This Privacy Policy explains how Coinleaf (“the app”, “we”, “us”), a personal-bookkeeping app for iOS developed by MO DONGLAN (an independent developer, under the “Xascade” brand), handles information. Coinleaf is designed to be local-first: your financial records live on your device, and we collect as little as possible.
The short version
- Your transactions, accounts, categories, and budgets are stored on your device and are never uploaded to us.
- There is no account to create — no name, email, or password.
- We do not use analytics, advertising, or third-party trackers, and we do not sell or share your data.
- The only network requests the app makes are to fetch exchange rates and to verify a Pro subscription — neither includes your financial records or personal identity.
- iCloud is optional and off by default. If you turn it on, your data syncs through your own private iCloud — we have no access to it.
Information stored on your device
Everything you record in Coinleaf — transactions, amounts, notes, accounts, categories, budgets, and recurring rules — is stored locally on your iPhone. We have no server-side copy of it and cannot see it. If you import a CSV or Excel file, or export your data, that happens locally through files you choose; the contents are not transmitted to us.
Optional iCloud storage
Coinleaf can optionally store your ledgers in your own iCloud so they stay backed up and in sync across your Apple devices. This feature is off by default; you turn it on yourself in Settings → iCloud. When enabled, your data is written to your private iCloud container and synchronised by Apple under Apple's Privacy Policy and iCloud terms.
We do not operate or have access to your iCloud, and your data still never reaches our servers — it moves only between your devices and your own iCloud account. You can turn iCloud off at any time (which returns to storing data on-device), and you can remove the iCloud copy from iOS Settings → your name → iCloud → Manage Account Storage, or by using Erase all data in the app.
Information sent to our services
Coinleaf makes only two kinds of network requests, both to services we operate:
1. Exchange rates
When currency conversion is enabled, the app requests up-to-date exchange rates from our rate service. The request contains only currency codes (for example, which base currency to use) — it never includes your transactions, balances, or any personal identifier. Rates are cached on your device. As with any internet request, our infrastructure provider receives your device's IP address and standard request metadata, which are used only to serve the response and to protect the service from abuse; they are not used to identify you or build a profile.
2. Subscription verification
Coinleaf Pro is an auto-renewable subscription sold through Apple. Purchases are processed by Apple; the app never sees your payment details. To confirm whether an active subscription exists for your installation, the app sends our subscription service Apple's transaction identifier and a random, per-installation identifier (an app account token — a UUID generated on your device). This lets us serve your subscription entitlement. It is not linked to your name, email, Apple Account, or any personal profile.
Payments and the App Store
All purchases and renewals are handled by Apple through the App Store under Apple's Privacy Policy. We do not receive or store your name, email address, or payment information.
What we do not collect
- No name, email address, phone number, or contacts.
- No precise or coarse location.
- No advertising identifiers, and no advertising.
- No third-party analytics, SDKs, or trackers.
- We never sell or rent your data, and we do not share it with data brokers.
Service providers
Our rate and subscription services run on Cloudflare, which processes requests on our behalf as our infrastructure provider. Apple processes your purchases. We do not use any other third parties to process your information.
Data retention
Because your financial data stays on your device, we do not retain it at all. The random subscription token and Apple transaction identifiers are retained by our subscription service only for as long as needed to provide your subscription entitlement. Exchange-rate requests are served from a shared cache and are not stored against you.
Security
All network requests use encrypted connections (HTTPS/TLS). Because we hold virtually no personal data, the impact of any incident is inherently limited — the sensitive information (your finances) never leaves your device.
Your choices and rights
You are in control of your data:
- Delete everything: use Settings → Erase all data in the app, or delete the app, to remove all local data from your device.
- iCloud: off by default; turn it on or off any time in Settings → iCloud. Turning it off returns to storing your data only on your device.
- Currency conversion: the rate service is only contacted when conversion is enabled.
- Subscription: manage or cancel any time in the App Store subscription settings; you may also request that we delete subscription records tied to your installation by contacting us.
Depending on where you live, you may have rights under laws such as the GDPR or CCPA to access or delete personal data. Since we cannot identify you from the minimal, non-identifying data we process, most of your data is already outside our reach — but you can always contact us with a request and we will help where we can.
Children
Coinleaf is a general-audience productivity app and is not directed to children. We do not knowingly collect personal information from children.
International users
Coinleaf is available worldwide. Our services run on globally distributed infrastructure, so requests may be processed at data-center locations near you. The data involved is limited to what is described above.
Changes to this policy
We may update this policy from time to time. When we do, we will revise the “Last updated” date above, and we will note any material change in the app or on this page.
Contact
Questions about this policy or your privacy? Email us at [email protected].