Privacy Policy
Last updated: 20 July 2026 · Version 1.0
This policy explains what we collect, why, and what you can do about it. It is written to comply with the Philippine Data Privacy Act of 2012 (RA 10173) and its implementing rules.
1. Who we are
IponPal is an independent product built and operated in the Philippines. For any privacy question, request, or complaint, contact us at hello@iponpal.com. We act as the Personal Information Controller for the data described below.
2. What we collect
| Data | Why we collect it | When |
|---|---|---|
| Name | To address you in the app | You type it at sign-up |
| Email address or mobile number | To restore your data if you change devices | You type it at sign-up |
| Monthly income (amount and type) | To calculate your budget and Financial Health Score | You type it at sign-up |
| Expenses, income entries, goals, and savings deposits — including any note you write | To show you where your money goes and to power coaching | Each time you log something |
| Optional "money mood" and "how your money feels" taps | To make coaching relevant to how you actually feel | Only when you tap one — always optional |
| Anonymous usage events (screens opened, features used) | To find what is broken and improve the app | While you use the app |
| Waitlist email address | To send product updates you asked for | Only if you submit the form on this website |
We do not collect: bank credentials, card numbers, government IDs, contacts, photos, or precise location. We never ask for your online banking password, and you should never give it to us or to anyone claiming to be us.
3. Legal basis
We process your data on the basis of your consent, which you give with the tickbox at sign-up, and which you can withdraw at any time by deleting your data. For the website waitlist, your consent is given when you submit the form.
4. Where your data lives
Your entries are stored on your own device and backed up to a private, access-controlled database so you do not lose your progress if you lose your phone. Access is restricted so that one user cannot read another user's records. We use the following processors:
- Supabase — database and authentication
- Vercel — website and app hosting
Our database is hosted in Singapore, so your data is stored outside the Philippines. RA 10173 permits this, and it does not reduce your rights: we remain accountable to you for that data under Philippine law, and we rely on our providers' contractual and technical safeguards to keep it protected to a comparable standard.
5. What we never do
- We do not sell your personal data. Not now, not later.
- We do not share or trade it with advertisers, lenders, or data brokers.
- We do not lend money, hold your money, or run any paluwagan or investment scheme.
- We do not show you ads based on your spending.
If we ever publish aggregate figures (for example, "users saved ₱X in total"), they are combined counts across many people and cannot identify you.
6. How long we keep it
We keep your data for as long as your account is active. If you delete your data in the app, your records are removed. Anonymous usage events that are not linked to your identity may be retained in aggregate form for product analysis.
7. Your rights under RA 10173
You have the right to be informed, to access, to correct, to erase or block, to object, to data portability, to damages, and to lodge a complaint. In practice:
- Access and portability — Profile → "Export my data (JSON)" gives you everything, immediately.
- Erasure — Profile → "Delete ALL my data" permanently removes your records.
- Correction — you can edit or delete any entry directly in the app.
- Objection and withdrawal of consent — email us, or simply delete your data.
- Waitlist — every update email has an unsubscribe link, or email us to be removed.
You may also complain to the National Privacy Commission at privacy.gov.ph.
8. Security
Data is transmitted over encrypted connections and stored in a database with row-level access rules, so your records are reachable only by you. No system is perfectly secure, and we will not pretend otherwise — but we do not hold the credentials that would let anyone move your money, because we never collect them.
9. Children
IponPal is intended for users aged 18 and above. We do not knowingly collect data from children. If you believe a minor has given us data, contact us and we will delete it.
10. Changes
If we change this policy in a way that materially affects you, we will update the version and date above and notify you in the app before the change takes effect.