Privacy Policy

Article 1. Purposes of Processing

Donup processes information as necessary to authenticate members through Apple or Google, create and synchronize personal finance entries across devices, manage budgets, recurring expenses, and payment methods, provide AI-assisted entry and the DonWorry AI financial assistant, and verify Donup Pro entitlements.

If these purposes change, Donup will provide notice in the app or through an updated Privacy Policy.

Article 2. Information Processed

Account and sign-in information: Supabase user ID, sign-in provider (Apple or Google), the provider's unique subject identifier, email address, name, and other account information the provider permits, linked sign-in methods, and a hashed identifier used to prevent duplicate migration of the same CloudKit source.

Information entered directly by the user: income and expense entries, amounts, currency and exchange-rate information, dates, categories, payment methods, notes, recurring expenses, budgets, assets and liabilities, settings, and display preferences.

Information optionally attached by the user: receipt or transaction photos, captured images, documents, spreadsheets, and information included in an attachment analysis request.

DonWorry conversation records: questions, attachment names and formats, response summaries, response blocks, chart data, related questions, and creation times.

Payment-message candidates: source text, sender, merchant, amount, transaction time, and save status that the user supplies through the app or an automation.

Purchase-entitlement information: App Store or Google Play product ID, purchase type, status, environment and timestamps; transaction, original-transaction, order, and account-link identifiers; verification-data hashes; and an encrypted Google Play purchase token needed for server re-verification.

Device and usage information: app version, OS version, synchronization device ID, IP address, request and response times and status, error information, data modification times, and a random or hashed identifier and request state used for AI request limits.

Donup does not collect payment card numbers, financial-account login credentials, advertising identifiers, location data, contacts, health information, Korean resident registration numbers, or other government-issued unique identifiers.

Article 3. Retention and Use Period

Personal finance data, preferences, payment-message candidates, DonWorry conversations, and attachments synchronized to Supabase may be retained until the user deletes the item or the Donup account. When an item is deleted, its content is removed, but a minimal identifier and deletion timestamp may remain as a synchronization tombstone until account deletion so other devices receive the deletion.

Recoverable copies of deleted personal finance entries and their images are retained for up to 30 days or the most recent 200 records, whichever limit is reached first. They are removed earlier if the user clears recovery records or deletes the account.

Existing CloudKit data may be copied into the signed-in Donup account's Supabase database and private file storage. The previous iCloud CloudKit copy may not be deleted automatically after migration and may need to be removed separately through iCloud storage management.

When Donup account deletion completes, Supabase Auth membership data, synchronized data, attachments, and purchase-entitlement verification data held by Donup are deleted from active systems. Local copies or exports on the user's devices, original purchase records held by Apple or Google, and a CloudKit copy left after migration must be deleted separately. Copies remaining in security or disaster-recovery backups are isolated from ordinary service and destroyed according to the backup rotation cycle.

AI requests and responses sent to the OpenAI API may be retained under default settings for up to 30 days as abuse-monitoring logs. Cerebras states that it does not retain AI inference inputs and outputs after providing a response, while service-operation logs may be processed for as long as necessary to provide the service.

DonWorry conversation records can be deleted through the conversation-history deletion feature in the app or by deleting the Donup account.

Article 4. Disclosure to Third Parties

Donup does not sell or disclose personal information to third parties except with the user's consent or when required or permitted by law.

When an external provider processes information on Donup's instructions to provide the service, that processing is disclosed under Service Providers and International Transfers below. The respective terms and privacy policies also apply to the user's direct use of an Apple or Google account and store.

Article 5. Service Providers

Supabase, Inc.: member authentication, per-user database and private file storage, multi-device synchronization, account deletion, purchase-entitlement verification and linking, AI request routing, and request-limit processing.

OpenAI OpCo, LLC: user-requested analysis of text, images, documents, and spreadsheets, and generation of personal-finance drafts and DonWorry responses.

Cerebras Systems Inc.: user-requested analysis of text and images and generation of personal-finance or asset drafts.

Apple Inc.: Sign in with Apple authentication, App Store payments, purchase restoration and transaction verification, migration of existing iCloud CloudKit data, and operating-system features such as speech recognition, camera access, and photo selection.

Google LLC: Google sign-in authentication and Google Play payments, purchase restoration, and transaction verification.

Article 6. International Transfers

Supabase, Inc. ([email protected]): account and sign-in information, personal-finance data, preferences, DonWorry conversations, attachments, purchase-entitlement information, and technical information are transferred to Singapore. Transfers occur over encrypted networks when the user creates an account, signs in, synchronizes, uploads an attachment, or requests a server feature. The information is processed for authentication, database, private storage, synchronization, and server features until the user deletes the item or account.

OpenAI OpCo, LLC ([email protected]): when the user runs an AI feature or enabled automatic advice requests analysis after permission, entered text, selected or captured images, documents or spreadsheets, questions, necessary structured personal-finance context, reference time, time zone, and category candidates are encrypted in transit to the United States. The information is processed to generate analysis and respond to errors or abuse and may be retained under default settings for up to 30 days.

Cerebras Systems Inc. ([email protected]): when the user runs a corresponding AI analysis feature, entered text or images, category or asset candidates, reference time, and time zone are encrypted in transit to the United States. The information is processed to generate the analysis. Cerebras states that it does not retain inference inputs and outputs after providing the response.

Apple Inc. and Google LLC: when the user invokes their respective sign-in, payment, or restoration features, account identifiers, the email address or name permitted by the user, authentication information, and purchase-verification information may be encrypted in transit to the United States and other countries where each provider operates. Each provider processes this information for its feature and legal obligations under its own retention policy.

The Supabase transfer is necessary to provide the Donup account and synchronization service. A user may refuse by not creating an account or by requesting account deletion, but Donup's account-based features will then be unavailable. A user may refuse OpenAI or Cerebras transfers by not using the optional AI features and may continue to enter data manually. Apple or Google transfers may be refused by choosing another sign-in method or not using the relevant sign-in or payment feature, but the related authentication, payment, or legacy CloudKit migration feature will be unavailable.

Article 7. Account-based Synchronization and CloudKit Migration

Data is separated by the Supabase user ID of the signed-in Donup account, and row-level access policies restrict reads to the authenticated user's own data.

Devices signed in to the same Donup account synchronize creates, updates, and deletions using row-level change history and revisions. When changes conflict, they may be reconciled against the latest server-confirmed change.

Attached images are stored under a private per-user path and cannot be accessed by another Donup account.

During initial migration, existing CloudKit data is read and copied into the signed-in Donup account. The iCloud user-record name is hashed within the app and container scope and used only to prevent the same source from being migrated into more than one Donup account; the original value is not sent to Donup servers. After migration, CloudKit is not used as the server original for ongoing Donup synchronization.

If Apple and Google sign-in methods are manually linked to one Donup account from account settings, the same data and verified purchase entitlement can be used on supported platforms. Signing in separately without linking may create separate accounts and separate data.

Article 8. Your Rights and a Legal Guardian's Rights

Users can access, correct, delete, and export their personal finance data through features provided in the app and can delete their Donup account and server-linked data from account settings.

Deleting a Donup account removes Supabase membership information and Donup server data, but does not delete the user's Apple or Google account. CloudKit copies left after migration and local copies on individual devices may need to be removed separately.

Account deletion does not cancel an App Store or Google Play subscription, erase the store's original purchase record, or issue a refund. Subscriptions, purchases, and refunds must be managed separately in the store where the purchase was made.

Requests to access, correct, delete, or restrict processing of personal information may also be submitted through the contact email address.

Article 9. Destruction of Personal Information

Personal information is destroyed without undue delay when its purpose has been fulfilled or its retention period has ended. On an account-deletion request, private server attachments, per-user database rows, and Auth membership data are deleted in order, and Donup does not report completion if any required stage fails.

Electronic files and database records are deleted so that recovery is impracticable. Any paper document is shredded or incinerated. Synchronization tombstones containing only an identifier and deletion time are removed with account deletion.

Deleting the app removes only the local copy on that device and does not delete Supabase account data. The user must use the in-app account-deletion feature to delete all server data.

Article 10. Security Measures

Donup limits the scope of data access by using the app sandbox and local SwiftData, Supabase Auth, per-user row-level access policies, private Storage paths, and server-only purchase-verification functions.

Encrypted transport is used for AI analysis requests and network communications where reasonably available.

Users are responsible for maintaining the security of their own devices, including device locks and the Apple or Google accounts connected as sign-in methods.

Article 11. Children's Personal Information

Donup is not primarily directed to children under 14 and does not knowingly collect a child's personal information without the consent of a legal guardian.

Requests concerning the processing of a child's personal information may be submitted through the contact email address.

Article 12. Privacy Contact and Remedies

Privacy contact team: Donup Operations

Privacy and service enquiries: [email protected]

Mail-order business registration number: 2026-서울구로-0897

Privacy complaints may also be submitted to the Personal Information Infringement Report Center (118, privacy.kisa.or.kr), the Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr), or the Korean National Police Cybercrime Reporting System (ecrm.police.go.kr).

Article 13. Automated Processing and AI Analysis

AI features analyze information entered or selected by the user and suggest a title, amount, date, category, asset information, or DonWorry response. They do not automatically make a decision that produces legal effects or a similarly significant change in the user's rights.

Before sending data to external generative AI, Donup explains the recipients, data, purposes, retention and refusal options, and requests permission separately from sign-in terms. Permission is recorded per account on this device and can be withdrawn from an AI feature notice or AI data use in Settings. New AI requests are blocked before permission and after withdrawal. Once allowed, enabled advice cards may automatically request advice using ledger information for the current screen.

Camera, microphone and speech recognition, and notification permissions are optional and requested when the corresponding feature is used. Photos are limited to items selected in the system picker. Refusing these permissions does not block manual entry or regular ledger features. Permissions can be changed in device settings.

Users may enter data manually without AI. AI entry and DonWorry actions may save entries automatically; saved results can be reviewed, edited or deleted. Features with a confirmation screen, such as imports, allow review or cancellation before saving. Saved DonWorry conversations and attachments can also be deleted separately.

Article 14. Changes to This Policy

This Privacy Policy may be updated to reflect changes in law, platform policies, or service features.

Material changes will be announced through an app update, an in-app notice, or a store notice.