Privacy Policy

Last updated: August 23, 2026

Introduction

Ruply ("we", "us", "Ruply") is a personal expense tracker built and operated by Mehul Bhargava, an independent developer based in India. We've built Ruply with one principle that everything else flows from: your money data belongs to you, and nobody else needs a copy of it.

This Privacy Policy explains, in plain language, what data Ruply handles, where it lives, and what you can do about it. We've tried to keep it short. If anything here is unclear, email mebhargava02@icloud.com.

1. The short version

• Your personal finance data — expenses, budgets, income, EMIs, envelopes, categories — lives on your iPhone and in your own iCloud, and from version 2.9.1 is also backed up, encrypted, to Ruply's own servers — so signing in with Apple on any iPhone brings everything back. It is stored solely for backup and restore. No one at Ruply reads, accesses, or uses your data, and we never sell or share it with anyone, ever.
• Data you share with other people — your household and your splits — is stored on our own servers so it can reach them. It is stored solely to run those features. No one at Ruply reads, accesses, or uses your data, and we never sell or share it with anyone, ever.
• Splits are stored on our servers in readable form — that is what lets balances stay correct on every phone, update instantly, and survive a lost device. They are stored solely to run Splits. No one at Ruply reads, accesses, or uses them, and they are never sold or shared.
• We keep a minimal account for you, created when you Sign in with Apple. It holds only your identity — a one-way hash of your Apple ID, your email, and your name — never your financial data. It exists so your access stays secure and so we can reach you about your account. See Sections 7b and 7c.
• A few features rely on external services (Apple Push Notifications, our stateless AI proxy, anonymous app-usage analytics, our minimal subscription-verification record). Each is described below.
• You can delete everything we hold about you, from inside the app, at any time.

2. Data we handle

2.1 Data you provide directly

• Your name — captured during onboarding so the app can greet you and label your household/splits identity. Stored on your device, in your iCloud, and in your encrypted Ruply backup.
• Monthly budget and monthly income — optional, used to compute the home-screen budget bar and EMI-to-income ratio. Stored on your device, in your iCloud, and in your encrypted Ruply backup.
• Expense data — amount, category, payment method, merchant, date, optional note. Stored on your device, in your iCloud, and in your encrypted Ruply backup.
• Receipts you scan — the photo is sent through our AI proxy for one-time text extraction (see Section 4) and then discarded by the proxy. The parsed expense is saved like any other expense — your device, your iCloud, your encrypted Ruply backup.
• Bank statement PDFs you import — same handling as receipts. Sent through our AI proxy for one-time parsing, never stored by us.
• Friend and household member details — names, emoji avatars, and (if you choose) profile photos. Stored in your iCloud. Household members are synced via Apple's CloudKit Sharing (Section 5). Splits friends are also delivered to the friend's device through our splits service (Section 5b).
• Location (optional). If you grant location permission and tap a location for an expense, Ruply stores latitude, longitude, and a human-readable name on that expense record in your iCloud. Location is used only to power the Spending Map in the Analytics tab. It is stored wherever the expense itself is stored — including your encrypted Ruply backup — and is never used for anything but showing you your own map. You can revoke location permission anytime in iOS Settings → Ruply → Location.
• Microphone audio (Log by Voice). When you tap the mic, audio is captured on your device and sent through our AI proxy for transcription. The audio file and the transcript are not stored by the proxy after the response is returned. See Section 4 for details.

2.2 Data Apple provides to Ruply

• Your Sign in with Apple identifier. When you sign in with Apple, Apple provides a stable identifier and (on first grant) your name and an email address. We store these locally on your device. From app version 2.3.3, the email address is also stored in a minimal contact record on our server (Section 7b). We use the identifier only as a key for the subscription-verification record described in Section 4, and only after applying a one-way SHA-256 hash.
• Apple Push Notification service device token. Used to deliver push notifications to other household members and split friends when you take an action affecting them. The token is held on our splits service alongside your hashed identifier so it can wake your friend's device the moment you share or settle a split (Section 5b and Section 6).

2.3 What we do NOT collect

• We do not collect your bank account number, credit card number, debit card number, CVV, UPI PIN, OTP, or any other financial credential. Ruply does not connect to any bank.
• We do not collect your contacts list. The "Add from Contacts" picker for friends opens iOS's native picker, and only the friend you tap is stored locally on your device.
• We do not collect your call history, SMS history, browsing history, or any data from other apps.
• We do not use cookies, fingerprinting, IDFA, or any cross-app tracking.

3. Where your data lives

Ruply keeps your personal finance data local-first. It is stored in three places:

• Locally on your device using Apple's Core Data framework.
• In your iCloud private database, synced automatically via Apple's NSPersistentCloudKitContainer. iCloud data is end-to-end encrypted between your devices and tied to your Apple ID. It is stored in Apple's data centres under your Apple ID, not under any Ruply account.
• From version 2.9.1, in an encrypted backup on servers we operate (on Cloudflare), keyed to a one-way hash of your Apple ID. This backup exists for exactly one reason: so that signing in with Apple on a new or reset iPhone brings your complete data back, with or without iCloud. It is encrypted in transit and at rest. It is not end-to-end encrypted — the server must be able to hand your data back to any device you sign into — so we protect it with the same rule as everything else we hold: no one at Ruply reads, accesses, or uses it, and it is never sold, shared, or used to train AI — ever.

The data we hold on our servers is: your encrypted personal-data backup (above), your household's shared data (Section 5), your splits (Section 5b), a minimal account and contact record (Sections 7b, 7c), your subscription record (Section 7), and anonymous usage analytics (Section 8). Each is stored solely to run that feature. No one at Ruply reads or uses your data, and none of it is ever sold or shared — with anyone, ever.

Two kinds of data live on our servers because they have to reach other people: your household (Section 5) and your splits (Section 5b). Both are held in readable form so the shared features actually work — the server is what keeps every member's balance consistent. No one at Ruply reads or uses this data, and it is never sold or shared.

If you delete the app, your local copy is removed; your iCloud copy and your Ruply backup remain, so signing in again brings everything back. Deleting your account from inside Ruply (Settings → Delete Account & Data) removes all three: device, iCloud, and our servers.

4. AI features and our stateless proxy

A handful of Ruply features use cloud AI: AI Quick Add, Ask Ruply, Receipt Scanning, Bank Statement Import, Money Story, AI Compare, and Log by Voice. These features send a single request to our AI proxy, which is a stateless Cloudflare Worker that:

• Receives your request from the app.
• Adds the secret API key for the AI provider on the server side (so the key never lives in the app binary).
• Forwards the request to the AI provider — Anthropic's Claude for text features, and Sarvam Saaras V3 for multilingual speech-to-text.
• Returns the AI provider's response back to your device.
• Does not store, log, or retain the request or response after the call completes.

What is sent depends on the feature:

• AI Quick Add / Log by Voice: the text you typed or the audio file from the mic, plus a small block of your recent merchants/categories so the model can disambiguate Indian brand names. No expense history is sent.
• Ask Ruply: your question, plus the context needed to answer it — your budget and income, category and payment-method breakdowns, and your most recent transactions (date, amount, merchant name, category). This includes real merchant names, but no identity: no Apple ID, no email, no household or friend identifiers.
• Receipt Scanning / Statement Import: the image or PDF you selected, sent once for parsing, not retained.
• Money Story / AI Compare: spending summaries for the period you requested — totals, category and payment breakdowns, and highlights such as your biggest expense and its merchant. No identity is sent.

What is NOT sent: your Apple ID, your real name (unless you typed it into a note), your email, your phone number, your device identifier, your location, your friend identities, your household member identities, or any data outside the scope of the request you triggered.

Provider sub-processors: Anthropic (Claude) and Sarvam (Saaras V3) process the data they receive under their own privacy and retention policies. Cloudflare provides the network layer for the Worker.

5. Household sharing

If you create or join a Household in Ruply, your household's shared data is stored on a service we operate on Cloudflare. (It moved off Apple's CloudKit Sharing in version 2.5, so households work reliably across everyone's devices — and, in future, across platforms.) What this means:

• We store household-scoped data only: member records, mirrored expense rows (subject to your chosen privacy level), the household budget, shared bills, and shared activity entries. Your personal, non-shared expenses are never part of this.
• Each member is identified only by a one-way hash of their Apple ID — never your real Apple ID, name, or email.
• We store this solely to run the shared-household features you use. No one at Ruply reads, accesses, or uses it, and we never sell or share it with anyone.
• Members can have different privacy levels — Open, Standard, or Private — that control how much of their own spending is visible to other members. You can change this anytime in Settings → Household.
• Infrastructure: the household service runs on Cloudflare Workers with Cloudflare D1 (SQLite). Cloudflare processes data on Ruply's behalf and does not use it for its own purposes.

If you leave a household or the financier dissolves it, your household data is deleted. When you tap Delete Account & Data, your household records tied to your hashed identifier are deleted from our servers.

5b. Splits (server-held)

From app version 2.7.0, splits run on a central service we operate — the server is the single source of truth for split expenses and settlements, and it computes every balance. We moved to this model deliberately: it is what makes balances provably consistent on every phone, lets a friend's change appear instantly, and means your splits survive a lost or new device. Here is exactly what the service holds:

• A SHA-256 hash of your Apple User ID, used as an opaque identifier. It cannot be reversed back to your Apple ID, your name, or your email.
• Your split expenses and settlements, in readable form: amount, description, category, date, who paid, and each participant's share — identified by hashed identifiers.
• The display name, emoji, and UPI ID you chose for splits, so friends see who a split is from.
• Your APNs device token, so a friend's device can be woken the moment you add or settle a split.
• Any friend profile photo you upload — stored as-is and served over an unguessable random URL. Prefer an emoji or initials avatar and nothing is uploaded.
• Connection records linking your hashed identifier to your friends' hashed identifiers.
• Named groups (the Groups tab) are stored the same way as splits — expenses, settlements, and membership in readable form, identified by hashed identifiers. This is what lets group balances stay correct on every phone, update instantly, and survive a lost device. Earlier versions stored group activity as an encrypted event log; that system has been retired (see below).

The promise that matters: this data is stored solely to run Splits. No one at Ruply reads, accesses, or uses it, and it is never sold, shared, or used to train AI — ever.

The splits service does not hold your real name from Apple or your Apple ID. Your personal (non-split) expenses live separately, in the encrypted backup described in Section 3. Encrypted records from earlier systems — the relay-based splits of versions 2.1–2.6 and the encrypted group event log used before version 2.8 — remain stored as ciphertext until deleted and are being retired.

When you delete a split or a settlement, your device instructs the service to delete it for everyone in it. When you tap Delete Account & Data, everything tied to your hashed identifier is deleted from the service.

Infrastructure: the service runs on Cloudflare Workers, with Cloudflare D1 (SQLite) holding split records and metadata, and Cloudflare R2 (object storage) holding friend profile images. Cloudflare processes data on Ruply's behalf and does not use it for its own purposes.

If you do not use Splits, no data is sent to the splits service.

6. Push notifications

Local notifications. Daily reminders, streak nudges, EMI alerts, recurring-expense reminders, and similar prompts are scheduled locally on your device using iOS's notification framework. We do not transmit these to any server.

Push notifications for households and splits. When you take an action affecting another user — joining a household, dissolving it, a financier's subscription ending, settling a split, marking a household expense as paid — Ruply sends a notification to the affected user's device via Apple Push Notification service (APNs). The push request is signed by a Cloudflare Worker using our Apple developer key.

For both splits and households, the recipient's APNs device token is held on our server alongside their hashed identifier, so the server can wake their device when you take an action that affects them. Notification payloads carry no plaintext expense content — your device fetches the record and renders the alert locally.

Notifications can be turned off per-type in iOS Settings → Ruply → Notifications, or as a master switch in Ruply → Settings → Notifications.

7. Subscription verification record

Ruply offers an optional Ruply+ subscription via Apple In-App Purchase. When you subscribe (individual or household), we keep a minimal server-side record so we can verify your entitlement and, for the Household plan, extend Plus to your household members.

This record contains:

• A SHA-256 hash of your Sign in with Apple identifier. The original identifier cannot be recovered from this hash.
• Apple's original transaction ID for the purchase — an opaque Apple identifier for the subscription, not a record of your spending.
• The product you subscribed to (for example, individual monthly or household yearly).
• The date your subscription is paid through, and when the record was last updated by Apple.
• A household identifier (a random UUID generated by your device).
• Apple's environment for the purchase (production or sandbox).

It does not contain your name, email, device identifier, expense data, financial data, or any personally identifying information.

The record is updated when Apple's Server-to-Server Notification V2 webhook reports a subscription state change (renewal, cancellation, billing failure, refund). Its only purpose is to allow Ruply to revoke Plus features promptly across household members when a financier's plan ends, so members are not silently using paid features they no longer have access to.

You can request deletion of this record at any time by emailing mebhargava02@icloud.com. Deletion is also triggered automatically when you tap Delete Account & Data inside Ruply.

7b. Your contact record (email address)

From app version 2.3.3, Ruply keeps one piece of contact information on our server: the email address associated with your Sign in with Apple (which may be a real address or Apple’s private-relay address, depending on what you chose at sign-in).

• What it contains: your email address, keyed by the same one-way SHA-256 hash of your Apple identifier used elsewhere. Nothing else — no name, no expense data, no financial data.
• Why we keep it: so we can reach you about your account, respond when you contact us, and send important service updates. We may occasionally share product news; you can ask us to stop at any time.
• What we never do with it: we do not sell it, share it with third parties, or use it for advertising or cross-app tracking.
• Where it lives: in a Cloudflare D1 database operated by Ruply. Cloudflare processes it on our behalf and does not use it for its own purposes.
• Deletion: tapping Delete Account & Data inside Ruply deletes this record automatically. You can also request deletion anytime by emailing mebhargava02@icloud.com.

7c. Your Ruply account (Sign in with Apple)

From app version 2.4, signing in with Apple creates a minimal account on our server. It holds identity only — never your financial data — and exists to keep your access secure and, in future, to let your data follow you across devices and platforms.

• What it contains: a one-way SHA-256 hash of your Apple identifier (the original cannot be recovered), your email, your name if you provided one, and a randomly generated session token so your device can make authenticated requests. Nothing else — no expenses, no budgets, no financial data.
• Why it exists: to secure your access to your account and to lay the groundwork for cross-device and future cross-platform support. Your money data lives on your device, in your iCloud, and in your encrypted Ruply backup (Section 3); the account is what lets that backup follow you to a new iPhone.
• Where it lives: in a Cloudflare D1 database operated by Ruply. Cloudflare processes it on our behalf and does not use it for its own purposes.
• Deletion: tapping Delete Account & Data inside Ruply deletes this account and its session. You can also request deletion anytime by emailing mebhargava02@icloud.com.

8. App-usage analytics

Ruply uses two privacy-respecting analytics tools to understand which features people use and where the app can be better: TelemetryDeck (based in Germany) and PostHog (based in the United States). Signals include:

• Feature open counts (e.g., "Money Story opened", "Receipt Scanner opened").
• Session events (e.g., app launched, app backgrounded).
• Product-funnel steps (e.g., a paywall was shown, a subscribe button was tapped) so we can see where people get stuck and fix it.
• Error categories (e.g., "AI request failed: network").

These signals never contain your expenses, monetary amounts, merchant names, notes, budgets, or any financial data. We never send your name, email, or raw Apple ID to an analytics provider.

To measure product funnels and retention per person — not just in aggregate — PostHog events are tagged with the same one-way SHA-256 hash of your Apple identifier used elsewhere in this policy. This hash is a pseudonymous key: it cannot be reversed to your Apple ID, name, or email, by us or by PostHog. It lets us answer questions like "how many people who saw the paywall started a trial" and "do people who log daily stick around", so we build the right things. TelemetryDeck signals remain fully anonymous, with no identifier at all.

We never sell this data, use it for advertising, or track you across other apps. Ruply contains no ad SDKs. Analytics providers process data on our behalf under their own privacy and retention policies.

Opting out: deleting your account (Settings → Delete Account & Data) removes your analytics identity. You can also email mebhargava02@icloud.com to opt out of analytics collection entirely.

9. Backup to iCloud Drive

Ruply automatically writes a weekly encrypted JSON backup of your expense data to your own iCloud Drive in a folder labelled "Ruply". This is your data, in your iCloud, accessible via the Files app. We do not have access to this backup. You can disable automatic backup in Settings → iCloud & Backup. You can delete the backup files from Files.app at any time.

10. Your rights

You can, at any time and without contacting us:

• View every piece of data Ruply holds about you — it's all in the app.
• Edit any expense, budget, EMI, envelope, split, or household record.
• Export your data as a CSV or as a Google Sheets-compatible file from Settings → Export.
• Delete your entire dataset by tapping Settings → Delete Account & Data. This action wipes your local Core Data store, your iCloud Ruply database, and your iCloud Drive backups, and deletes everything we hold server-side: your splits data (Section 5b), your account and contact records (Sections 7b, 7c), and your subscription record (Section 7). It also clears your analytics identity (Section 8).

You can also stop using Ruply at any time by deleting the app. Your iCloud copy remains under your control in Apple's storage management, and your Ruply backup stays until you delete your account from inside the app (Settings → Delete Account & Data), which removes it from our servers.

If you are a resident of a jurisdiction that grants you additional rights under data protection law (e.g., GDPR, India's DPDP Act), you can exercise those rights by emailing mebhargava02@icloud.com.

11. Data retention

Your iCloud data is retained for as long as you keep it; you control its lifecycle through Apple. Your Ruply backup, your splits, and your household data are retained for as long as your account exists, and are deleted when you delete your account from inside the app.

Two pieces of data have a Ruply-side retention policy:

• The subscription verification record (Section 7), retained while your subscription is active and for 30 days after it lapses, then deleted automatically by a daily cleanup job.
• Your splits records and connection records (Section 5b), retained while the corresponding splits and friend connections exist, and deleted when you delete the split, remove the friend, or tap Delete Account & Data.
• Your account and contact records (Sections 7b, 7c), kept while your account exists and deleted when you tap Delete Account & Data or email us.

12. Changes to this policy

If we change this policy materially, we'll update the date at the top, post the new version at this URL, and surface the change inside the app the next time you open it. Material changes do not take effect retroactively for data already collected.

13. Contact

• For privacy questions, data deletion requests, or anything else:
• Mehul Bhargava
• Email: mebhargava02@icloud.com
• Instagram: @ruply.app
• X: @ruplyapp