Privacy Policy

The short version

• Your ledger is stored on your device. You can use Outlayr without an account, and then your entries, amounts, and notes never leave the phone.
• An account (Sign in with Apple, Google, or an email and password) turns on merchant suggestions, notification reading, voice entry, receipt scans, and installment plan imports. With Outlayr Pro it also turns on sync, which keeps a copy of your ledger and photos on our servers until you delete your account.
• With an account, we email you a welcome note, a note when Pro starts, and notice before a material change to this policy or our Terms. No newsletters or marketing.
• Voice entries, receipt scans, installment plan imports, PDF bank statements you choose to import, merchant suggestions, and bank notifications that show an amount are processed by Anthropic, and ElevenLabs turns voice recordings into text. We don’t store your recordings, scanned photos, screenshots, or notifications, and, apart from whatever a statement you import shows, we never send either company your name, email, or account ID.
• Nothing goes to Anthropic or ElevenLabs until you allow it. The app asks during setup, or after you sign in, and Speak an entry and Scan a receipt ask again until you do. Import from a screenshot, for installment plans, asks the first time you use it, even if you allowed the others. Withdraw it any time in Settings › Send data to AI providers. Once allowed, merchant suggestions, notification reading, and web lookups are on, and all three can be turned off in Settings › Smart fill. Turning Smart fill on also allows sending data to AI providers.
• The app sends usage analytics and crash reports to PostHog: which screens you open, which features you use, and errors. Never amounts, merchants, notes, or names. It starts off if your device’s region is in the EEA or UK, and on everywhere else. Change it in Settings › Share analytics. Our server also tells PostHog the size, cost, and speed of each request to Anthropic, never what it contained, and links it to your account only while Share analytics is on.
• This website uses PostHog too, with a cookie. If you’re in the EEA or UK, it asks first. Change your answer in the footer under Cookies.
• With Outlayr Pro you can connect Notion to import expenses from your Notion databases. We keep Notion’s access key encrypted on our servers so you can import again, until you disconnect Notion or delete your account. What we read from Notion passes through our server to your phone and isn’t stored.
• You can connect an AI assistant such as Claude to your account. Once you approve it, it can read what your devices synced, and with Outlayr Pro add entries. What it reads is handled under that assistant’s privacy policy.
• If you invite friends, each one sees your first name on your invite, and you see their first name, how many days they have logged up to three, and the date of the third. Never what they logged.
• No ads and no tracking across other companies’ apps. We don’t sell your personal information or share it for advertising.
• You can delete your account and everything synced to it from the app at any time: Settings › Account › Delete account.

Who we are

Outlayr is made by danestves LLC, a Delaware limited liability company. We decide how the personal data described here is used, which makes us its controller. You can reach us at support@tryoutlayr.com or by mail at 651 N Broad St, Suite 201, Middletown, DE 19709, USA.

This policy covers the Outlayr app, the servers that support it, and this website. “We” and “us” mean danestves LLC. Our Terms of Use cover everything else about using Outlayr.

Data at a glance

Every kind of data Outlayr handles, in one place. The sections below explain each row.

What stays on your device

Outlayr keeps your ledger in a database inside the app on your device: your entries (amount, currency, date, merchant or note, category, tags, account, repeat schedule, and any photos), accounts and their balances, transfers, budgets, savings goals, categories, tags, and settings. Entries you delete wait in Recently deleted on the phone, where you can restore them.

You don’t need an account to use Outlayr. Without one, none of your ledger is sent to us.

Features that stay on your device

• Widgets show totals, balances, budgets, and recent entries on your Home Screen, and on iPhone your Lock Screen too. They read from storage shared only between Outlayr and its own widgets.
• Search: on iPhone, Outlayr adds your 500 most recent entries and your budgets to the on-device Spotlight index so you can find them from Search. To stop this, turn off Show Content in Search for Outlayr in the iOS Settings app.
• Reminders (a daily nudge and upcoming subscription charges) are scheduled on your device. Outlayr never sends notifications from a server and doesn’t register for push notifications.
• Siri and Shortcuts actions on iPhone (log a transaction, check a budget, get a spending summary) run on the device. Apple handles Siri requests under its own privacy policy. Logging from a notification can also send its text to be read by Anthropic.
• App lock (Settings › Biometric lock) puts Outlayr behind your device’s biometric lock (Face ID or Touch ID on iPhone). The system checks your face or fingerprint, and Outlayr only learns whether the check passed.

What the app sends even without an account

• Exchange rates. The app downloads market rates from our server. The request needs no account and carries no ledger data. Our server reads the rates from Open Exchange Rates, CotizaVE, and Binance, which receive nothing about you.
• Logos. To show a logo for a merchant or bank, the app asks our logo server for it by web address (for example, netflix.com). It never includes amounts, notes, or who you are. If we don’t have that logo yet, our server looks it up on Google’s and DuckDuckGo’s icon services, the merchant’s own website, and Wikidata, and keeps a copy for everyone. Those services see the web address and our server, not you. Logos are then cached on the phone.
• App updates. When the app starts, it asks Expo, the platform we use to ship updates, whether a newer version of the app’s code is available. The request includes a random ID created for this install (not linked to your account), the app version, and your IP address. If an update failed to start last time, it also includes a short error message.
• Purchase status. The app checks with RevenueCat whether you have Outlayr Pro, using a random anonymous ID until you sign in, and your account ID, name, and email after. See Outlayr Pro.
• Analytics and crash reports. The app tells PostHog, the analytics service we use, when it is installed, updated, opened, or closed, which kind of screen you open (for example, an account’s screen, never which account), and when you save an entry, transfer, account, category, or budget, share a card, import or export data, change a setting, open Outlayr Pro, or open the app from a widget, shortcut, or link. These events carry details such as expense or income, whether an entry came from a scan or your voice, whether it was new or an edit, which setting changed and whether it is now on, and how many rows an import brought in, rounded to a range such as 10 to 99. If the app hits an error, it sends the error message and where in the code it happened. Each event carries a random ID created for this install, the app version, your device model, operating system, language, time zone, and screen size. It never includes amounts, merchants, notes, account or category names, or your email. PostHog discards your IP address. Once you sign in, these events are linked to your Outlayr account ID. If your device’s region is set to a country in the EEA or UK, Settings › Share analytics starts off and none of this is sent until you turn it on. Turning it off stops all of it on that device.

Your account

You can sign in with Apple, with Google, or with an email and password. We receive:

• With Apple: your email address, or a private relay address if you choose Hide My Email, and an identifier for your Apple account. The app doesn’t send us your name.
• With Google: your name, email address, a link to your Google profile photo, and an identifier for your Google account.
• With email: your email address and a password. We keep only a one-way hash of the password, never the password itself. To confirm the address or reset the password, we email you a 6-digit code through Cloudflare. A code expires after 10 minutes.

We create an Outlayr account ID, a random string, and link it to that identity. We also store the tokens needed to keep you signed in and to revoke access when you delete your account. Each sign-in creates a session, which can record your IP address and your device’s user agent. A session stops working after seven days without use, and signing out deletes it.

Signing in doesn’t change the ledger on your device. Signing out ends the session on that device and leaves the ledger where it is.

Emails we send

We send a few emails to the address on your account, in the app’s language:

• A welcome note once your address is confirmed, which is right away with Apple or Google.
• A note when Outlayr Pro starts, with your plan, its renewal date, and where to manage it.
• Notice before a material change to this policy or our Terms of Use.

They come with your account, so there’s no unsubscribe link, and they stop when you delete it. We don’t send newsletters or marketing. To write them in your language, the app tells our server its language when you sign in and when it renews your session. We keep that language and a record of which of these emails you got until you delete your account.

Sync and photos

Sync is part of Outlayr Pro. When you’re signed in with Pro, Outlayr copies your ledger to our servers and sends it to your other signed-in devices. You can stop a device from syncing in Settings › Sync.

What syncs

• Entries, transfers, accounts, budgets, savings goals, categories, tags, and the amounts, currencies, dates, merchants, notes, and exchange rates on them.
• Photos attached to entries and images set on accounts, uploaded to our file storage on Cloudflare R2. Each account has a 2 GB photo limit.
• Settings that describe you rather than the phone, such as your currency, display preferences, and whether suggestions and web lookups are on.
• Your phone’s time zone, so a connected AI assistant dates your entries the way the app does.
• A random ID for each device, used to order edits made on different devices.

Settings tied to one phone stay on it: notifications, app lock, Share analytics, number entry, and light or dark mode.

Deleted entries

When you delete an entry on a synced device, our servers keep a deletion record so your other devices can remove it too. That record keeps the entry’s last contents, and any photo it had, until you delete your account.

Turning sync off

Turning sync off stops that device from sending changes. It doesn’t remove what’s already on our servers. To remove it, delete your account.

Connecting Notion

With Outlayr Pro, you can connect a Notion workspace and import expenses from its databases. Notion asks which pages to share with Outlayr, and Outlayr can read only those. It can’t change, add, or delete anything in Notion.

When you connect, Notion gives our server an access key and your Notion user ID. We keep the key encrypted on our servers, linked to your account, so you can import again later without connecting again. We never see your Notion password, and we don’t keep your Notion name or email.

When you import, our server uses the key to read the databases you pick: their names, column names, and rows, and the names of the rows they link to. It sends them to your phone, which builds the import there. Nothing read from Notion is stored on our servers, and your phone keeps only the entries you import.

• Disconnect in Settings › Import › Notion at any time. Our server asks Notion to revoke the key and deletes it.
• Removing Outlayr from your Notion settings revokes the key too. We delete it the next time the app tries to use it.
• If Pro ends, the key stays until you disconnect, but importing again needs Pro.
• Deleting your account revokes and deletes the key.

Notion Labs, Inc. handles your workspace under its own privacy policy. It learns that your workspace is connected to Outlayr, and when our server reads from it.

Suggestions, voice, and receipts

These features need an account, and none of them run until you allow sending data to Anthropic and ElevenLabs when the app asks. Turning off Settings › Send data to AI providers stops all of them. Each request goes to our server first, which checks your account and limits, then forwards only the content listed below. None of them send Anthropic or ElevenLabs your name, email, or account ID, except what a bank statement PDF you import shows, which can include your name and address.

Merchant suggestions (Smart fill)

When you type, speak, scan, or log from Apple Pay or a notification a merchant Outlayr doesn’t recognize on the device, the app sends our server the merchant name, whether the entry is an expense or income, its currency code, your language and device region, and the names of your categories. Never the amount, date, notes, or account.

Our server first checks a shared list of known merchants (below). If the merchant isn’t there, it asks Anthropic’s Claude model, and the answer (a category, tags, an emoji, and the merchant’s web address) comes back to your device. Saved entries that still have no logo may be looked up again in the background. Those requests wait on our server only until your device collects the answer.

On once you allow sending data to AI providers. Turn it off in Settings › Smart fill.

Reading bank notifications

When Outlayr logs a purchase from a notification, through the Shortcuts automation on iPhone or notification access on Android, the app sends our server the notification’s title and text exactly as the app that posted it wrote them, and your language. Anthropic’s Claude model reads whether it reports a purchase, money you received, a declined charge, or something else, and the amount, currency, and merchant. The text carries whatever that app put in it, such as the amount, a date, or the last digits of a card. The app’s name, the card and account names you set in Outlayr, and your other entries are not sent.

Only notifications that show an amount are sent: login codes, promotions, and repeats of a notification Outlayr already logged stay on your phone. We don’t store the text. The answer goes straight back to your phone, which adds the entry: a declined charge isn’t logged, and anything else is logged, using the phone’s own reading wherever the model gave no answer or called it something other than a purchase or income. If Smart fill is off, you’re offline, or the answer takes longer than 8 seconds, the phone reads the notification on its own.

On once you allow sending data to AI providers. Turn it off in Settings › Smart fill.

Web lookup of new merchants

If the model can’t place a merchant and you have Pro, our server may ask Anthropic to search the web for it. Anthropic’s model runs the searches, using the merchant name and sometimes a country or city. It receives the merchant name, expense or income, currency code, language, and region, and for background lookups, your category names too. A web lookup usually improves the answer for the next entry with that merchant rather than the one you’re typing.

On once you allow sending data to AI providers. Turn it off in Settings › Smart fill, which turns off suggestions too. The app sends your choice with every request, and our server also honors the synced setting, so no web lookup runs for you while it’s off.

The shared merchant list

When an answer names a clear business with a web address and a general category, we add it to a shared list so the next lookup of that merchant is instant. Each item holds the merchant name, its web address, a category from a fixed general list, an emoji, and tags, filed under the merchant name and currency. It doesn’t record who asked and isn’t linked to any account. Items are refreshed after 30 days, or 90 days when confirmed by a web source.

When we find no logo for a merchant, you can add its website. When you save the entry, the merchant name, that web address, and a general category join this list, so other people who log that merchant see its logo, and the logo also appears on your earlier entries for it. If your category isn’t on the fixed list and you allow AI providers, Anthropic’s Claude model picks one from the merchant name. We check that the address has a logo, and a website you add never replaces a merchant already on the list. It stays for 90 days and isn’t linked to you. Don’t add a website if you don’t want it shared.

Voice entry

When you speak an entry, the app records the clip on your device and sends it to our server with your account names, category names, your ledger’s currency, your language, and today’s date. ElevenLabs transcribes the clip, receiving only the audio and your language, and Anthropic’s Claude model turns the text into a draft entry for you to review.

We never save the audio. The transcript and the draft are kept on our server as a short conversation so you can correct the entry by speaking again. It’s deleted when you close the voice screen, or one hour after your last message if the app closes first.

Receipt scan

When you scan a receipt, the app compresses the photo on your device and sends it to our server with your account names, category names, ledger currency, language, region, and today’s date. Anthropic’s Claude model reads the merchant, total, date, and line items. We don’t store the photo, and the scan doesn’t attach it to the entry. The entry it creates holds the merchant, amount, date, and the items as notes.

Installment plan import

When you import an installment plan, you choose a screenshot of an order’s payment plan. The app compresses it on your device and sends it to our server with the name of the account you’re importing into, its currency, your language, region, and today’s date. Anthropic’s Claude model reads the app or store that sold it, and each installment’s amount, due date, late fee, and whether it is paid. We don’t store the screenshot. The plan it fills in holds only those details, and nothing is saved until you review it and tap Save.

CSV import

The file is read on your device, and so is a Notion export: the zip is opened and its CSV read on the phone. With Smart fill on, descriptions Outlayr can’t match on the device are sent to our server, and with Pro, on to Anthropic to suggest categories: at most 200 at a time, with any run of four or more digits removed, together with your category names and device region. Amounts, dates, and the rest of the file stay on your device. With web lookup on, some descriptions may also be looked up on the web as described above.

Bank statement PDF import

This feature is part of Pro and works differently from CSV import: the file leaves your device. When you pick a statement, the PDF is uploaded to our server, which reads its text and deletes the file as soon as it has. If the import is interrupted, a scheduled job deletes the file within about 75 minutes. Our server masks long runs of digits such as IBANs and card numbers, keeping the last four, and sends Anthropic the remaining text of the statement, which is everything printed on it: your name and address if the statement shows them, dates, descriptions, amounts, and balances. The transactions Anthropic finds come back to your device for you to review, and their descriptions are classified as in CSV import. We do not keep the statement or its text.

Who Anthropic and ElevenLabs are

Anthropic is the US company that makes the Claude AI models. ElevenLabs makes the speech-to-text models that write down voice entries. Both process these requests for us as service providers under their API terms. Anthropic doesn’t train its models on this data, and we’ve turned off ElevenLabs’ use of it for training. We don’t use your data to train AI models either.

If a request to Anthropic fails, our server’s error log can include the merchant name involved, so we can find the problem. It never includes a notification’s text.

Records of AI requests

After each request to Anthropic, our server sends PostHog a record of it: the feature, the model, how many tokens it used and what it cost, how long it took, whether it failed, and the names of the model’s tools it used, such as web search. Voice entry records also carry an ID for the conversation, so its turns stay together. A record never includes what you said, the photo or screenshot, a notification’s text, or any other text sent to or received from Anthropic. If Settings › Share analytics is on for the device making the request, the record carries your account ID, so we can see what AI features cost for each account. If it’s off, the record carries a random ID that isn’t linked to you.

Apple Pay and Shortcuts

On iPhone, Outlayr can log card purchases for you through Apple’s Shortcuts app. You install our shortcut from an iCloud link in Settings › Apple Pay and turn on the automation yourself.

When the automation runs, Shortcuts gives Outlayr the amount, merchant, and card name of an Apple Pay purchase, or the title and text of a notification from an app you pick, such as your bank. Outlayr reads the amount and merchant, matches the card to one of your accounts by name, and adds the entry. An Apple Pay purchase is read on your phone and nothing from it is sent to us. A notification that shows an amount is also read by Anthropic when Smart fill is on. The automation runs for every notification from the apps you pick in it, so pick only your bank and card apps. The new entry is then like any other: it syncs if sync is on, and its merchant name can be used for a merchant suggestion.

Notification access on Android

On Android, Outlayr can log purchases from your notifications. Nothing is read until you open Settings › Auto-logging, tap Allow notification access, and turn it on for Outlayr in Android’s settings.

With access on, Android shows Outlayr every notification your phone receives. Outlayr checks each one on your phone for an amount and ignores the rest. For an app that sends one with an amount, it keeps the app’s name and the title and text of its latest such notification, for up to 20 apps, so it can list them under Log from. It logs purchases only from the apps you turn on there, and Google Wallet starts on. From those, it reads the amount, the merchant, and the card a Google Wallet notification names, matches the card or app to one of your accounts, adds the entry, and confirms it with a notification of its own. It also keeps the text of the last 5 notifications it logged.

Notifications from apps you haven’t turned on are never sent to us or anyone else. When Smart fill is on, a notification that shows an amount from an app you turned on is also read by Anthropic before the entry is added. The new entry is then like any other: it syncs if sync is on, and its merchant name can be used for a merchant suggestion. To stop, turn an app off under Log from, or turn off notification access for Outlayr in Android’s settings. Deleting the app removes what it kept.

AI assistants

You can connect an AI assistant that supports the Model Context Protocol (MCP), such as Claude, to your Outlayr account. Nothing is connected until you add Outlayr in the assistant, sign in to your Outlayr account on tryoutlayr.com, and approve the assistant on a screen that shows its name and the site your access goes to. If the assistant gave you a link instead, that screen shows a code to compare with the one your assistant shows. We ask for that approval every time an assistant connects.

Once approved, the assistant can read what your devices last synced: entries, categories, accounts and their balances, budgets, and upcoming charges. With Outlayr Pro it can also add an expense or income, which reaches your devices through sync like any other entry. Without sync, there is nothing on our servers for it to read.

What the assistant reads, and what you tell it, goes to the company that runs it and is handled under that company's privacy policy. We don't send it anywhere else.

To keep the connection working, we store the assistant's name and web address, your approval and what it may do, when it last used its access, and its access keys, which we keep only as a one-way hash. Access keys last one hour, and the assistant renews them while you stay connected. A renewal key that goes unused for 30 days expires. An assistant connected from a link gets a one-hour key it can't renew. If you remove Outlayr from the assistant, its access expires within 30 days. Deleting your account removes it at once, and you can write to support@tryoutlayr.com to have it removed sooner.

Outlayr Pro

Payments for Outlayr Pro go through your app store (Apple’s App Store on iPhone, Google Play on Android). We never see your card details or your app store account details.

On the web, payments go through Stripe, and its Link service is the seller. When you start a checkout, we send Stripe your name, email, account ID, and the plan you chose. You enter your payment details and billing address on Stripe’s page, and we never see your full card number. We use the country your request comes from to choose the price and do not store it. To show your plan and payments on the web, our server reads them from Stripe and does not keep them.

RevenueCat manages subscription status for us. When the app opens, RevenueCat’s software checks whether you have Pro. Before you sign in it uses a random anonymous ID. After you sign in it uses your Outlayr account ID, and the app also sends your name and email so we can find your purchases when you write to us. RevenueCat receives your app store purchase and subscription records and basic technical details, such as the app and operating system versions.

Our server asks RevenueCat about your account ID to confirm Pro, and RevenueCat tells our server when your subscription changes. We keep a copy of your subscription records, such as the product, dates, price, and store country, and delete it with your account.

Invites

Signed in, you get an invite code. Anyone who opens your code or link in the app sees your first name.

When a friend claims it, we record who invited whom, their first name, on how many separate days they synced a new entry, up to three, and when the third one landed. Your invite page lists each friend’s first name, that count and that date, never their entries or amounts. To check that a friend’s account is new and never had Pro, our server asks RevenueCat about it.

Months of Pro from invites are granted through RevenueCat. Your invite code, the invites you sent, the invite you claimed, and any months waiting for your paid plan to end are deleted with your account, and your name leaves your friends’ lists. If the invite you claimed already earned your friend a month, it stays on their list without your name, so it still counts toward their yearly limit.

Device permissions

The app asks for each permission the first time a feature needs it. You can change them in your phone’s Settings app.

• Camera: taking a photo of a receipt to scan.
• Photos: choosing a receipt to scan, a screenshot of an installment plan to import, or a custom image for a transaction or account.
• Microphone: recording an entry you speak, only while you speak.
• Face ID: unlocking Outlayr when the lock is on.
• Notifications: the reminders you turn on, and the confirmation when Outlayr logs a purchase for you.
• Notification access (Android): reading notifications to log purchases, as described in Notification access on Android.

Outlayr doesn’t ask for your location or contacts, or for permission to track you.

Service providers

These companies help run Outlayr. Each receives only what its job needs.

• Hetzner hosts the servers in Helsinki, Finland, that run our database and server functions. They hold your account and synced data, and handle every request to our server.
• Cloudflare stores the photos you attach to entries and accounts (Cloudflare R2), when photo backup is on, and sends our emails (sign-in codes, the welcome and Pro notes, and notice of changes), for which it receives your email address and the email’s contents.
• Anthropic provides the Claude AI models behind suggestions, notification reading, voice entry, receipt scans, installment plan imports, CSV import, bank statement PDF import, and web lookups. It receives the content described in Suggestions, voice, and receipts.
• ElevenLabs turns voice recordings into text. It receives the recording and your language.
• RevenueCat tracks subscription status. It receives an anonymous ID, or your account ID, name, and email once you sign in, and your purchase records.
• Apple provides Sign in with Apple, App Store payments, and iOS features such as Siri and Shortcuts, under its own policy.
• Google provides Sign in with Google and Google Play payments, under its own policy.
• Stripe processes purchases on the web, and its Link service sells them. It receives your name, email, account ID, the plan you chose, and the payment details and billing address you enter at checkout.
• Expo delivers app updates. It receives a random install ID, the app version, your IP address, and update error messages.
• PostHog provides usage analytics and crash reports, from servers in the United States. It receives the events described in What the app sends even without an account, a random install ID, and your account ID once you sign in, plus the records of AI requests our server sends. It also receives this website’s analytics, described in This website.

Open Exchange Rates, CotizaVE, and Binance publish the exchange rates our server reads. They receive nothing about you.

No ads or tracking

Outlayr contains no advertising software. Its only analytics are the PostHog events described above and the records of AI requests, which we use to fix crashes, learn which features to improve, and keep AI costs in check. Outlayr doesn’t use your device’s advertising identifier and doesn’t track you across other companies’ apps or websites.

We publish totals from these events, our servers, RevenueCat, and GitHub on tryoutlayr.com/open, such as how many installs opened the app this week, how many entries were saved, and from how many countries. They are counts across everyone, never anything about one person.

We don’t sell your personal information, share it for targeted advertising, or use it to build a profile of you. We don’t use your data to train AI models.

This website

This website uses PostHog to learn how people use it. As you browse, it sends the pages you view and the page that sent you, clicks, how far you scroll, how fast pages load, errors, and a recording of the visit (clicks, scrolling, and what was on screen, with anything you type hidden). Each event carries your browser, operating system, language, time zone, and screen size. Events reach PostHog through relay.tryoutlayr.com, and PostHog discards your IP address. They are never linked to your Outlayr account.

If you sign in on this site, to connect an AI assistant or to open your ledger, it keeps your session in cookies so you stay signed in. Those cookies are needed for sign-in and aren't used for analytics.

With Outlayr Pro, opening your ledger here saves a copy in your browser's storage so the page loads without waiting for our server. It isn't encrypted, like the ledger on your phone, so anyone using your browser profile could read it. A small cookie notes that the copy exists and holds nothing else. Signing out on this site deletes the copy from that browser.

To recognize you on later visits, PostHog keeps a random ID in a cookie and your browser’s storage. If you’re in the EEA or UK, or your browser sends Global Privacy Control, the site asks before setting it and records nothing until you answer. Elsewhere it’s set on your first visit. Change your answer at any time in the footer under Cookies. Your answer is kept in your browser.

If you decline, the site still counts your visit without a cookie. PostHog turns your IP address and browser into a code that changes every day, so it can’t recognize you on a later day, and the visit isn’t recorded.

The site’s fonts, images, and video are served from the site itself. The company that hosts it may keep standard request logs, such as your IP address, browser user agent, the page requested, and the time, to deliver and protect the site. Links to other sites, such as the App Store, lead to services with their own policies.

Legal bases

If you’re in the European Economic Area or the United Kingdom, we rely on these legal bases:

You can object to any processing based on legitimate interests by writing to support@tryoutlayr.com.

How long we keep data

The table above lists how long each kind of data is kept. A few details behind it:

• Synced data, including deletion records for entries you deleted, and backed-up photos are kept until you delete your account.
• Voice conversations are deleted when you close the voice screen, or one hour after your last message.
• Recordings pass through our server to ElevenLabs, and receipt photos, installment plan screenshots, and notification text to Anthropic. We don’t store any of them.
• The Notion access key and your Notion user ID are kept until you disconnect Notion or delete your account. Rows read from Notion aren’t kept on our servers.
• AI assistant connections (the assistant’s name and address, your approval, and its access keys) are kept until you delete your account. Access keys stop working after an hour, or after 30 days without renewal.
• Merchant suggestion requests aren’t kept once answered. Ones queued in the background wait on our server until your device collects the answer.
• Your app language and the record of which welcome, Pro, and change notices you got are deleted with your account.
• Usage counters that enforce limits on scans, voice entries, suggestions, and notification reading hold counts only, keyed to your account ID, and are deleted with your account.
• Invite records (your code, who invited whom, first names, days logged, and months earned or waiting) are deleted with the account they belong to. An invite that earned a month loses the friend’s name when the friend’s account is deleted, and stays until the inviter’s account is deleted.
• Items in the shared merchant list aren’t linked to anyone. They’re refreshed after 30 or 90 days.
• Analytics events linked to your account are deleted with it. PostHog erases them in a later batch, so they can remain for a while after the app reports the deletion finished. Events from an install that never signed in carry only a random install ID and are kept under PostHog’s retention policy. Records of AI requests sent while Share analytics was off carry a random ID instead of your account ID, plus the conversation ID for voice entry, and are kept the same way.
• Website events carry a random browser ID, or a code that changes daily if you declined cookies, and are kept under PostHog’s retention policy.
• Our providers, including Anthropic, ElevenLabs, Apple, Google, and Expo, and Notion if you connect it, keep the data they receive under their own retention policies.

Deleting and exporting

Delete your account

Open Settings › Account › Delete account. You may be asked to sign in again to confirm. Deletion then runs in this order:

• Outlayr’s access to your Apple or Google sign-in is revoked. For Apple, our server asks Apple to revoke it. For Google, the app does.
• If you connected Notion, our server asks Notion to revoke Outlayr’s access key.
• Your synced ledger, deletion records, backed-up photos, and pending suggestion requests are deleted from our servers.
• Your customer records at RevenueCat and Stripe and our copy of your subscription status are deleted.
• Your profile at PostHog and every analytics event linked to it are deleted. PostHog erases the events in a later batch, so they can remain for a while after the app reports the deletion finished.
• Your usage counters, open voice conversations, sessions, AI assistant access, sign-in links, Notion access key, invite code and invites, and account are deleted. If the invite you claimed already earned your friend a month, it stays on their list without your name.

It starts right away and runs from your device. If it’s interrupted, open Settings › Account again and the app picks up where it stopped. If you can’t use the app, write to support@tryoutlayr.com. Delete your account has these steps on one page.

Afterward, a record that a deletion happened, with no link to you, is removed within two days of it finishing.

Deleting your account doesn’t cancel an Outlayr Pro subscription, because your app store (Apple’s App Store on iPhone, Google Play on Android) bills it. On iPhone, cancel it in the Settings app under your name, then Subscriptions. On Android, cancel it in the Google Play Store app under your profile picture, then Payments & subscriptions, then Subscriptions. Your app store keeps its own purchase records. A subscription you bought on the web is different: deleting your account cancels it and deletes your customer record at Stripe, and Stripe and Link may keep the purchase records the law requires.

Erase this device

Your ledger on the phone stays after you delete your account, unless you choose Delete account and erase this device. That also removes Outlayr’s database, photos, widget data, Spotlight entries, scheduled reminders, and stored sign-in details from the device. The system keeps control of permissions and widget placement.

Without an account

Nothing of your ledger is on our servers. Settings › Erase data clears your transactions, and your budgets if you choose, from the phone. Entries already in Recently deleted stay there. Deleting the app removes the whole ledger from the phone, but an iCloud or Google backup of the phone can keep a copy and restore it if you reinstall Outlayr.

Export first

Settings › Export data offers two files. Export CSV is a readable copy of your transactions for a spreadsheet. Export a full archive carries every entry, category, and budget in full and can restore your ledger later. You choose where either file goes.

Your rights

Depending on where you live, you have the right to:

• know what personal data we hold about you and get a copy;
• correct it;
• delete it;
• receive it in a portable format;
• restrict or object to how we use it;
• withdraw a permission you gave, without affecting what happened before.

Most of this works in the app: edit or delete entries, export your data, turn features off, or delete your account. For anything else, write to support@tryoutlayr.com. We may ask you to write from the email address on your account so we can confirm the request is yours. We answer within one month.

In the EEA or UK, you can also complain to your local data protection authority, or in the UK, the Information Commissioner’s Office. We’d like the chance to help first.

US state privacy rights

If you live in California or another US state with a privacy law, this is what we collected in the past 12 months and who received it for a business purpose.

It comes from you, your device, Apple, and Google, and we use it for the purposes described in this policy. We keep it for the periods in Data at a glance.

We don’t sell personal information or share it for cross-context behavioral advertising, and we haven’t in the past 12 months. We don’t use sensitive personal information to infer anything about you.

You can ask to know, delete, or correct your personal information, and you won’t be treated differently for asking. An authorized agent can ask for you if we can confirm you gave permission. If we turn down a request, reply to our answer to appeal.

Because we don’t sell or share, there is nothing for a Global Privacy Control signal to opt you out of, but we treat one as a valid opt-out request: this website then asks before setting its analytics cookie, wherever you are. Do Not Track has no agreed meaning, so the site doesn’t respond to it.

Security

• Traffic between the app, our servers, and our providers travels over encrypted HTTPS connections.
• Every request for your data is tied to your signed-in session, and our server decides whose data a request can touch. One account can’t read or write another’s ledger or photos.
• Sign-in refresh tokens and the Notion access key are encrypted before we store them.
• Requests to Anthropic and ElevenLabs carry no name, email, or account ID, apart from what a bank statement you import shows.
• You can lock Outlayr behind your device’s biometric lock (Face ID or Touch ID on iPhone).

No system is perfectly secure. If you find a security problem, write to support@tryoutlayr.com, and if a breach affects your data we’ll tell you as the law requires.

International transfers

Our servers are in Helsinki, Finland, in the European Union. danestves LLC is a US company, and Anthropic, ElevenLabs, RevenueCat, Stripe, Expo, PostHog, Cloudflare, Apple, Google, and Notion process the data they receive mainly in the United States, whose laws may protect it differently from your own. Write to support@tryoutlayr.com for details of the safeguards that apply.

Children

Outlayr isn’t directed at children under 13, and we don’t knowingly collect their personal data. If you live in the EEA or UK and are under 16, or under the age of digital consent where you live, don’t create an account without a parent’s or guardian’s permission. If you believe a child has given us personal data, write to support@tryoutlayr.com and we’ll delete it.

Changes

When this policy changes, we’ll post the new version here and update the effective date above. Before a material change takes effect, the app shows what changes, and if you have an account, we email you too. A change is material if it affects what we collect, who receives it, how we use it, how long we keep it, or your rights and obligations. Other changes, such as clearer wording or a better free plan, are only posted here.

Contact

Questions about this policy or your data go to support@tryoutlayr.com. For help with the app itself, see Support.

We keep emails you send us as long as we need them to help you, and delete them if you ask. Contact support in Settings opens an email that already lists the app version, operating system version, and device type, which you can edit before sending.