Privacy Policy

Effective date: 27 July 2026

This policy covers the following apps ("the Apps"), published by
Jorge Villegas ("we", "us"):

• Finora Budget (budgeting & finance)
• Vitals Flow (health & habit tracking)
• Smart Utility Hub (pool & kitchen utilities)

Short version: we do not collect your data. The Apps have no user accounts, no
analytics, no advertising, no trackers, and no server that we operate. Your information
stays on your device (and, if you choose, in your own iCloud).

---

1. Information we collect

None. We do not operate any server or account system, and the Apps contain no
third-party analytics, advertising, attribution, or tracking software. We receive no
personal information from you, and we cannot see the data you enter.

2. Where your data lives

• On your device. Everything you enter — transactions, budgets, health readings, habits, pool and kitchen data — is stored locally on your device.
• Your iCloud (Finora Budget and Vitals Flow, optional). Both apps can synchronize your data across your Apple devices using Apple's CloudKit private database. This uses your iCloud account and is managed entirely by Apple; we have no access to it. See Apple's privacy policy at https://www.apple.com/legal/privacy/.
• Sync is a Pro feature in both apps, and each has a Settings → iCloud Sync switch to turn it off. In Finora Budget it is on by default once Pro is active; in Vitals Flow you turn it on yourself. Either way it only ever uses your own iCloud — never a server of ours.
• Smart Utility Hub does not use iCloud at all; its data stays on your device.
• Apple Health (Vitals Flow only, optional). With your permission, Vitals Flow reads from and writes to HealthKit. That data remains in your Health store under your control, is never transmitted to us, and is never used for advertising or shared with third parties.

3. Optional AI features (bring-your-own-key)

Some features can use an AI provider to help you — for example scanning a receipt, reading
a blood-pressure monitor, analyzing a pool test strip, or giving pool guidance. **These
features are off by default and work only if you add your own** API key for a
provider you choose:

• OpenAI — https://openai.com/policies/privacy-policy
• Anthropic (Claude) — https://www.anthropic.com/legal/privacy
• Mistral AI — https://mistral.ai/terms/#privacy-policy
• DeepSeek — https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html
• Google (Gemini) — https://policies.google.com/privacy
• Alibaba Cloud (Qwen) — https://www.alibabacloud.com/help/en/legal/latest/alibaba-cloud-international-website-privacy-policy

When you use such a feature, the relevant content (for example the image or text you are
processing) is sent **directly from your device to the provider you configured, using your
own account and key.** We do not receive, store, or have access to that content, or to your
key. Your use of a provider is governed by that provider's terms and privacy policy.
To disable this entirely, simply do not add an API key (or remove it in Settings).

Usage tracking (optional). In Finora Budget, Vitals Flow, and Smart Utility Hub you can turn
on organization-wide AI usage in Settings and add a second, separate OpenAI Admin key. It is
used for one thing only: reading your own token-usage totals back from OpenAI. **No content from
the Apps is ever sent with it** — it cannot be used to call an AI model at all. Like your other
keys it lives only in your device's Keychain, we never receive it, and it is deleted when you
turn the setting off. Leaving this off changes nothing about the AI features above.

4. Device permissions

The Apps request only what a feature needs, and the data stays on your device unless a
section above says otherwise:

• Camera — to scan receipts, a blood-pressure monitor, or a pool test strip.
• Bluetooth — to connect to a compatible body or kitchen scale.
• Face ID / Touch ID — to lock the app. Biometric authentication is handled by Apple's Secure Enclave; we never receive your biometric data.
• Notifications — for reminders you set (e.g. habit or bill reminders).

5. Sharing and selling

We do not sell, rent, or share your personal information with anyone. We do not track
you across other apps or websites, so no App Tracking Transparency prompt is shown.

6. Data retention and deletion

Because your data is stored on your device (and optionally in your iCloud), you control
it. Deleting an App removes its on-device data. iCloud data is managed in your Apple ID /
iCloud settings. Any backups you export are files you save and control.

7. Children's privacy

The Apps are not directed to children under 13 and do not knowingly collect information from
children. Since we collect no data at all, no such information is gathered.

8. Changes to this policy

If we change this policy, we will update the effective date above and post the revised
version at this URL. Material changes will be reflected before they take effect.

9. Translations

This policy is offered in other languages for convenience. **The English version is the
authoritative one**; if a translation and the English text ever disagree, the English text
governs.

10. Contact

Questions about this policy? Contact us at panosvigasdev@gmail.com.