Privacy Policy

Amy AI ("we", "us", "our") operates the Amy mobile application ("the App"). This Privacy Policy explains what personal information we collect, how we use it, and the choices you have.

1. Information we collect

a) Information you provide

• Account details — name, email address, and password hash when you sign up.
• Onboarding answers — age bracket, income bracket, savings goal, spending weakness (all optional and stored in your user profile).
• Savings goals and contributions — targets, dates, and progress you record in the App.
• Savings-group information — group names, invite codes, and member lists of groups you create or join.
• Messages to the AI coach — the text you send in chat is transmitted to OpenAI for generating replies. We do not store full conversation transcripts beyond ephemeral session state.

b) Information collected automatically

• SMS transaction data — with your explicit consent granted at onboarding, the Digitap Expense Manager SDK reads financial SMS messages on your device to extract transaction amount, merchant or payee, category, date, and debit/credit type. Amy stores the extracted transaction metadata for expense tracking, FDS scoring, behavioural insights, and AI coaching. Amy does not use SMS for OTP or account verification and does not sell SMS data.
• Device identifiers — a Firebase Cloud Messaging (FCM) push token and device type (Android/iOS) so we can deliver notifications.
• Usage analytics — Firebase Analytics events (screen views, feature taps) to understand which parts of the App are useful.

2. How we use your information

• To provide the App's core features: showing your spending history, tracking savings goals, calculating progress, and delivering AI-generated coaching messages.
• To send push notifications — welcome messages, spending insights based on your transactions, goal milestones, and optional weekly digests. You can disable these in your device settings at any time.
• To operate savings groups: sharing your display name and savings-score with other members of groups you have joined. We do NOT share your email with other group members.
• To improve the App via aggregated usage analytics.
• To comply with legal obligations.

3. Third-party service providers

We use the following processors. Each has its own privacy policy governing how they handle data on our behalf:

• Supabase — primary database, authentication, and storage.
• Google Firebase — authentication, messaging, analytics.
• Digitap — SMS parsing to extract transaction metadata from financial messages.
• OpenAI — generates AI coach replies, quiz questions, and notification copy. Messages are sent to OpenAI only when you interact with AI features; OpenAI's terms forbid training on API inputs by default.
• RevenueCat — subscription management (if you purchase a paid plan).
• Render — hosting for our backend API.

4. Data retention

We retain your account data for as long as your account is active. Transaction data is retained to provide historical insights. You can request account deletion at any time from the App's Settings screen or from our public deletion page at /legal/delete-account. After deletion we deactivate your login, stop app access, mark your account records as deleted, and process associated data deletion or retention handling within 30 days unless retention is required by law.

5. Security

We use industry-standard measures including HTTPS in transit, encrypted database storage at rest, row-level security policies to isolate user data, and secure secret storage on both server and device. No system is 100% secure, but we do our best to protect your information.

6. Children

The App is not intended for users under 18. We do not knowingly collect personal information from children under 18.

7. Your rights

You have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your account and associated data.
• Withdraw consent for SMS access (by revoking the permission in your device settings; the App will continue to work but will stop auto-ingesting new transactions).
• Export your data in a portable format.

To exercise these rights, use the in-app Settings → Delete Account flow, visit /legal/delete-account, or email care@amyapp.ai. We will respond within 30 days.

8. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top and, for material changes, notify you via in-app notification or email.

9. Contact

Amy AI  ·  care@amyapp.ai