Last updated: May 2026

Data Retention Policy

This policy explains what data PennyRa collects, how long we retain it, and your rights over that data.

1. What Data We Store

–Account data: Email address, hashed password, and optional display name.
–Transaction data: All income and expense records you add, including date, amount, category, and notes.
–Subscription data: Plan type (Free/Plus/Pro), status (trial/active/cancelled), billing period, and renewal date.
–Usage logs: Anonymized activity data collected for debugging and security purposes.
–Payment records: Invoice dates and subscription history; credit card details are never stored.

–Active accounts: All data is retained as long as your account is open.
–Deleted accounts: When you delete your account, your personal data and transaction records are permanently deleted within 30 days. This window allows you to reverse the deletion.
–Backups: Disaster recovery database backups are retained for a maximum of 90 days and then permanently deleted.
–Payment records: Invoice and subscription history is retained for 7 years as required by tax and accounting regulations.
–Usage logs: Debugging and security logs are automatically deleted after 90 days.

–Export: Go to Settings → Export to download your transaction data in CSV format.
–Account deletion: Go to Settings → Delete Account to permanently delete your account and data. The process completes within 30 days.
–Access and rectification: Email hello@pennyra.com to request a copy of your data or correction of inaccurate information.
–Right to complain: If you are in the EU or Turkey, you may lodge a complaint with your local data protection authority.

–All data is stored in a Supabase PostgreSQL database with Row-Level Security (RLS) enabled.
–Data is only accessible for legitimate service operations and is never sold or rented to third parties.
–All connections are encrypted with TLS/HTTPS.