ask Ruply: your question, plus the context needed to answer it — your budget and income, category and payment-method breakdowns, and your most recent transactions (date, amount, merchant name, category). This includes real merchant names, but no identity: no Apple ID, no email, no household or friend identifiers.
• Receipt Scanning / Statement Import: the image or PDF you selected, sent once for parsing, not retained.
• Money Story / AI Compare: spending summaries for the period you requested — totals, category and payment breakdowns, and highlights such as your biggest expense and its merchant. No identity is sent.

What is NOT sent: your Apple ID, your real name (unless you typed it into a note), your email, your phone number, your device identifier, your location, your friend identities, your household member identities, or any data outside the scope of the request you triggered.

Provider sub-processors: Anthropic (Claude) and Sarvam (Saaras V3) process the data they receive under their own privacy and retention policies. Cloudflare provides the network layer for the Worker.

5. Household sharing

If you create or join a Household in Ruply, your household's shared data is stored on a service we operate on Cloudflare. (It moved off Apple's CloudKit Sharing in version 2.5, so households work reliably across everyone's devices — and, in future, across platforms.) What this means:

• We store household-scoped data only: member records, mirrored expense rows (subject to your chosen privacy level), the household budget, shared bills, and shared activity entries. Your personal, non-shared expenses are never part of this.
• Each member is identified only by a one-way hash of their Apple ID — never your real Apple ID, name, or email.
• We store this solely to run the shared-household features you use. No one at Ruply reads, accesses, or uses it, and we never sell or share it with anyone.
• Members can have different privacy levels — Open, Standard, or Private — that control how much of their own spending is visible to other members. You can change this anytime in Settings → Household.
• Infrastructure: the household service runs on Cloudflare Workers with Cloudflare D1 (SQLite). Cloudflare processes data on Ruply's behalf and does not use it for its own purposes.

If you leave a household or the financier dissolves it, your household data is deleted. When you tap Delete Account & Data, your household records tied to your hashed identifier are deleted from our servers.

5b. Splits (server-held)

From app version 2.7.0, splits run on a central service we operate — the server is the single source of truth for split expenses and settlements, and it computes every balance. We moved to this model deliberately: it is what makes balances provably consistent on every phone, lets a friend's change appear instantly, and means your splits survive a lost or new device. Here is exactly what the service holds:

• A SHA-256 hash of your Apple User ID, used as an opaque identifier. It cannot be reversed back to your Apple ID, your name, or your email.
• Your split expenses and settlements, in readable form: amount, description, category, date, who paid, and each participant's share — identified by hashed identifiers.
• The display name, emoji, and UPI ID you chose for splits, so friends see who a split is from.
• Your APNs device token, so a friend's device can be woken the moment you add or settle a split.
• Any friend profile photo you upload — stored as-is and served over an unguessable random URL. Prefer an emoji or initials avatar and nothing is uploaded.
• Connection records linking your hashed identifier to your friends' hashed identifiers.
• Named groups (the Groups tab) are stored the same way as splits — expenses, settlements, and membership in readable form, identified by hashed identifiers. This is what lets group balances stay correct on every phone, update instantly, and survive a lost device. Earlier versions stored group activity as an encrypted event log; that system has been retired (see below).

The promise that matters: this data is stored solely to run Splits. No one at Ruply reads, accesses, or uses it, and it is never sold, shared, or used to train AI — ever.

The splits service does not hold your real name from Apple or your Apple ID. Your personal (non-split) expenses live separately, with your Ruply account as described in Section 3. Encrypted records from earlier systems — the relay-based splits of versions 2.1–2.6 and the encrypted group event log used before version 2.8 — remain stored as ciphertext until deleted and are being retired.

When you delete a split or a settlement, your device instructs the service to delete it for everyone in it. When you tap Delete Account & Data, everything tied to your hashed identifier is deleted from the service.

Infrastructure: the service runs on Cloudflare Workers, with Cloudflare D1 (SQLite) holding split records and metadata, and Cloudflare R2 (object storage) holding friend profile images. Cloudflare processes data on Ruply's behalf and does not use it for its own purposes.

If you do not use Splits, no data is sent to the splits service.

6. Push notifications

Local notifications. Daily reminders, streak nudges, EMI alerts, recurring-expense reminders, and similar prompts are scheduled locally on your device using iOS's notification framework. We do not transmit these to any server.

Push notifications for households and splits. When you take an action affecting another user — joining a household, dissolving it, a financier's subscription ending, settling a split, marking a household expense as paid — Ruply sends a notification to the affected user's device via Apple Push Notification service (APNs). The push request is signed by a Cloudflare Worker using our Apple developer key.

For both splits and households, the recipient's APNs device token is held on our server alongside their hashed identifier, so the server can wake their device when you take an action that affects them. Most notifications only tell your device to fetch the latest data and render the alert itself. Some carry a short alert written by the server, for example who joined your household or what a friend added to a shared split, including its description and amount.

On Android, the same events reach your phone through Firebase Cloud Messaging (Google) instead of APNs. Your Android device token is held on our server with your hashed identifier, in the same way as an iPhone's. The message tells the app what to refresh and, for some events, carries the short alert text that is shown (for example who joined your household, or what a friend added to a shared split). Firebase is used for delivery only.

Notifications can be turned off per-type in iOS Settings → Ruply → Notifications, or as a master switch in Ruply → Settings → Notifications.

7. Subscription verification record

Ruply offers an optional Ruply+ subscription via Apple In-App Purchase on iPhone and Google Play Billing on Android. Android purchases are processed by RevenueCat, which receives your Ruply account identifier (a random ID, not your name or email) and the purchase details from Google Play, and tells our server which plan is active. From October 2026, our server also passes each iPhone purchase record that Apple sends us (Apple's signed transaction, which identifies the product, dates and price, not you) to RevenueCat with the same Ruply account identifier, or a random purchase identifier if you have not signed in, so that subscription reporting covers both stores. Our own server, not RevenueCat, decides whether you have Ruply+ on iPhone. When you subscribe (individual or household), we keep a minimal server-side record so we can verify your entitlement and, for the Household plan, extend Plus to your household members.

This record contains:

• A SHA-256 hash of your Sign in with Apple identifier. The original identifier cannot be recovered from this hash.
• Apple's original transaction ID for the purchase — an opaque Apple identifier for the subscription, not a record of your spending.
• The product you subscribed to (for example, individual monthly or household yearly).
• The date your subscription is paid through, and when the record was last updated by Apple.
• A household identifier (a random UUID generated by your device).
• Apple's environment for the purchase (production or sandbox).

It does not contain your name, email, device identifier, expense data, financial data, or any personally identifying information.

The record is updated when Apple's Server-to-Server Notification V2 webhook reports a subscription state change (renewal, cancellation, billing failure, refund). Its only purpose is to allow Ruply to revoke Plus features promptly across household members when a financier's plan ends, so members are not silently using paid features they no longer have access to.

You can request deletion of this record at any time by emailing mebhargava02@icloud.com. Deletion is also triggered automatically when you tap Delete Account & Data inside Ruply.

7b. Your contact record (email address)

From app version 2.3.3, Ruply keeps one piece of contact information on our server: the email address associated with your Sign in with Apple (which may be a real address or Apple’s private-relay address, depending on what you chose at sign-in).

• What it contains: your email address, keyed by the same one-way SHA-256 hash of your Apple identifier used elsewhere. Nothing else — no name, no expense data, no financial data.
• Why we keep it: so we can reach you about your account, respond when you contact us, and send important service updates. We also send a short product-update email when something worth knowing ships. Every such email carries an unsubscribe link, and the same switch lives in the app under Settings → Notifications → Email me product updates. Account and security mail is separate and is never used for updates.
• What we never do with it: we do not sell it, share it with third parties, or use it for advertising or cross-app tracking.
• Where it lives: in a Cloudflare D1 database operated by Ruply. Cloudflare processes it on our behalf and does not use it for its own purposes.
• Deletion: tapping Delete Account & Data inside Ruply deletes this record automatically. You can also request deletion anytime by emailing mebhargava02@icloud.com.

7c. Your Ruply account (Sign in with Apple)

From app version 2.4, signing in with Apple creates a minimal account on our server. It holds your identity, and from version 2.10 it is also the account your personal data is stored under (Section 3), so your data follows you to any phone you sign in on.

• What it contains: a one-way SHA-256 hash of your Apple identifier (the original cannot be recovered), your email, your name if you provided one, and a randomly generated session token so your device can make authenticated requests. Your expenses and other personal data are stored separately, keyed to this account (Section 3).
• Why it exists: to secure your access and to let your data follow you to any phone you sign in on.
• Where it lives: in a Cloudflare D1 database operated by Ruply. Cloudflare processes it on our behalf and does not use it for its own purposes.
• Deletion: tapping Delete Account & Data inside Ruply deletes this account and its session. You can also request deletion anytime by emailing mebhargava02@icloud.com.

8. App-usage analytics

Ruply uses privacy-respecting analytics to understand which features people use and where the app can be better. On iPhone that is TelemetryDeck (based in Germany) and PostHog (based in the United States); on Android (from version 3.0.1) it is PostHog only. Signals include:

• Feature open counts (e.g., "Money Story opened", "Receipt Scanner opened").
• Session events (e.g., app launched, app backgrounded).
• Product-funnel steps (e.g., a paywall was shown, a subscribe button was tapped) so we can see where people get stuck and fix it.
• Error categories (e.g., "AI request failed: network").

These signals never contain your expenses, monetary amounts, merchant names, notes, budgets, or any financial data. We never send your name, email, or raw Apple ID to an analytics provider.

Separately from those analytics tools, once a day the app sends one line to Ruply's own server about the previous day: how many expenses were logged on this device and their combined total. That line is keyed by a random identifier generated on your device, which is never linked to your account, your Apple identifier, or the hash above. It lets us see how much is logged across all of Ruply on a given day (that single fleet-wide total is also charted in our analytics dashboard); it cannot be traced back to you, and it contains no individual expense, merchant, category, or note. Turning off analytics in Settings also stops this line.

To measure product funnels and retention per person — not just in aggregate — PostHog events are tagged with the same one-way SHA-256 hash of your sign-in identifier (Apple or Google) used elsewhere in this policy, along with a random identifier the PostHog SDK creates when the app is installed. This hash is a pseudonymous key: it cannot be reversed to your Apple ID, name, or email, by us or by PostHog. It lets us answer questions like "how many people who saw the paywall started a trial" and "do people who log daily stick around", so we build the right things. TelemetryDeck signals remain fully anonymous, with no identifier at all.

We never sell this data, use it for advertising, or track you across other apps. Ruply contains no ad SDKs. Analytics providers process data on our behalf under their own privacy and retention policies.

Opting out: turn off Settings → Data → Help Improve Ruply in the app (iPhone and Android) to stop analytics from that phone. Deleting your account (Settings → Delete Account & Data) removes your analytics identity. You can also email mebhargava02@icloud.com with any questions.

9. Backup to iCloud Drive

Ruply automatically writes a weekly encrypted JSON backup of your expense data to your own iCloud Drive in a folder labelled "Ruply". This is your data, in your iCloud, accessible via the Files app. We do not have access to this backup. You can turn automatic backup off in Ruply's backup settings. You can delete the backup files from Files.app at any time.

10. Your rights

You can, at any time and without contacting us:

• View every piece of data Ruply holds about you — it's all in the app.
• Edit any expense, budget, EMI, envelope, split, or household record.
• Export your data as a CSV or as a Google Sheets-compatible file from Settings → Export.
• Delete your entire dataset by tapping Settings → Delete Account & Data. This action wipes the data on your device and deletes everything we hold server-side: your personal data (Section 3), your household and splits data (Sections 5, 5b), your account and contact records (Sections 7b, 7c), and your subscription record (Section 7). It also clears your analytics identity (Section 8). Weekly backup files in your iCloud Drive (Section 9) are yours, and you can delete them from the Files app.

You can also stop using Ruply at any time by deleting the app. Your data stays with your Ruply account until you delete your account from inside the app (Settings → Delete Account & Data), which removes it from our servers.

If you are a resident of a jurisdiction that grants you additional rights under data protection law (e.g., GDPR, India's DPDP Act), you can exercise those rights by emailing mebhargava02@icloud.com.

11. Data retention

Your personal data, your splits, and your household data are retained for as long as your account exists, and are deleted when you delete your account from inside the app.

Two pieces of data have a Ruply-side retention policy:

• The subscription verification record (Section 7), retained while your subscription is active and for 30 days after it lapses, then deleted automatically by a daily cleanup job.
• Your splits records and connection records (Section 5b), retained while the corresponding splits and friend connections exist, and deleted when you delete the split, remove the friend, or tap Delete Account & Data.
• Your account and contact records (Sections 7b, 7c), kept while your account exists and deleted when you tap Delete Account & Data or email us.

12. Changes to this policy

If we change this policy materially, we'll update the date at the top, post the new version at this URL, and surface the change inside the app the next time you open it. Material changes do not take effect retroactively for data already collected.

13. Contact

• For privacy questions, data deletion requests, or anything else:
• Mehul Bhargava
• Email: mebhargava02@icloud.com
• Instagram: @ruply.app
• X: @ruplyapp