Back to VeroSpend

VeroSpend Privacy Policy

Local financial records. Optional cloud AI. Clear choices about what you share.

Effective: October 23, 2026
App: VeroSpend (com.choloasis.spendiary.app) on iPhone, iPad, and Mac
Publisher: QnSub Tech
Privacy contact: info@qnsub.com

This policy covers the VeroSpend app and its Cloudflare backend. It replaces the earlier policy that described VeroSpend as entirely local. Optional encrypted Cloud sync, cloud AI, document analysis, opportunity research, and credit wallets use online services.

  • Your tracker records stay on your device unless you export, share, or choose a cloud feature that sends the information described below.
  • Cloud sync is optional and end-to-end encrypted. If enabled, Cloudflare stores encrypted financial records, receipt attachments, completed chats, and a shared wallet credential so your devices can sync.
  • Cloud AI is optional. Before using it, you must accept the in-app explanation of the information sent to our backend and AI providers.
  • Credits use a server wallet. Wallet identifiers, balances, and verified Apple purchase information are retained to provide credits and prevent duplicate grants or charges.
  • We do not sell personal data or track you across other companies’ apps or websites. Service providers process information to deliver the features you use.

1. Financial records on your device

VeroSpend stores profiles, preferences, accounts, balances, income, expenses, budgets, savings goals, debts, recurring items, and any saved asset or rental-income details locally. Photos you attach to records are also stored locally. Manual tracking does not require a separate VeroSpend sign-up or a bank login, and VeroSpend does not connect to your bank credentials or move money.

Records stay local until you enable Settings → Cloud sync and connect devices using a private sync code. Exports, imports, device backups, or other sharing features you choose may create additional copies.

Optional encrypted Cloud sync

Cloud sync includes financial profiles and records, receipt attachments and saved images, bill reminder preferences, completed Vero chats and remembered context, and the credential for your shared credit wallet. Active and queued chat requests stay on their originating device. Notification permission stays specific to each device. The latest saved change wins for the same record; separate offline entries are retained, and deletions propagate when devices reconnect.

Your device encrypts synced contents using AES-256-GCM before upload. The private sync code contains the key, stays in your device Keychain, and is never sent to Cloudflare. The service stores ciphertext, opaque record identifiers, revision timestamps, deletion markers, and a hash of the sync authorization credential. It also processes ordinary network and request metadata. Anyone with your private sync code can access the synced data and wallet. Keep it private; we cannot recover a lost code.

Encrypted records and deletion markers remain until you choose Delete cloud copy in Cloud sync. This removes that cloud space’s encrypted records and attachments and prevents linked devices from reconnecting to it. A minimal deleted-space marker is retained to prevent accidental recreation. Local copies and the separate credit ledger are kept. Pausing sync queues local changes for later; disconnecting stops this device from syncing without deleting its local data. Cloud sync does not require consent to cloud AI, and enabling it does not send synced content to an AI model.

2. AI Chat and Financial Guide

After you opt in and send a question, the app sends your message and an aggregate financial summary to VeroSpend’s Cloudflare Worker to provide a personalized answer. The summary can include income, spending, budget, savings, debt, and asset totals relevant to the feature.

  • Financial Guide: up to eight recent messages are included for context. Its conversation session clears when you close it.
  • AI Chat: up to 24 recent messages, earlier statements remembered locally for the selected profile, and proposed setup facts and labels saved through chat may be included. Context is limited to fit each request. Chat history is saved locally per profile and can also sync encrypted when Cloud sync is enabled. Clearing it removes remembered statements and propagates to connected devices.
  • Providers: AI Chat and Basic guidance use Cloudflare Workers AI. Pro Deep Analysis uses OpenAI with response storage disabled in the API request; Apple-signed subscription information is used to verify Pro access. This setting does not eliminate providers’ separate security or abuse-prevention processing.

For AI requests, the app does not automatically send raw transaction rows, saved merchant names, saved account identities or numbers, attachments, addresses, bank credentials, or employer labels outside chat setup. However, anything you type or dictate into the conversation is part of your message, including names or other sensitive details you choose to include.

In supported app versions, a clear completed purchase you describe can be validated and saved automatically as an expense, with a confirmation in chat. No payment account is inferred. Monthly profile changes and scanned document drafts require review and confirmation. AI output may be incomplete or wrong and is not professional financial, legal, tax, or employment advice.

3. Receipt and screenshot analysis

When you select a receipt, screenshot, or camera image in AI Chat, text recognition runs on your device. You can review and edit the recognized text before choosing Analyze.

  • Only the reviewed text, profile currency, language, and category names are sent to Cloudflare Workers AI to identify the document and prepare tracker drafts.
  • Image pixels are not uploaded for this AI analysis. Remove sensitive information from the recognized text before analyzing if you do not want it processed.
  • Draft entries are saved only after you review and confirm them.
  • Raw images and OCR text are not saved in chat history. A brief analysis summary and save confirmations may remain in that profile’s local chat. Separately, photos you deliberately attach to tracker records are saved locally and included in encrypted Cloud sync if you enable it.

4. Opportunity research

Find opportunities uses Cloudflare Web Search with Ceramic and may retrieve a limited set of official public provider, government, and property-marketplace pages. Search requests contain general topic terms and your country, not your original question, financial totals, account or property names, or chat history.

Cloudflare Workers AI compares source excerpts with your financial summary and recent conversation to suggest opportunities and next steps, with source links. Opening a source link takes you to that website, whose privacy practices apply. Excerpts, rates, eligibility, and availability can be outdated; verify details with the provider.

5. Microphone and speech recognition

Voice features request microphone and Apple Speech permission when needed. VeroSpend uses Apple’s speech frameworks and requests on-device recognition when supported. Depending on your device, language, and the available speech recognizer, Apple’s speech service may process audio on its servers. VeroSpend does not upload your audio to its own backend or AI providers or save it as a recording.

Speak to Vero automatically sends the completed transcript to AI Chat after you finish speaking, using the same cloud consent and data handling described above. Dismissing the recording cancels the current capture. Where available, local Voice Quick Add parses a transcript on the device to create an entry without sending that text to VeroSpend’s cloud AI.

6. AI credits, Apple purchases, and wallet sharing

One credit covers one completed AI inquiry and reply or one document analysis. Local entries use no credits. Automatic retries reuse the same inquiry identifier and do not cost extra. Failed opportunity research is not charged.

A verified Apple app download receives 25 welcome credits once per Apple account and app in that environment. Starting the following UTC day, 2 daily credits reset at 00:00 UTC and do not accumulate. Daily credits are used first, then welcome credits, then purchased credits. Welcome and purchased credits do not expire. Replacing a wallet does not reset the free grants. TestFlight’s Sandbox and production wallets are separate.

Apple processes in-app purchase and subscription payments. VeroSpend does not receive payment card details. Our backend verifies Apple-signed app-download and purchase information to confirm eligibility, verify Pro access, and add each credit purchase once.

Cloudflare Durable Objects store the following to operate your wallet, prevent duplicate charges or grants, and recover purchase delivery:

  • A random wallet identifier and a hash of its authentication credential.
  • Daily, welcome, and purchased balances, inquiry identifiers, and verified purchase identifiers.
  • A one-way hash of an Apple app-download identifier to prevent repeated welcome grants.

Your private wallet recovery credential is stored in the device Keychain. You can recover the same wallet on another device or connect devices through Cloud sync to share its balance; using the same Apple ID alone does not automatically link wallets. Cloud sync sends the wallet credential only inside encrypted records. The previous wallet is saved in the device Keychain and can be recovered through AI credits. Wallet balances are not added together, and changing wallets does not reset free grants. Anyone with your recovery key can access that wallet. Save it privately before changing devices, and never send it to support or an AI chat. Clearing local finances does not delete or reset the server wallet.

7. Identifiers, security, and retention

Requests use a persistent, randomly generated installation identifier and wallet identifiers to provide app functionality, authenticate the wallet, and limit abuse. Financial information and user content submitted to cloud features can be associated with those identifiers; these requests are not anonymous. The backend uses one-way hashes of installation, network, and subscription identifiers for rate limiting. Cloud infrastructure also processes network/request metadata and diagnostic logs for service operation and security.

  • Retry protection: generated replies and proposed entries may be cached on the backend for up to 24 hours after completion. Financial details repeated in a reply may remain in this temporary cache.
  • Unfinished requests: incomplete replies and reservations expire after 10 minutes; unused credit reservations are released.
  • Questions and summaries: these are processed for the request and are not stored as question bodies or financial summaries in the credit wallet.
  • Wallet records: billing identifiers and balances remain while the wallet is in use. Hashed app-download grant records are retained to prevent repeat welcome grants after wallet replacement.
  • Providers: Cloudflare, OpenAI, and Apple may process information under their own security and abuse-prevention policies. The retry-cache limits above do not define those providers’ retention periods.

Online requests use HTTPS. Our providers may process information outside your country. See Cloudflare’s privacy policy, OpenAI’s API data controls, and Apple’s privacy information. VeroSpend does not include advertising or third-party analytics SDKs.

8. Other optional permissions and connections

  • Camera and Photos: used for images you choose to scan or attach, and supported exports. VeroSpend reads selected images rather than uploading your photo library.
  • Location: if you choose country detection, the app requests a one-time location and uses Apple’s geocoding service to determine your country and currency. The location reading is not saved in the tracker or sent to VeroSpend’s AI backend. You can pick the country manually instead. Your selected country may be included in opportunity research.
  • Face ID, Touch ID, or passcode: optional App Lock uses Apple’s authentication framework. VeroSpend receives an authentication result, not your biometric data.
  • Local network: where Nearby Sharing is available, paired devices exchange selected tracker data directly using Apple’s MultipeerConnectivity framework, rather than through VeroSpend’s cloud backend.
  • Market rates: supported currency conversions request currency codes and dates from Frankfurter. Crypto quotes request coin identifiers and a quote currency from CoinGecko. Those services receive ordinary connection metadata such as your IP address, but not your balances, transaction rows, wallet recovery key, or bank credentials.

9. Backups, exports, and support

Exports, shared reports, and device backups may contain financial information and attachments. Copies saved to Files, iCloud, another device, or another service are governed by that destination’s settings and privacy practices. Removing data in VeroSpend does not remove copies you exported or backed up.

If you email us, we receive your email address and the message and attachments you send to resolve your request. Include only the information needed to explain the issue. Redact financial details from screenshots and never include a private sync code, wallet recovery key, payment card details, bank credentials, or Apple password.

10. Your controls and deletion requests

  • Disable cloud AI in the app’s Settings to stop using cloud guidance. This does not automatically delete earlier server wallet records or replies awaiting cache expiration.
  • Clear a profile’s chat history and remembered statements in AI Chat, or delete tracker records. With Cloud sync connected, deletions propagate to linked devices. Disconnect first if you want to reset data only on this device; pausing sync alone queues changes for later.
  • Pause automatic sync, disconnect a device, or choose Delete cloud copy in Settings → Cloud sync. Cloud-copy deletion removes encrypted synced contents, but keeps local copies and the separate credit ledger.
  • Revoke Camera, Photos, Microphone, Speech, or Location permission in your device’s privacy settings.
  • Manage Apple subscriptions through your Apple ID subscription settings.
  • For access, correction, wallet deletion, or other privacy requests, email info@qnsub.com. We may need to verify control of the relevant wallet without asking for its recovery secret. Some purchase, anti-fraud, or legally required records may need to be retained.

Uninstalling the app does not delete the cloud sync copy or server wallet, or guarantee removal of Keychain credentials, backups, or exported files. Save your wallet recovery key and private sync code privately before uninstalling if you want to retain access.

11. Children

VeroSpend is intended for adults managing personal or household finances and is not directed to children under 13. Contact us if you believe a child has submitted personal information through a cloud feature.

12. Changes and contact

We update this page and its effective date when our privacy practices change. If the information shared with cloud AI materially changes, the app may require renewed consent before using that feature.

Privacy questions and requests: info@qnsub.com. For app troubleshooting, see VeroSpend Support.