Your spending secrets stay between you, your device, and the features you choose to use.
Last updated: January 10, 2026Haelan Labs ("we," "us," or "our") operates the Pico spending tracker application ("the App"). This Privacy Policy explains how we collect, use, and protect your information when you use our App.
We are committed to protecting your privacy. Your spending data is stored locally on your device by default, and we collect only the minimum information necessary to provide our services.
Account information: When you create an account, we collect your email address and name through Apple Sign-in, Google Sign-in, or email authentication. This information is stored securely with our authentication provider, Supabase.
Spending data: Your transactions, including amounts, descriptions, categories, and dates, are stored locally on your device using Apple's SwiftData framework. This data remains on your device and is not uploaded to our servers.
Voice input: When you use voice input to log expenses, audio is processed entirely on your device using Apple's Speech Recognition framework. No audio recordings are transmitted to external servers.
AI-generated content: To provide personalized spending commentary, transaction summaries may be sent through an OpenRouter-hosted LLM for processing. These summaries include only the item description and amount. Your identity, account information, and complete transaction history are never shared.
Usage analytics: We collect anonymous, privacy-preserving metrics about app usage to improve categorization accuracy. These metrics include aggregate statistics about category selections and do not contain personal spending details.
We use the information we collect to:
Local storage: Your spending transactions are stored locally on your device using Apple's SwiftData framework. Your data is protected by iOS Data Protection, which automatically encrypts files when your device is locked.
Cloud services: Account authentication data is stored with Supabase, a secure cloud platform. All data in transit is encrypted using TLS 1.3.
Security measures: We implement industry-standard security measures to protect your information, including encryption at rest and in transit, secure authentication protocols, and regular security assessments.
Supabase: For user authentication and account management. Supabase stores your email and name. Their privacy policy is available at supabase.com/privacy.
OpenRouter: For generating personalized spending commentary via a hosted LLM. Only transaction summaries, item and amount, are shared without identifying information. Their privacy policy is available at openrouter.ai/privacy.
Apple Services: For in-app purchases, authentication with Sign in with Apple, and on-device speech recognition. Apple's privacy policy is available at apple.com/privacy.
Google Sign-in: If you choose to authenticate with Google, we receive your name and email. Google's privacy policy is available at policies.google.com/privacy.
Local data: Your spending data remains on your device until you choose to delete it. You can delete individual transactions or all data through the App's settings.
Account data: We retain your account information for as long as your account is active. If you delete your account, we will delete your personal information within 30 days, except as required by law.
Analytics data: Anonymous aggregate analytics are retained indefinitely to improve our services.
You have the right to:
The App is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.
If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. We will take steps to delete such information from our systems.
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy in the App and updating the "Last updated" date.
Your continued use of the App after any changes constitutes your acceptance of the updated Privacy Policy.
If you have any questions or concerns about this Privacy Policy or our data practices, contact Haelan Labs at hello@haelanlabs.com.
We will respond to your inquiry within 30 days.
