VeroSpend Privacy Policy
Effective October 23, 2026
Financial data
Your saved financial records stay on your device unless you deliberately export, share, or enable Cloud sync. VeroSpend does not connect to your bank credentials or move money.
Optional encrypted device sync
Settings → Cloud sync can connect iPhone, iPad, and Mac using a private sync code. After you choose to connect, financial profiles, accounts, transactions, income, budgets, bills and reminder settings, goals, debts, saved assets, receipt attachments, saved images, and completed Vero conversations are encrypted on your device before being stored in Cloudflare Durable Objects. A separately derived authentication credential, opaque record identifiers, change timestamps, and deletion markers are used to authenticate and merge changes. Cloudflare does not receive the private sync code or the key needed to decrypt the record contents.
The shared credit-wallet credential is also encrypted inside this sync space. Linked devices use the existing server credit ledger; balances are not copied or added together. TestFlight Sandbox and production balances remain separate. Previous device wallets are kept in Keychain for recovery. Pending chat inquiries, queued messages, Apple purchase processing, and notification permission stay specific to each device to prevent duplicate requests or purchases.
The latest saved change wins for a conflicting record, separate offline entries are retained, and deletions propagate after the devices reconnect. Sync works while the app is active. Existing profiles remain separate. Anyone with your sync code can decrypt your synced data and access its shared wallet; keep it private. We cannot recover a lost code.
Pausing stops network sync while keeping changes queued locally. Disconnecting leaves local data and the credit wallet in place. Delete cloud copy permanently removes the encrypted records and attachment chunks in that sync space and prevents disconnected devices from silently recreating it. Minimal authentication/deletion state is retained to enforce that deletion; the separate purchase and credit ledger is unaffected. Record deletion markers are retained to prevent old devices restoring deleted records. Unused attachment chunks are removed after their known record references have been deleted and sync catches up. Removing the app alone does not delete cloud data, exports, backups, or Keychain credentials.
AI Chat and Cloud Financial Guide
When you opt in and ask a question, VeroSpend sends your question and aggregate financial totals to a VeroSpend Cloudflare Worker. Financial Guide includes up to eight recent messages. AI Chat includes up to 24 recent messages, earlier user statements remembered locally for the selected profile, and proposed setup facts and labels previously saved through chat. Conversation context is bounded to fit each request. It does not automatically send raw transactions, merchant names, saved account identities, attachments, employer labels outside chat setup, addresses, or bank credentials.
AI Chat and Basic questions are processed by Cloudflare Workers AI. AI Chat history is saved per profile and is included in encrypted Cloud sync only when you enable that separate feature. App versions supporting automatic expense recording validate and log clear completed purchases you describe, then confirm the saved entries in chat. No payment account is inferred. Monthly profile changes and scanned document drafts require your review and confirmation. Pro Deep Analysis is processed by OpenAI with response storage disabled. AI output can be incomplete or wrong and is not professional financial, legal, tax, or employment advice.
Opportunity research
Find opportunities uses Cloudflare Web Search with Ceramic to research current sources. The Worker may also retrieve a small set of official public provider, government, and property-marketplace pages. These requests contain no personal or financial details. Only general topic terms and your country are sent to search, not your original question, financial totals, account or property names, or chat history. Cloudflare Workers AI compares source excerpts with your financial summary and recent conversation, then provides source links and suggested next steps. Search excerpts can be incomplete or outdated; verify prices, eligibility, and availability with the provider. A completed research answer uses one AI credit; failed research is not charged.
Receipt and screenshot analysis
If you choose a photo or use the camera in AI Chat, text recognition runs on your device. You can review and edit the recognized text before selecting Analyze. Only that reviewed text, your profile currency, language, and category names are sent to Cloudflare Workers AI to identify the document and prepare tracker drafts. Image pixels are not uploaded for AI analysis. Photos deliberately attached to tracker records may be included in encrypted Cloud sync when enabled. Remove any sensitive details you do not want processed before analyzing. Entries are saved only after you review and confirm them. Raw image and OCR text are not saved in chat history; a brief analysis summary and save confirmations may be saved locally in that profile's chat.
AI credits and purchases
One credit covers one completed AI inquiry and reply or one document analysis. On-device entries use no credits. A verified App Store download receives 25 welcome credits once per Apple account and app, and, from the following UTC day, 2 daily credits that do not accumulate. Creating another wallet does not reset these free grants. Previously registered wallets keep their existing balances. Recover your original wallet when changing devices. Welcome and purchased credits do not expire. Apple processes payments; VeroSpend does not receive payment card details. Apple-signed purchases are verified on the backend and added once. TestFlight uses a separate Sandbox wallet.
Your random wallet identifier, hashed authentication credential, balances, inquiry identifiers, and verified purchase identifiers, and a one-way hash of the Apple app-download identifier are stored in Cloudflare Durable Objects to deliver credits, prevent duplicate charging, and recover purchases. Your private wallet recovery key is stored in the device Keychain. Keep your recovery key private and save it before changing devices. Anyone with it can access that credit wallet. Clearing local finances does not reset the credit wallet.
For retry protection, generated AI replies and proposed entries may be cached on the backend for up to 24 hours after completion. Uncompleted replies and reservations expire after 10 minutes; unused reservations are released. Question bodies and financial summaries are not stored in the wallet. Financial information included in an AI reply can remain in this temporary cache until it expires. Billing identifiers and balances remain while the wallet is in use. The hashed app-download grant record is retained to prevent repeat welcome grants after a wallet is replaced.
Existing subscriptions
Apple processes subscription payments. VeroSpend receives Apple-signed transaction data to verify Pro access, but does not receive your payment card details. VeroSpend validates the app, product, subscription expiration, and revocation status before allowing Deep Analysis.
Security and retention
The guide endpoint does not persist question bodies or financial summaries. Generated responses may be temporarily cached as described above. It uses one-way hashes of installation, network, and subscription identifiers for rate limiting. Cloudflare and OpenAI may process requests under their own security and abuse-prevention policies.
Your choices
You can disable Cloud Financial Guide in Settings. Cloud sync has separate pause, disconnect, and Delete cloud copy controls. Deleting records while sync is connected also deletes those records on linked devices after sync. Subscription management and cancellation are available through your Apple ID subscription settings. For support, wallet deletion, or privacy requests, contact info@qnsub.com. Never send your recovery key or sensitive financial details in a support message.