Privacy Policy
In short: Your financial data (transactions, accounts, budgets, receipts, FIRE planning) lives on your device. If you allow it, the app also keeps a backup in your own private iCloud; it asks you once and backs up nothing before (change it under Settings › iCloud Backup). We run no servers of our own for the app, have no access to your financial data and use no analytics of our own (what Google processes for the ads in the free version is in section 3.1). Data leaves your device only in these cases:
- Ads (free App Store version only, not with Pro): Google AdMob shows non-personalised banners. Google receives the advertising identifier (IDFA) only if you allow tracking in the iOS prompt.
- Pro purchase: handled by Apple only (App Store). We use no third-party purchase service and receive no purchase data.
- iCloud: the backup runs only if you allow it: the app asks you once, backs up nothing before, and you can change it any time in the settings. Syncing between your devices runs only if you switch it on. Both are stored in your private iCloud at Apple.
- Prices and exchange rates (only when needed): if you have foreign currencies, the app downloads the ECB's public euro reference rates at most once a day. Only when you tap does it look up an ISIN at OpenFIGI, and it asks your own price source only if you connect one. Amounts and quantities are never sent.
- AI (optional): only if you add your own Anthropic key and use an AI feature, the data that feature needs goes directly to Anthropic. The on-device AI (Apple Intelligence) sends nothing; you turn on the phrasing of insights yourself.
- Apple Watch (if you use the watch app): a summary of your figures, such as what is left today, the fixed costs still due this month and your savings rate for the year (as a percentage), goes to your paired watch; no transactions and no IBANs.
- What you send yourself: e-mails to us that you send from your mail app (e.g. "Report format"), files and images you export or share, and Siri requests, which go to Apple under Apple's rules.
1. Controller and contact
The controller under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR) is:
Nikola Marković
Reinach BL
Switzerland
E-mail: support@komovi.ch
Komovi is the name under which Nikola Marković publishes apps as a sole proprietor; "we" and "us" in this policy mean him. This policy covers the FinanzPilot Schweiz app and the komovi.ch website.
Please use this e-mail address for any privacy request. We have not appointed a data protection officer; we are not required to.
2. What data is stored where
2.1 Your financial data stays on the device
Everything you enter or import in FinanzPilot — transactions, accounts, categories and rules, budgets, recurring payments, savings goals, assets, pillar 2/3a, tax and FIRE assumptions, your "About you" answers (municipality, year of birth, civil status, work, church tax and denomination, and in Ticino and Valais, if you choose, your gender), noted expenses (Apple Pay), notes, receipt photos and the text recognised from them — is stored in a database on your device. Imports (CSV, camt XML, PDF statements), receipt text recognition and the on-device AI (Apple Foundation Models; phrasing the insights only if you turn it on) run entirely on the device. We do not receive this data.
The database is part of the normal iPhone/iPad backup (local or Apple's iCloud Backup) so it survives a device change. Before app updates, the app keeps local safety copies on the device. Exports (database, JSON, CSV, PDF), cancellation letters (PDF) and images to share are only created by you; they are made on the device and go through the share sheet wherever you send them.
Also stored on the device: settings (e.g. language, theme, the Focus or Expert view, app lock, reminders), how far you got in the introduction and tips, your "Helpful" / "Off the mark" feedback on insights, your Apple Intelligence choice and a cache of phrased insights, the name and address you enter for a cancellation letter (for your next letter; never in the app's backup, sync or exports), the install date (for the ad rules), your permission to share data with Anthropic (if given) and — if added — your Anthropic API key in the iOS Keychain. Widgets and Siri shortcuts read a summary through a shared app container on the device. Through the same container the Shortcuts action "Note an expense" hands the amount and merchant of an Apple Pay payment to the app; nothing is sent. A link such as finanzpilot://add-expense only opens the "Note this expense?" form; nothing is saved until you tap.
2.2 No analytics or tracking of our own
FinanzPilot contains no analytics or crash-reporting services of our own, no tracking of our own and no user account. No registration is needed. The exception in the free version is Google's ad SDK (section 3.1): it also collects diagnostic, performance and crash data and measures the ads, so the App Privacy section in the App Store also lists these data under the purpose "Analytics". In App Store Connect, Apple gives us aggregated figures without personal reference (e.g. downloads, purchases, countries), plus crash reports and usage statistics only from people who allowed sharing with app developers in iOS (see Apple's privacy policy). In AdMob, Google likewise shows us only aggregated ad figures (e.g. impressions, earnings).
3. Processing by third parties
3.1 Ads: Google AdMob and Google User Messaging Platform
When: Only in the free App Store version, only without FinanzPilot Pro, at the bottom of the app's pages. Never over dialogs, menus or the introduction. Before the first page after the introduction, the Google SDK is not started.
Sequence: (1) Google asks for your consent through its consent platform (UMP) — in the EEA, the United Kingdom and Switzerland; no ads are loaded before that. If you decline, Google may still serve so-called limited ads: according to Google without any personalisation and without a local device identifier; the IP address is still used to deliver the ad, and cookies or local storage only to detect invalid traffic. (2) Only if you agree there (or Google does not need to ask where you are) does iOS then show the App Tracking Transparency (ATT) prompt, once; if you decline on Google's form, the app does not ask about tracking. (3) Only then does the ad SDK start and load a banner.
Non-personalised: Every ad request is flagged as non-personalised. According to Google, such ads are based only on context, such as the approximate location (city). Google does not use advertising identifiers or cookies to target them, but does use them for frequency capping, aggregated ad reporting and to fend off invalid traffic.
What Google receives (according to the privacy manifest in Google's SDK, which our App Store privacy label is based on): IP address and approximate location derived from it, device and system information, a device identifier (see below), interactions with ads (impressions, clicks), advertising data, diagnostic and performance data, and SDK crash data. Google receives the advertising identifier (IDFA) only if you choose "Allow" in the ATT prompt; Apple and Google treat this as "tracking". If you decline, the app and the ads work the same, just without the IDFA; according to Google, the SDK may still use other device identifiers that are limited to one app or developer. Google never receives your financial data.
Withdrawal: You can change or withdraw your consent for Google at any time under Settings → FinanzPilot Pro → Ad consent (Google privacy options). You change the tracking permission under iOS Settings → Privacy & Security → Tracking. With FinanzPilot Pro no ads are shown and the ad SDK is not started.
Provider: Google processes this data as an independent controller; for people in Switzerland and the EEA this is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA). The basis is Google's Controller-Controller Data Protection Terms, which also cover the Swiss FADP. Privacy: policies.google.com/privacy · How Google uses data from partner apps: policies.google.com/technologies/partner-sites · AdMob data disclosure: developers.google.com/admob/ios/privacy/data-disclosure.
3.2 FinanzPilot Pro: Apple App Store
Purchases (yearly subscription and one-time purchase) are handled exclusively by Apple through the App Store; we receive no payment data. The app checks whether Pro is active directly on your device with Apple's StoreKit: Apple signs every transaction and iOS verifies the signature locally. The app sends no purchase or transaction data to us or to anyone else; there is no third-party purchase service and we keep no purchase statistics. "Restore purchases" asks Apple for your purchases. In Switzerland, Apple Distribution International Ltd. (Ireland) sells the app and Pro in its own name on our behalf (as commissionaire) and processes the purchase data as an independent controller, governed by Apple's privacy policy.
Apple: apple.com/legal/privacy.
3.3 iCloud Backup and iCloud Sync (both optional)
If you allow it, iCloud Backup stores a copy of the database (including receipt photos) about once a day in the private CloudKit database of your own iCloud account. The app asks you once (when you set it up, or once after the update to version 3.2); until you say yes, nothing is backed up. You can change it any time under Settings › iCloud Backup. If you switch it off, the copy stays in iCloud until you delete it (section 9). With iCloud Sync, every row is stored individually in your private iCloud; the content sits in encrypted fields that are encrypted on the device. Technical details such as the table name, change time and size remain readable to Apple. Receipt photos and PDFs are stored by the sync as files (CloudKit assets) in the same private database; CloudKit always stores them encrypted. Noted expenses (Apple Pay) are not synced; they stay on the device where you noted them. Apple always stores app data in iCloud encrypted. Backup and sync are end-to-end encrypted, i.e. without keys at Apple, if you have switched on Advanced Data Protection for iCloud. This data is held by Apple in your account; we have no access to it. Apple's processing is governed by your agreement with Apple and Apple's privacy policy.
3.4 AI features: on the device and, optionally, with your own Anthropic key
The on-device AI (Apple Foundation Models) sends nothing — neither to us nor to Apple. It phrases the insights and the month in review from figures the app computes itself, but only if you turn this on under Settings › AI; with FinanzPilot Pro it answers questions about your finances that you ask it. If you additionally add your own Anthropic API key and use an AI feature (Copilot chat, AI categorisation, monthly briefing), the app sends the data needed for it directly from your device to the Anthropic API — for example your question, transaction descriptions, amounts, categories or monthly totals, and for the Copilot your canton (so tax answers fit), not your municipality. The app first replaces IBANs, account and card numbers with placeholders (card numbers keep at most their last four digits). Before the first such request the app asks you explicitly whether it may send data to Anthropic; nothing is sent unless you tap "Allow", and you can withdraw the permission in the AI section of the settings at any time. We are not in between and receive nothing. The contractual relationship is between you and Anthropic; Anthropic's Commercial Terms, its data processing addendum and its privacy policy apply. Anthropic also processes the data in the USA; the app asks for your explicit consent before. According to Anthropic, data sent through the API is not used for training by default and is deleted within 30 days at the latest (exceptions include violations of Anthropic's usage policies).
Provider: for customers in Switzerland Anthropic Ireland, Limited, Ireland (parent company: Anthropic PBC, USA). Privacy: anthropic.com/legal/privacy.
3.5 Market data and exchange rates
The iOS app does not fetch share prices from a market-data provider; you enter prices yourself, and "See price" opens the SIX Swiss Exchange or fund provider page in your browser. If you hold accounts or securities in a foreign currency, the app downloads the European Central Bank's public euro reference-rate file at most once a day (ECB, Frankfurt am Main, Germany); nothing about you is sent, and like any website the ECB sees your device's IP address. You can switch this off under Settings → Exchange rates. Only when you tap "Look up online" for an unknown ISIN does the app send that one ISIN to OpenFIGI (Bloomberg Finance L.P., USA) to get the name and ticker – no amounts, holdings or identifiers; OpenFIGI sees your device's IP address (privacy: openfigi.com/docs/privacy-policy). If you choose to connect your own price source under Settings → Advanced · Prices, the app sends the symbol or ISIN (and your own key, if you added one) directly to that address at most once a day per holding, never amounts; we are not involved and receive nothing, and that provider's terms apply. (Only the separate, self-hosted server version asks Yahoo Finance for prices of your ticker symbols and, on request, searches it for an ISIN – without personal data; there, you are the operator.)
4. This website and e-mail
4.1 Hosting and server logs
This website is hosted by our hosting provider hosttech GmbH (Switzerland; servers in Switzerland), which runs it on our behalf. On every request the web server stores technically necessary data in server logs: IP address, date and time, page requested, status code and amount of data transferred, the referring page (referrer) and browser and operating system (user agent). This is needed to deliver the site, find errors and fend off abuse.
4.2 Access statistics from the server logs
From these server logs the hosting automatically creates access statistics (Webalizer), e.g. page views per day, most visited pages, referring websites, browsers and countries of origin. The statistics can also list the IP addresses or host names of the most frequent visitors. We use them only to see how the website is used overall and to spot errors. We do not combine them with other data and create no profiles. No cookies and no scripts are used for this.
4.3 Google Search Console
We registered the website with Google Search Console to see how it appears in Google Search. No Google code is embedded on this website for this; Google receives no data from us when you visit this website. Google shows us only aggregated figures on search queries, impressions and clicks in Google Search. What Google processes when you use Google Search is governed by Google's privacy policy.
4.4 No cookies, no third-party content
This website sets no cookies, uses no analytics or tracking scripts and loads no fonts, images or videos from third parties. There are no forms, accounts or newsletters on this website.
4.5 E-mail and support
If you e-mail us (also via "Report a problem", "Report format" or "Report ad" in the app), we process your e-mail address, your name (if given), the content and the technical details included in the prepared e-mail (e.g. app version, iOS version, current screen; for "Report format", details about the file and its column names, no bookings). It is only sent when you send it from your mail app. We use them only to answer your request and fix errors. The mailbox is hosted by hosttech in Switzerland. Please never send us bank statements, bank files or backups with real data.
5. Purposes and legal bases
| Processing | Purpose | Legal basis (GDPR) |
|---|---|---|
| Ads (Google AdMob/UMP) | Funding the free version with non-personalised ads; measurement, frequency capping, fraud prevention | Consent (Art. 6(1)(a)), collected through Google's consent message; advertising ID only with ATT permission. Limited ads after you decline and where Google does not require consent: legitimate interest in funding the free version (Art. 6(1)(f)) |
| Pro purchase (Apple App Store) | Processing the purchase, unlocking Pro, restoring purchases | Performance of a contract (Art. 6(1)(b)) |
| iCloud Backup/Sync | Backing up and syncing your devices at your request | Performance of a contract (Art. 6(1)(b)); processing by Apple in your own account |
| AI with your own key | Answers, categorisation, briefings at your request | Performance of a contract (Art. 6(1)(b)); transfer initiated by you |
| Exchange rates (ECB), Look up online (OpenFIGI), own price source | Converting foreign currencies; name and ticker for an ISIN; prices from your source | ECB: legitimate interest in current exchange rates for your foreign currencies (Art. 6(1)(f)); can be switched off. OpenFIGI and own price source: performance of a contract (Art. 6(1)(b)); transfer initiated by you |
| Website (server logs, access statistics, Search Console) | Delivering and securing the website; spotting errors; seeing how the website is used and found overall | Legitimate interest (Art. 6(1)(f)) |
| Support requests | Answering your request | Contract or legitimate interest (Art. 6(1)(b)/(f)) |
Under the Swiss FADP we process personal data in line with the principles of Art. 6 FADP; where consent is required, we ask for it. The app is only available in the Swiss App Store and is aimed at people in Switzerland; the GDPR details in the table apply only where the GDPR applies in an individual case.
No automated individual decisions, no profiling by us: we make no decisions based solely on automated processing that have legal effects on you or significantly affect you (Art. 21 FADP). The app's calculations (e.g. categorisation, budget, FIRE projection) run on your device and serve only you.
6. Recipients and transfers abroad
We do not sell personal data and do not pass on financial data. Only these recipients receive personal data:
- hosttech GmbH, Richterswil, Switzerland: hosting of the website and the e-mail mailbox, on our behalf; data in Switzerland.
- Google: Google Ireland Limited, Ireland, and Google LLC, USA: ads (section 3.1) and Search Console (4.3).
- Apple: Apple Distribution International Ltd., Ireland, and Apple Inc., USA: App Store, purchases and iCloud (3.2, 3.3).
- Anthropic: Anthropic Ireland, Limited, Ireland, and Anthropic PBC, USA: only if you use AI with your own key, at your initiative (3.4).
- European Central Bank (ECB), Frankfurt am Main, Germany: the technical connection data when the app loads exchange rates (3.5).
- Bloomberg Finance L.P. (OpenFIGI), USA: the one ISIN and the technical connection data, only when you tap "Look up online" (3.5).
- Your own price source (if connected): symbols or ISINs, sent to the address you entered (3.5).
Countries and safeguards: data may go to Switzerland, Ireland and Germany (EU) and the USA; Google and Apple also run data centres in other countries (see their privacy policies). Under Annex 1 of the Swiss Data Protection Ordinance (DPO), the EU offers adequate data protection. Since 15 September 2024 the USA is adequate only for companies certified under the Swiss-U.S. Data Privacy Framework: for Google LLC and for Bloomberg Finance L.P. (OpenFIGI; certified as part of Bloomberg L.P.) the transfer relies on that certification. Apple and Anthropic say they base transfers to the USA on the European Commission's standard contractual clauses with the adaptations required for Switzerland, recognised by the FDPIC (Art. 16(2)(d) FADP). For transfers to Anthropic, the app also asks for your explicit consent (Art. 17(1)(a) FADP). The app sends the ISIN to OpenFIGI (USA) only when you tap; apart from the technical connection data, the request contains nothing about you. Your own price source receives its requests wherever the provider you chose runs it.
7. Retention
- Data on the device: until you delete it (see section 9) or remove the app. Local safety copies: the five most recent.
- iCloud: until you delete the backup or the sync data, or remove them in your iCloud settings.
- Google, Apple, Anthropic, the ECB, Bloomberg (OpenFIGI) and your own price source: according to their privacy policies. Purchase data is kept only by Apple (in your Apple Account) and by StoreKit on your device; we keep none.
- Support e-mails: until the request is resolved, at most two years, unless the law requires longer retention.
- Website server logs: according to the hosting provider, usually a few days to weeks; then they are deleted.
- Access statistics (Webalizer): as a monthly summary for as long as the hosting exists.
- Search Console: aggregated figures according to Google (currently about 16 months).
8. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability / handover, the right to object to processing and the right to withdraw any consent at any time with effect for the future. Because we hold none of your financial data, you can exercise most of these rights directly in the app (export and deletion, see below). For everything else, an e-mail to support@komovi.ch is enough; we usually reply within 30 days and may ask you to confirm your identity. Questions about purchases and refunds are answered by Apple (reportaproblem.apple.com), as we hold no purchase data.
You can lodge a complaint with a supervisory authority — in Switzerland the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch), in the EU the authority of your country of residence.
9. How to delete your data
- Everything on the device: Settings → Export data → Delete all data (deletes transactions, accounts, budgets, receipt photos and settings on this device). Or delete the app.
- iCloud Sync: Settings → iCloud Sync → Delete sync data in iCloud (entries and receipt photos).
- iCloud Backup: switch the backup off in the app settings and remove FinanzPilot's data under iOS Settings → [your name] → iCloud → Manage Storage.
- AI key: remove it in the AI section of the settings; revoke the key itself in the Anthropic console.
- Ads: withdraw consent as described in section 3.1; switching off tracking in iOS stops the advertising ID being shared.
- Exports you saved or shared yourself are deleted wherever you stored them.
10. Children
FinanzPilot is aimed at adults planning their personal finances. We do not knowingly process data of children.
11. Security
The app can be locked with Face ID / Touch ID; keys are kept in the iOS Keychain. All connections to the services named above are encrypted (HTTPS). Because your data lives on your device, its protection also depends on the security of your device and your Apple account.
12. Changes
We update this policy when the app or the law changes. The version published here applies; we mention material changes in the app's release notes.