The iOS app, in plain words.
This page covers the Artos iOS app only. The website is a different product with a different data flow, and it has its own page. Both are part of a small pilot built by a student at SMU, and both are written to align with Singapore's PDPA.
Your money never leaves your phone. Transactions, amounts, merchant names, balances, account names, budgets, categories and rules live in a database on the device and are never uploaded, never synced, and never visible to us. There is no account and no login, so there is nothing for us to look you up by. The only things that reach a server are the statement files you choose to upload for reading, an optional email address you can skip, behavioural usage events, and crash reports.
When you upload a screenshot or a PDF, it is sent to our server to be read, held in memory only, and never written to disk. The reading job that holds it deletes itself within an hour whether it succeeded or failed. The transactions that come back are written to your phone, not to our database. There is no file to delete because no file is kept.
Early in the app we ask once for an email address, so we can send you updates and ask how the pilot is going. You can skip it and use the whole app anyway. Nothing is locked behind it and nothing about the app works differently if you never give it.
If you do give it, we store the address against your install and nothing else. It is never attached to a usage event, never attached to a crash report, and it does not change what we can see of your money, which is still nothing.
There is no expiry clock on it. It sits there until you remove it, which you can do at any time from the You tab. Removing it deletes the record from our side. Because there is no automatic deletion date, that removal control is the guarantee, which is why it is a plain row on the You tab and not buried somewhere.
When you install the app it generates a random id and keeps it in the iOS keychain. It is not your Apple ID, not an advertising id, and not anything Apple gave us. It exists so the server can rate-limit statement reading fairly and so usage events from one install hang together. If you gave us an email, that id is how we know which install is yours. Deleting all your data from the You tab clears it.
The app records which screens and actions you use, and when: that a screen was opened, that an import finished, that a budget was created. It also records whether the phone is iOS or Android, the app version, whether an import was a PDF or an image, how long a read took, how many rows came back, and how many arrived without a suggestion. It never records amounts, merchant names, descriptions, category names, or anything else from inside your ledger. The server also refuses to store anything shaped like that, as a second line of defence in case the app ever tries.
This is on by default and there is a switch to turn it off on the You tab. Turn it off and the app stops sending them from that moment. If you gave us an email, these events are linked to it; if you skipped it, they are linked to the random install id and nothing else.
If the app crashes it sends us a report so we can fix it. These are always sent and there is no switch for them, because a crash we never hear about is one we never fix. A report carries the error, where in the code it happened, and the device model and iOS version.
A crash also attaches a short recording of the screen from just before it. Nothing is recorded during ordinary use, only around a crash. Text, images and drawn shapes are blanked out on the phone before anything is sent, so what arrives is the shape of the screen and what you tapped rather than what it said. That blanking is done by the crash reporting library and is best effort rather than a guarantee, which is why we would rather say so here than imply it is airtight.
We strip amounts, merchants, descriptions, category names, the people in your splits, and the filenames of your statements out of the report text. During the pilot a merchant name can still reach us inside an error message, because the stripping matches patterns and an ordinary shop name looks like ordinary words. Crash reports are never tied to your email.
If you send feedback from the app, the message is stored word for word and read by the founder. It carries the app version and nothing else about you. Write whatever you would write in an email, and leave out anything you would not want kept.
Everything is on the You tab, and all of it is immediate:
Data protection contact: Dewa (SMU). Email: dewa@artos.cash. Reach out to ask what is stored about you, to correct it, or to request deletion.