Privacy Policy

Effective October 19, 2026

Draft — under legal review before public launch.

Ruckwise is a budgeting and financial planning app built for U.S. service members. This policy explains what information the operator of Ruckwise ("we") collects, how it is used and protected, and the choices you have. The short version: your financial data is yours, we never sell it, we don't show ads, and we don't use tracking or advertising tools.

Information that stays on your iPhone

Most of what you put into Ruckwise — transactions you enter, budgets, goals, plans and events, notes, your Leave and Earnings Statement (LES) pay details, and settings — is stored only on your iPhone, encrypted by iOS. It reaches our servers only if you turn on server sync or bank connections.

• LES scanning happens entirely on your iPhone. The image is never uploaded.
• The Ask assistant answers money questions using Apple's on-device intelligence or built-in calculations. Your questions and numbers are not sent to us or to any AI provider. For general-knowledge questions it can look a topic up on Wikipedia; only the short search words are sent to the Wikimedia Foundation, never your financial details or account information.
• Receipts and documents you scan into the Vault are read on your iPhone and stored there, encrypted. They are not uploaded.
• Your app passcode is stored only on your iPhone, as a one-way scrambled fingerprint in the iOS Keychain.

Information we collect when you create an account

• Account details: your email address, an optional name and rank, and your password (stored only as a one-way bcrypt hash — we can never see it).
• Security details: your two-step verification secret (encrypted), one-time recovery codes (hashed), and a list of your signed-in devices (the device type reported by your browser or app, and when it was last used).
• Data you sync: if you turn on server sync, the transactions and categories you choose to sync.
• Sign-in with Google or Apple: if you use it, the email address and an account identifier from Google or Apple. We never receive your Google or Apple password.
• Sign-in history: for your security, we record sign-ins, failed attempts and new devices with the time, the type of device, and a partial network address (for example, the first three parts of an IPv4 address). Full IP addresses are not stored in this history. When your account is used on a new kind of device, we tell you in the app.
• Notifications: if you allow push notifications, a device token from Apple so we can deliver them. It is deleted when you sign out or Apple says it is no longer valid.

Household sharing and parent mode

If you join a household, the balances and recent transactions of only the accounts you choose to share, and your monthly budget summary if you turn it on, are stored on our server so the members of your household can see them. You can stop sharing or leave at any time.

In parent mode, a parent creates a profile for their child with only a first name and an emoji. Allowance amounts, chores, savings goals and spending requests are stored with the parent's account. If the parent sets up the child's own phone, that phone signs in with a one-time code from the parent and can only see the child's own jars, goals and chores. We keep a record that the parent created the profile.

Support, feedback and usage counts

• Support requests: the messages you send us and our replies, the topic, and (if you choose) your app version and device model. On the website we also ask for an email so we can reply.
• Survey answers: your score, the ideas you pick and any comment, linked to your account if you're signed in.
• Anonymous usage counts: the app counts how often features are opened (for example, "Debt Planner was opened"). The server keeps only a total per feature per day and does not store who sent it. You can turn this off in Settings → Privacy.
• Website visit counts: our website counts page views per day, the name of the site that sent a visitor (for example, "google.com", never the full link), and which calculators are used. It sets no cookies and stores no IP addresses or identifiers.

Beta waitlist

If you join the waitlist on our website, we store your email address and the date you signed up, only to invite you to the beta and send launch news. Ask us at any time to remove it.

Bank connections (Plaid)

When you connect a bank, you sign in through Plaid Inc., a service used by many financial apps. Your bank username and password go to Plaid, never to us. Plaid then shares with us, read-only: your account names, the last digits of account numbers, account types, balances, investment holdings if you connect an investment account, and transactions (date, amount, merchant, category, and the merchant's logo link). We also get your bank's public name, logo and brand color from Plaid's directory to show in the app. Store logos load in the app directly from Plaid's logo service, which, like any website, can see that a logo was requested. We cannot move money, make payments, or change anything at your bank. Plaid's handling of your data is described in the Plaid End User Privacy Policy. You can disconnect a bank at any time in the app, which also revokes our access at Plaid.

How we use information

• To run the app: show your balances and transactions, keep your devices in sync, and send the notifications you turn on.
• To keep your account secure: verify sign-ins, detect abuse, and limit repeated attempts.
• To support you when you ask for help.

We do not sell or rent your information, use it for advertising, share it with data brokers, or use it to train artificial intelligence models.

Who else handles data

We use a small number of service providers, bound to use data only to provide their service to us:

• Plaid — bank connections (see above).
• Railway — hosts our servers and encrypted database in the United States.
• Apple — app distribution and, if you allow them, push notifications. Ask runs on Apple's on-device model.
• Google — only if you choose Continue with Google to sign in.
• Wikimedia Foundation — receives the short search words when Ask looks up a general-knowledge topic on Wikipedia.
• Have I Been Pwned — when you choose a password, we check whether it appears in known data breaches. Only the first five characters of a one-way hash of the password are sent; the password itself never leaves our server.

We may disclose information if required by law, such as a valid court order, and will notify you when the law allows.

How we protect information

All connections use encryption in transit (HTTPS). Our entire database is encrypted at rest with AES-256, and bank access tokens and two-step secrets are additionally encrypted with separate keys. Sign-ins can require two-step verification, and you can sign out every device at once. Backups are encrypted. See our Security page for details.

How long we keep information

We keep your account data while your account is open. If an account has no sign-ins or activity for two years, we delete it and disconnect its banks. When you delete your account in the app, it is erased from our live systems immediately and your bank connections are revoked at Plaid. Encrypted backups that may contain it are deleted within 30 days. Records of administrative actions (for example, that an account was deleted) are kept for security and legal purposes.

Your choices and rights

• Access and export: export your transactions from the app at any time (Settings → Export Transactions).
• Correction: edit any information in the app.
• Deletion: delete your account in the app (Settings → Server Sync → Delete Account), or erase all data on your iPhone (Settings → Erase All Data).
• Notifications: turn each type on or off in Settings → Notifications, or in iOS Settings.
• Usage counts: turn off anonymous usage counts in Settings → Privacy.

Depending on where you live, you may have additional rights under state privacy laws. Contact us to exercise them; we won't treat you differently for doing so.

Children

Ruckwise accounts are for adults 18 and older. Children can only use Ruckwise through parent mode, set up and controlled by a parent, which stores only the child's first name and the allowance details the parent enters. A parent can review, change or delete a child's profile at any time in the app (Settings → Kids), which also signs the child's phone out. We do not knowingly collect any other information from children; if you believe we have, contact us and we will delete it.

Not affiliated with the government

Ruckwise is an independent product. It is not affiliated with, endorsed by, or operated by the U.S. Department of Defense, the U.S. Army, or any branch of the armed forces.

Changes

If we make material changes to this policy, we will tell you in the app before they take effect.

Contact

Questions or requests: support@ruckwise.com.