RROW Privacy Policy

1. Data we process

Account data: Apple identifier, name and email provided by Apple (including a private relay address), sign-in dates, language, consent versions and dates, and security settings. RROW does not receive your Apple Account password.

Profile and preferences: avatar, selected currencies, analytics currency, theme, notification preferences, carry‑forward settings and other choices.

Financial records: amounts, currencies, dates, titles, categories and income/expense statuses; recurring payments; monthly budgets and carryovers; debts and repayments; savings, reserves and their recorded movements; notes and saved rates; confirmed scan fields.

Technical data: IP address and security logs, device and app type, session identifiers, push token, error and activity data needed for security, diagnostics and service delivery. We do not use advertising identifiers for cross‑service tracking and do not sell personal data.

Audience statistics: in new versions, enter your country, gender and age in full years during registration. These fields are required to complete initial setup. Your date of birth is not requested. RROW stores your answers in account metadata in Supabase and uses them for aggregate statistics accessible to administrators. Answers are deleted with the account. Gender and age are not inferred from names, and country is not inferred from IP addresses or GPS. Existing accounts are not assigned these details automatically.

2. Sources of data

You supply records, preferences, an avatar and selected documents. Apple supplies sign-in data according to your choices. Technical data arises during use; reference rates come from Frankfurter.

3. Purposes and legal bases

We process data to create and secure accounts; synchronise devices; provide calendars and financial records; perform calculations, conversion, analytics, export and reminders; scan receipts and generate AI reports; provide support; prevent abuse; fix errors; comply with law; and protect rights.

The legal bases are performance of our contract with you, our legitimate interests in security and service improvement, and compliance with legal obligations. Where a device permission requires consent, you can change that permission in your device settings.

4. Receipt scans and AI reports

When you start a scan, the selected receipt image is sent through our protected server to an AI provider to extract the amount, date, currency, merchant and suggested category. RROW does not save the source image in its database or cloud storage; it is released from request memory after a result is returned. If you save the transaction, only the fields you review and confirm remain in your account.

To prioritize report suggestions, OpenAI receives only aggregate financial metrics, currencies, standard categories and recommendation candidates calculated by the app. Names, company and transaction titles, notes, contact details, avatars, logos and receipt images are not included in this request. We use the OpenAI API with application‑state storage disabled. API data is not used to train OpenAI models by default, but the provider may retain abuse‑monitoring logs for up to 30 days unless Zero Data Retention applies, or longer when legally necessary.

Separate, optional consent to share aggregated amounts, currencies and standard categories with OpenAI enables weekly, monthly, quarterly and annual personal finance reports automatically. Consent is available during registration or in Reports; accepting the terms and privacy policy alone does not enable AI. Declining does not restrict core bookkeeping. Reports use synchronized data after the current calendar period ends, with consent given before its end, starting at 09:00 in the selected time zone. The app calculates amounts; AI prioritizes suggestions. Saved reports are not recalculated when records change. Disable new reports in Reports; history remains until account deletion or an applicable deletion request. Earlier weekly-only consent does not enable other periods. Receipt scanning requires separate consent and does not enable reports.

Before the first scan, the app separately explains that the selected photo and document data will be sent to OpenAI and asks for explicit consent. Permission is saved locally for the current account on this device and covers subsequent documents you choose to recognize. It is not transferred through cloud sync or backups and is not enabled by accepting the Terms or permitting AI reports. Canceling does not send the image. You can revoke permission in Receipt recognition settings: new scans and application of pending results stop, but data already sent cannot be recalled. A change to the recipient, data or processing purpose requires new consent.

5. Recipients

Supabase processes account data, synchronized records and avatars. Apple and Expo process data needed for sign-in or notification delivery. OpenAI receives a selected document after separate consent, or aggregate metrics for optional reports. Frankfurter receives currency-code and period requests, not your financial history; direct device requests also reveal standard network data, including IP address.

Providers process data on our instructions or as independent controllers within their own services. We may also disclose data where required by law, a competent authority or protection of rights and safety. In a business reorganisation, data may transfer to a successor subject to applicable obligations. We do not sell or rent personal data.

6. International transfers

Providers may process data in Armenia, the European Economic Area, the United States and other countries where protections may differ. Where required, we use contractual and organisational safeguards for lawful transfers, including processing agreements, standard contractual clauses or another recognised mechanism.

7. Retention

Records and preferences are retained until the corresponding data or account is deleted. RROW does not save source scan images in cloud storage. Avatars remain until replacement, removal or account deletion; cleanup may retry after a temporary failure. Disabling reports stops new reports but does not erase the archive.

After account deletion we delete or anonymise active data without undue delay, except information we must retain for law, disputes, fraud prevention or proof of consent. Residual copies may remain for a limited period in protected backups until scheduled overwrite and are not used for ordinary operations.

Updating the app does not itself erase data from previously available Family and Business workspaces or investment records. Contact support to request a copy or deletion of inaccessible historical data. Previously shared records may remain for other participants where needed to protect their rights; requests are assessed under applicable law. The current interface does not provide new invitations or shared bookkeeping.

8. Security

We use access controls, authentication, protected transmission, server access rules, logging, backups and other reasonable technical and organisational measures. Some local data is kept in protected device storage. No method is absolutely secure, so protect your device, password and 2FA codes and report suspicious activity.

9. Your rights

Depending on applicable law, you may request access, a copy, correction, updating, deletion or restriction; object to certain processing; obtain a portable copy of data you provided; withdraw consent; and complain to a competent data‑protection authority.

Many controls are available in the app: editing profile and preferences, export, deleting individual records and full account deletion. For other requests, contact support or write to the Company. We may verify identity and will respond within the period required by applicable law.

10. Device permissions

Photos and camera support avatars and selected scans; notifications support reminders and completed reports; Face ID or Touch ID protect local access. Biometric templates are not sent to RROW. Avatars may be stored locally and in private Supabase storage; they are distinct from source receipt images. Change permissions in device settings.

11. Local storage and web technologies

The app uses protected local storage, application memory and necessary session technologies for sign‑in, synchronisation and preferences. The web version may use strictly necessary cookies or similar local storage. RROW does not use them for third‑party behavioural advertising.

12. Minors

RROW is not intended for independent use by anyone who cannot validly consent or enter an agreement under applicable law. If you believe a child submitted data without required representative permission, contact us so we can investigate and take legally required action.

13. Changes to this Policy

We may update this Policy when RROW, our providers or the law changes. The current version and effective date will be available in the app. We will give prominent notice of material changes and obtain renewed consent where required.

14. Controller and contact

Controller: CDM Nexus LLC, registration number 999.110.1559924, registered on 13 February 2026. Address: 26/3 Vazgen Sargsyan Street, Yerevan, Republic of Armenia. Email: info@rrow.am.

Privacy questions and rights requests may be sent to info@rrow.am, through RROW support or by post to the address above. Never include a password, full 2FA code or other access secret in a request.