This Privacy Policy describes how Evan Paul Lazar (ABN 76318734086), trading as SinkWise ("SinkWise," "we," "us," or "our") collects, uses, and protects your information when you use the SinkWise app for iPhone (the "App"), the website at sinkwise.app, and the budgeting service offered through them (the "Service").
If you do not agree with this policy, please don't use the Service. Questions? Contact us via our contact page.
| Category | Examples | Why we collect it |
|---|---|---|
| Account & identity | From Sign in with Apple or Google: a unique account ID, your email address (or, if you choose Apple's "Hide My Email", a private relay address Apple creates), and your name if you choose to share it; account creation and last sign-in times. Accounts created on the former web app may also hold a securely hashed password and email-verification status from that time | To create, identify and secure your account |
| Age check | Before an account is created, the App asks for your date of birth. We do not store your date of birth; we store only that you confirmed you are 13 or older, and whether you are 18 or older | To keep SinkWise for people 13 and older, and to remind under-18s that a parent or guardian must approve a purchase |
| Financial data you enter | Funds (names, targets, due dates and how often a bill comes round, balances), your deposit and withdrawal history, your payday schedule, optional take-home pay and hours (for Price Check), spending you record or scan (shop, date, time, total, items, category, payment method label and tax shown on the receipt), and preferences such as theme and reminder times. Accounts from the former web app also hold that app's recurring bills and budget expenses, and other information described in Section 10 | To provide the core saving and budgeting features |
| Photos you scan | The photo of a receipt, bill or price tag, and the text your iPhone reads from it. With "Read Scans with AI" on, these are sent to our server and our AI provider to be read and are not stored by us. With it off, they never leave your iPhone | To read the details so you don't have to type them |
| Subscription | For App Store subscriptions: your SinkWise account ID, the product, purchase, renewal, trial and expiry dates and store transaction IDs, which Apple shares with our subscription provider RevenueCat. We never receive your card or payment details, which stay with Apple. For subscriptions bought on the former web app: Stripe customer and subscription IDs and plan status | To give you Premium and keep it in step with your purchases |
| Security & device data | A DeviceCheck token from Apple that confirms requests come from the genuine App on a real iPhone (it doesn't identify you), your IP address when you use AI scanning (stored only as a one-way hash, to limit scans per network), and short-lived server logs | To protect the Service from abuse and keep AI scanning affordable |
| Reminders | Payday and bill reminders are scheduled on your iPhone. We don't collect a device push token or send push notifications from a server | To remind you on payday and before bills |
| Communications | Your email address and the content of service emails we send you (for example, confirmation that your account was deleted, or notices about important changes to the Service) | To operate the Service and keep you informed about your account |
| Usage & analytics | The App has no analytics or advertising trackers. On the sinkwise.app website, Google Analytics data is collected only if you accept analytics cookies via our consent banner | To understand how the website is used (only with your consent) |
| Consent records | Your acceptance of the Terms and Privacy Policy and your age confirmation, with a timestamp and document version | To keep a record that you agreed, as required by law |
We don't ask for and don't want sensitive categories of data (such as government IDs, health, racial or ethnic origin, biometric data, or precise geolocation). Please don't enter them into free-text fields like fund or bill names. We do not collect biometric data.
We collect only the personal data that is actually needed to provide the Service — we do not collect data speculatively or beyond what the purposes in this table require.
"Read Scans with AI" (on by default; turn it off in the App under You → Read Scans with AI) uses a third-party AI model, currently provided by Anthropic:
Earlier AI features. AI Insights and AI News were features of the former web app and are not part of the App. They sent account data to Anthropic only when you ran them. Any results saved in your account are kept as described in Section 10 and are not shown in the App.
We process your information to: provide and operate the Service (your dashboard, funds, history); manage subscriptions bought through Apple (via RevenueCat) or, for earlier web subscriptions, Stripe; read scans with AI when you choose to; communicate with you about your account or security; monitor and improve the Service; and comply with legal obligations.
Your data is never sold, and never shared with any organisation or individual for their own use. No advertisers, no data brokers, no marketers — no one. We do not share your personal information for cross-context behavioural advertising, and we do not use your financial data to show you third-party advertising.
What we do use your information for is making SinkWise better: we use Google Analytics (only if you accept analytics cookies via our consent banner) and similar service tools to understand how the Service is used — which features people use, where errors happen, what's slow — solely so we can improve our services. These tools process data on our behalf and on our instructions; they are never given your data for their own purposes.
Consent boxes on sign-up are never pre-ticked. Where we ask for your consent, you must actively opt in.
If you're in the EU or UK, we rely on the following legal bases to process your personal information:
We never sell your personal information, and we never share it with any organisation or individual for their own purposes. Your information is disclosed only to the service providers ("sub-processors") we need to run and improve SinkWise. Each acts on our instructions, uses your data only to provide their service to us, and only receives as much as necessary:
We ensure each sub-processor is bound by data processing agreements that require them to protect your data. We may also disclose information if required by law, court order, or to protect the rights, property, or safety of SinkWise or others.
The Service may link to other websites we don't control. We're not responsible for their content or privacy practices, and visiting them is at your own risk.
We use cookies and similar technologies, described in full in our Cookie Policy. In short: essential cookies keep you signed in and can't be turned off; analytics cookies are optional and off by default until you actively accept them via our consent banner, which includes a genuine "Reject All" option.
You sign in to SinkWise only with Sign in with Apple or with Google. We receive basic profile information from them (your name if you share it, and your email address or an Apple private relay address) to set up your account. We never see your Apple or Google password. When you delete your SinkWise account, we also ask Apple to revoke SinkWise's access to your Apple ID. We don't control, and aren't responsible for, Apple's or Google's own privacy practices.
Signing in with an email address and password is no longer offered. If your account was created that way on the former web app and you can't sign in with Google using the same address, you can ask us for a copy of your data, to move it to a new account, or to delete it (see Section 13).
SinkWise is operated from Australia, and our service providers (Google Firebase, Apple, RevenueCat, Vercel, Anthropic, Resend, Stripe and Google Analytics) are based primarily in the United States. Because SinkWise has users worldwide, using the Service means your information may be transferred to, stored in, and processed in the United States, Australia and other countries whose data-protection laws may differ from your own.
Where we transfer personal data of users in the EU or UK, we rely on the European Commission's Standard Contractual Clauses (SCCs) — or their UK equivalent — incorporated into our agreements with each sub-processor. For transfers from Australia, we apply protections consistent with the Australian Privacy Principles. By using the Service, you understand your information will be handled as described in this policy regardless of where it is processed.
We keep your personal information for as long as your account is active and for a reasonable period afterward to comply with legal obligations or resolve disputes. Specific timeframes:
Once the applicable retention period expires, data is securely deleted or anonymised.
On your iPhone: to open instantly, the App keeps a copy of your account data on your iPhone while you are signed in. When you sign out or delete your account, the App deletes that copy.
Information from the former web app. When the web app closed, we did not delete any account or the information in it. Funds, deposits and withdrawals, bills and budget expenses appear in the App when you sign in to the same account. Other information has no matching feature in the App and is not shown there: for example the results of AI Insights and AI News, goal photo selections, automated-deposit schedules, payday check-in settings, plan-limit choices and any Squads. It stays in your account, protected and handled in the same way as the rest of your data, until you delete your account or ask us to delete it; you can ask us for a copy at any time. Accounts you can no longer sign in to (for example email-and-password accounts whose address is not a Google account) are kept until the account holder asks us to delete them, and we delete them on request.
We use reasonable technical and organisational measures to protect your information, including:
That said, no method of transmission or storage is 100% secure. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and, where required, notify the relevant supervisory authority within 72 hours of becoming aware of the breach.
We do not knowingly allow anyone under 13 to create an account. Before an account is created, the App asks for your date of birth. If it shows you are under 13, the account is not created and nothing you entered is saved to an account. We do not store anyone's date of birth: for people 13 and older we keep only the confirmation that they are, and whether they are 18 or older.
If you are between 13 and 17, you should only use SinkWise with a parent or guardian's knowledge. Any Premium subscription requires a parent or guardian's permission and use of a payment method they control.
If we become aware — through any means — that someone under 13 has created an account or provided us personal information, we will delete that account and all associated personal information as quickly as reasonably possible, and in any case within 5 business days of confirmation.
We do not collect biometric data, precise geolocation, or any data category beyond what is necessary to provide the Service. We do not use marketing or imagery primarily designed to appeal to children under 13.
If you are a parent or guardian who believes your child under 13 has created an account, please contact us immediately via our contact page.
Teen-specific note: If you are between 13 and 17 and located in a US state with specific teen privacy protections (such as California, which treats data of users under 16 as sensitive personal information under the CPRA, or states with additional parental consent requirements), we apply heightened protections to your data consistent with those laws. We do not sell or share the personal information of users we know to be under 18, and we do not use it for targeted advertising.
Depending on where you're located, you may have some or all of the following rights regarding your personal information. We will respond to verified requests within 30 days (or within any shorter period required by applicable law).
You can already do much of this yourself directly in the app:
For anything else — including a full data export, moving your data from an account you can no longer sign in to into a new one, a correction request, or any right listed above — contact us via our contact page, from the email address on the account so we can confirm it's you. We will respond within 30 days. If your request is complex or numerous, we may extend this by a further 30 days and will notify you of the extension.
If you're in the EU or UK and believe we're processing your data unlawfully, you have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, or the relevant EU supervisory authority in your member state).
Global Privacy Control (GPC): If your browser or browser extension sends a Global Privacy Control signal, we will treat it as a request to opt out of the sale or sharing of your personal information. Because we do not sell or share personal information for advertising purposes, this signal has no effect on how we process your data — but we acknowledge and honour it.
Do Not Track (DNT): Some browsers send a "Do Not Track" signal. There is currently no uniform legal standard for how websites must respond to DNT. We don't currently differentiate responses based on DNT signals, but we honour GPC as described above.
This section applies to residents of California and other US states with comprehensive consumer privacy laws. SinkWise is a small, early-stage service and does not currently meet the CCPA's revenue or data-volume thresholds that would make compliance mandatory. However, we believe your privacy rights matter regardless of those thresholds, and we will honour the rights described below to all users.
Categories of personal information we collect (as defined under CCPA):
Purposes for collection — to provide and operate the Service, process payments, secure your account, improve the product, and comply with legal obligations. We do not collect personal information beyond what is reasonably necessary for these purposes.
We do not sell or share your personal information for cross-context behavioural advertising. Accordingly, we do not offer a "Do Not Sell or Share My Personal Information" opt-out link — because there is nothing to opt out of. If this changes, we will update this policy and add the required link before doing so.
Global Privacy Control: We honour GPC browser signals as described in Section 14.
Sensitive personal information: We treat personal information relating to users we know or have reason to believe are under 16 years of age as sensitive personal information, and we do not sell or share it.
Your rights under CCPA / CPRA and similar state laws:
To make a request, contact us via our contact page. We will verify your identity before processing the request and respond within 45 days, with a possible extension of 45 additional days where reasonably necessary. Residents of Virginia, Colorado, Connecticut, Texas, and other states with similar comprehensive privacy laws may exercise the same rights. We may ask for information to verify your identity before fulfilling a request.
SinkWise is operated from Australia, and we handle personal information in line with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) to the extent they apply. You may ask us to access or correct your personal information at any time. If you believe we've mishandled your personal information, you can complain to us first via our contact page, and if you're unsatisfied with our response, you can escalate to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
We may update this policy from time to time. We'll update the "Last updated" date above, and material changes will be flagged in-app or by email. Continued use of the Service after a revised version is posted constitutes acceptance of the changes.
Questions about this policy or how your information is handled? Contact us via our contact page.
Evan Paul Lazar (ABN 76318734086), trading as SinkWise
our contact page