1. 核心承诺
My Money 是无需账号的个人预算与记账工具。您的账本始终保存在设备本地，不会自动上传。App 不连接银行，不包含广告或第三方分析 SDK，也不会将您的内容用于广告或追踪。
自 1.0.1 起，App 新增一项可选的「在线 AI」功能，默认关闭。只有当您主动开启并明确同意后，相关功能才会把该功能对应的文字或统计摘要，经由托管在 Vercel 的 My Money 在线服务发送给 DeepSeek 进行处理。未开启时，App 的行为与之前一致：所有智能处理都在设备上完成。具体范围见第 3 节。
2. 设备端存储
交易、预算方案、评估结果、决策历史和设置保存在 App 的本地容器中，使用 SwiftData 与系统偏好设置管理。App 不建立服务器账本副本。您的设备备份可能依据您对 iCloud、Finder 或其他 Apple 备份服务的设置包含 App 数据；该备份由您和 Apple 控制，并非 My Money 上传到开发者服务器。
3. AI 处理：默认设备端，可选在线
截图 / 照片记账（1.0.1-b 起）：你选择的图片只在设备内存中交给 Apple Vision 做文字识别，不写入文件、不进入共享容器、不上传。识别出的文字默认由本机规则解析成待确认条目；只有在你另行开启「截图记账」在线授权后，这些文字才会按第 3 节所述发送。相机仅在你主动选择拍照时使用，照片同样不上传。
未开启在线 AI 时，文字记账解析、金额与日期提取、类别判断、预算计算、消费洞察、购买建议和转盘候选均由设备端 AI 在本机完成。兼容设备可使用 Apple 随系统提供的设备端语言模型优化文案或动态生成候选；模型不可用时，App 使用随应用提供的本地语义规则、统计模板和动态候选引擎。两条路径均不把您的输入或账本发送给开发者或第三方 AI 服务，也不存在服务器回退。
App 随包提供简体中文和英语本地候选库。其他语言在系统端侧模型支持时可动态处理；系统模型不可用时，转盘会使用英语离线兜底，而不会上传问题。系统语言模型及语言资源由 iOS 管理，其可用性取决于设备型号、系统版本、地区、语言和系统设置。系统可能自行下载或维护模型资源，但 My Money 不会在该过程中附带您的财务内容、语音或决策问题。
可选的在线 AI（1.0.1 起，默认关闭）。在「设置 → 在线 AI」开启并同意后，下列功能会在您每次主动发起时发送对应内容：
- 记账解析：本次输入或设备端转写得到的文字、当前日期、时区、记账币种。
- 购买建议：本次商品或问题、价格，以及剩余预算等必要的预算判断结果。
- 消费报告与洞察：您选定期间的分类汇总、总支出和必要的预算指标，不含逐笔备注。
- 转盘候选：本次问题和候选数量。实际抽选仍在本机执行。
- 截图记账（1.0.1-b 起）：从截图或照片中在设备上识别出的文字、当前日期、时区、记账币种。图片本身始终不上传；识别出的文字可能包含截图上的商户、金额、时间及其他文字。
接收方为：My Money 在线服务（托管在 Vercel，负责校验字段并转发）与 DeepSeek（作为 AI 处理方）。原始录音始终只在设备上转写，不会发送给任何一方。完整账本、逐笔备注和评估答案不会随这些请求自动上传。预算、余额、结转、合计与随机抽选始终由本机确定性代码计算，模型不会改写您的金额。
授权按功能分别记录并带有版本号；接收方、用途或字段范围发生实质变化时会重新征求同意。您可随时在设置中关闭总开关或撤回单项授权，关闭后 App 不再发起新的在线请求、会取消仍可取消的请求并忽略迟到结果。关闭无法撤回已经发送的数据。
供应商处理与保留。在线请求先由 My Money 在 Vercel 美国华盛顿特区（iad1）的函数校验和转发，再交给 DeepSeek 处理。该 Vercel 项目已启用 Observability Plus，运行日志元数据保留 30 天；我们的函数不把请求正文或模型输出写入日志，也不建立内容数据库。DeepSeek 公开的《开放平台服务协议》没有为下游终端用户输入规定固定保存期限，也没有承诺这些输入绝不用于模型训练。因此 My Money 不作“零留存”或“绝不用于训练”的承诺，并按可能被保留的情况进行保守披露。请勿在输入中加入与功能无关的密码、证件号码、银行卡号或他人敏感资料。
4. 语音与麦克风
只有当您主动开始语音输入时，App 才请求麦克风和语音识别权限。App 强制要求 Apple 的设备端语音识别；原始音频仅在当前识别会话中暂时存在，不写入 App 文件、不由 My Money 上传，也不用于训练。如果设备或所选语言不支持设备端识别，语音功能会停止并提示改用文字输入，不会切换到服务器识别。拒绝权限不影响文字记账。
5. 通知、实时活动与其他权限
预算提醒和记账提醒由设备本地安排。实时活动只展示您刚保存的金额、备注和本地计算的余额，并由 iOS 管理。My Money 不请求定位、通讯录、照片、蓝牙或广告追踪权限。快捷指令仅在您主动运行时打开相应功能。
6. 开发者收集的数据与 App Store 申报
App 不发送分析事件、崩溃正文、设备标识、广告标识或诊断日志，也不含第三方追踪 SDK。
在线 AI 关闭时（默认）：App 不向开发者服务器或任何 AI 服务发送您的内容。
在线 AI 开启时：您主动发起的那一次操作所涉及的文字或统计摘要会传输给上文所列接收方，用于实现该功能。这些内容不与您的身份关联（App 无账号，不收集姓名、邮箱或通讯录），不用于广告或追踪。App Store 产品页面的隐私申报按此实际行为填写，不再沿用 1.0 的“未收集数据”答案。
麦克风和语音识别仅在您主动使用时用于设备端处理，开发者不会收到录音。若今后行为再次变化，我们会先更新 App、本政策、隐私清单和 App Store 隐私申报，并在需要时取得您的许可。
7. 官网、外部链接与支持邮件
只有当您主动打开隐私政策、用户协议、支持页面、App Store 或邮件客户端时，设备才会访问相应外部服务。网站托管商和网络服务商可能按其政策处理访问网站所必需的 IP 地址、浏览器信息和基础访问日志；这些请求不包含您的账本、预算、语音、转写或决策内容。支持页面不使用广告追踪或行为分析脚本。您主动发送的支持邮件将由您和相关邮件服务商处理，请勿在邮件中附加不必要的敏感财务资料。
8. 数据控制、保留与删除
本地资料会保留到您在 App 内删除或卸载 App。设置中的“清除所有数据”会删除交易、预算、评估和决策记录并取消通知；为方便继续使用，当前界面语言偏好可以保留。您也可以使用 App 提供的导出功能自行保存备份。开发者不建立服务器账本或在线 AI 内容数据库，因此无法替您恢复已删除的本地资料。若您对已发送的在线 AI 内容提出访问或删除请求，请通过 snaptidyapp@outlook.com 联系我们，并提供大致日期、时间、功能和请求内容特征；我们会按照适用法律评估，并在需要时与 DeepSeek 协调。由于 App 没有账号或用户 ID，未必能够从供应商系统中定位某一次请求。
9. 儿童、跨境与安全
My Money 不以儿童为定向对象，也不会要求儿童提交个人资料。在线 AI 关闭时，App 不把财务内容发送给开发者或第三方 AI 服务。开启后，您主动发起的相应请求会先传输到位于美国华盛顿特区（iad1）的 Vercel 函数，再交由位于中国的 DeepSeek 开放平台运营方处理，因此可能涉及跨境传输。设备安全仍取决于您的密码、系统更新和备份设置；建议启用设备锁并及时更新 iOS。
1. Our core commitment
My Money is a personal budgeting and expense-tracking tool that requires no account. Your ledger is stored on your device and is never uploaded automatically. The app does not connect to banks, contains no advertising or third-party analytics SDK, and never uses your content for advertising or tracking.
From 1.0.1 the app adds an optional "Online AI" feature, which is off by default. Only after you turn it on and explicitly agree will the relevant feature send that feature's text or summary, through the My Money online service hosted on Vercel, to DeepSeek for processing. With it off, the app behaves exactly as before: all intelligent processing happens on your device. Section 3 lists the exact scope.
2. On-device storage
Transactions, budget plans, assessments, decision history, and settings are stored in the app's local container using SwiftData and system preferences. The app creates no server copy of your ledger. Device backups may include app data according to your iCloud, Finder, or other Apple backup settings; those backups are controlled by you and Apple and are not uploads to a My Money developer server.
3. AI processing: on device by default, online optional
Screenshot / photo entry (from 1.0.1-b): an image you pick is handed to Apple Vision in device memory for text recognition only. It is not written to a file, not placed in the shared container, and not uploaded. The recognised text is parsed into draft entries by on-device rules by default; only if you separately enable the "Screenshot entry" online scope is that text sent as described in this section. The camera is used only when you choose to take a photo, and photos are likewise never uploaded.
With Online AI off, transaction parsing, amount and date extraction, categorization, budget calculations, spending insights, purchase suggestions, and wheel choices are processed by AI on device. Compatible devices may use Apple's system-provided on-device language model to refine text or dynamically create choices. If that model is unavailable, the app uses bundled semantic rules, statistical templates, and a dynamic local choice engine. Neither path sends your input or ledger to the developer or a third-party AI service, and there is no server fallback.
The app bundles local Simplified Chinese and English choice libraries. Other languages can be handled dynamically where the system on-device model supports them; if that model is unavailable, the wheel falls back to offline English rather than uploading the question. iOS manages system language models and language resources. Availability depends on device model, OS version, region, language, and system settings. The system may download or maintain model resources, but My Money does not attach your financial content, audio, or decision questions to that resource management.
Optional online AI (from 1.0.1, off by default). Once you enable it in Settings → Online AI and agree, these features send the following each time you start them yourself:
- Entry parsing: the text you typed or the transcript produced on your device, plus the current date, time zone, and bookkeeping currency.
- Purchase reflection: the item or question, its price, and the minimum budget figures needed to judge it, such as the remaining budget.
- Reports and insights: category totals, total spending, and the necessary budget figures for the period you chose. Individual notes are not sent.
- Wheel options: the question and how many options you want. The draw itself still runs on your device.
- Screenshot entry (from 1.0.1-b): the text recognised on your device from a screenshot or photo, plus the current date, time zone, and bookkeeping currency. The image itself is never uploaded; the recognised text may include merchants, amounts, times and other text visible on the screenshot.
The recipients are the My Money online service (hosted on Vercel, which validates the fields and forwards them) and DeepSeek (which performs the AI processing). Raw audio is always transcribed on device and is sent to neither. Your full ledger, per-entry notes, and assessment answers are never uploaded automatically with these requests. Budgets, balances, rollover, totals, and the random draw are always computed by deterministic local code; the model never rewrites your amounts.
Consent is recorded per feature and carries a version. If the recipients, purpose, or field scope materially change, we ask again. You can switch the feature off or revoke a single scope at any time in Settings; the app then starts no new online requests, cancels anything still cancellable, and ignores late responses. Turning it off cannot recall data that was already sent.
Provider processing and retention. An online request is first validated and forwarded by a My Money function in Vercel's Washington, D.C., USA region (iad1), then processed by DeepSeek. This Vercel project has Observability Plus enabled and retains runtime-log metadata for 30 days; our function does not write request bodies or model outputs to logs and creates no content database. DeepSeek's published Open Platform Terms do not set a fixed retention period for downstream end-user inputs and do not promise that those inputs are never used for model training. My Money therefore makes no “zero retention” or “never used for training” promise and conservatively discloses the content as potentially retained. Do not include unrelated passwords, government identifiers, card numbers, or another person's sensitive information in your input.
4. Voice and microphone
The app requests microphone and speech-recognition access only when you start voice input. My Money requires Apple's on-device speech recognition. Raw audio exists only during the current recognition session; it is not written to app files, uploaded by My Money, or used for training. If the device or selected language does not support on-device recognition, voice input stops and asks you to type instead. It never switches to server recognition. Denying permission does not affect text entry.
5. Notifications, Live Activities, and permissions
Budget and logging reminders are scheduled locally. A Live Activity displays only the amount, note, and locally calculated balance from a transaction you just saved and is managed by iOS. My Money does not request location, contacts, photos, Bluetooth, or advertising-tracking access. Shortcuts open a feature only when you run them.
6. Developer data collection and App Store disclosure
The app sends no analytics events, crash-report content, device identifiers, advertising identifiers, or diagnostic logs, and contains no third-party tracking SDK.
With online AI off (the default): the app sends none of your content to a developer server or to any AI service.
With online AI on: the text or summary involved in the one action you start is transmitted to the recipients listed above in order to provide that feature. It is not linked to your identity (the app has no account and collects no name, email, or contacts) and is never used for advertising or tracking. The App Store privacy disclosure reflects this actual behaviour and no longer reuses the 1.0 "Data Not Collected" answer.
Microphone and speech recognition are used only for on-device processing that you initiate; the developer never receives the audio. If this behaviour changes again, we will first update the app, this policy, the privacy manifest, and the App Store privacy disclosures, and obtain permission where required.
7. Website, external links, and support email
Your device contacts an external service only when you choose to open this policy, the Terms, Support, the App Store, or your email client. Website hosts and network providers may process the IP address, browser information, and basic access logs needed to serve a page under their own policies. Those requests contain no ledger, budget, audio, transcript, or decision content. The support site uses no advertising trackers or behavioral analytics scripts. Email you choose to send is handled by you and the relevant email providers; avoid including unnecessary sensitive financial details.
8. Control, retention, and deletion
Local information remains until you delete it in the app or uninstall the app. “Erase All Data” removes transactions, budgets, assessments, and decision records and cancels notifications; the selected interface language may be retained for convenience. You may use the app's export feature to keep your own backup. The developer creates no server ledger or online-AI content database, so we cannot restore deleted local information. To request access to or deletion of content already sent through online AI, email snaptidyapp@outlook.com with the approximate date, time, feature, and characteristics of the request. We will assess the request under applicable law and coordinate with DeepSeek where needed. Because the app has no account or user ID, it may not be possible to locate an individual request in a provider system.
9. Children, transfers, and security
My Money is not directed to children and does not ask children to submit personal information. With online AI off, the app sends no financial content to the developer or a third-party AI service. With it on, the request you start is first transmitted to a Vercel function in Washington, D.C., USA (iad1) and then to the China-based operator of the DeepSeek Open Platform for processing, so international transfers may occur. Device security still depends on your passcode, system updates, and backup settings; use a device lock and keep iOS current.
10. Changes and contact
If this policy or our data practices materially change, we will update the date and provide notice where appropriate. For privacy questions, email snaptidyapp@outlook.com or visit Support.
