Privacy Policy

Last updated: 17 October 2026

Hearth is a family budget you run by talking, so it hears about your money and your family. This page says plainly what it collects, what it never collects, who sees it, and how to take it all back.

The short version

• You don't need an account. Hearth gives your phone an anonymous account, and Sign in with Apple is optional.
• Your voice stays on your phone. Speech becomes words on the device; only the words go to our server, which has our AI provider, Anthropic, read them, and then discards them. Only the resulting entries are kept.
• Your household's budget is shared with the members of your household, and nobody else.
• Hearth never moves money, never asks for bank passwords and never reads bank balances.
• We never sell your data or share it for advertising. There are no advertising, attribution or analytics SDKs in the app or on this website.
• You can export everything as a CSV file whenever you like once your household has started the plan or its trial, even after it lapses, and delete your household or your account from the app. If you set up Hearth but never started the Family plan or its trial, or stopped partway through setup, write to [email protected] and we will delete everything: it leaves our active systems within 30 days.

Who we are

Hearth is made and run by Narek Keshishyan, an independent developer, who is the controller of your personal data. For anything about privacy, write to [email protected]. A postal address is available on written request to the same address.

Your account

The first time you open Hearth, the app creates an anonymous account for your phone. It makes a random device identifier and a random 256-bit secret, and keeps both in the iOS Keychain. Our server stores the secret only as a one-way hash, so the account works only from your phone. There is no email, no password and no profile to fill in.

Sign in with Apple is optional. If you use it, Apple sends us a stable identifier and, only if you choose to share it, an email address, which can be Apple's private relay address. We never see your Apple ID password. Signing in upgrades your anonymous account in place, so your household can follow you to a new phone.

We also keep your phone's language setting (for example en-US) and the push token Apple gives your phone, which our server uses for the silent sync pushes described under Notifications and sync, whether or not you allow notifications.

Your household

A household is the budget your family shares: its name, main currency and time zone; the members; the plan (categories, budget lines, income, savings goals, reminders, and accounts such as "Checking"); and every entry, with its amount, date, line, who it was for, who logged it, a short note, and, for another currency, the original amount and the rate.

It is stored on our server so that every family phone sees the same budget, and it is visible only to the members of your household. Every household request our server answers first checks that you belong to that household.

Adults in a household can see and change the whole plan and every entry. Personal fun-money lines show to the other adults as a total only. That is a courtesy in the app, not a lock: those entries still sync to every phone in the household.

Members can be people without phones: children, grandparents, or "Family". They are names, and nicknames or voice aliases like "the oldest", that an adult types or says so spending can be recorded for them. Hearth never contacts them. In this version, only adults join on their own phones.

Invites are 6-character codes that work for 7 days, once. A link made for one person can only be used to join as that person; a link made for no one can only be used to join as someone new. Share it only with the person you mean.

Voice and typing

Hearth listens only while you ask it to: while you hold the mic button, or for one sentence after you tap it or open Hearth's voice action from Siri, a shortcut or a widget. Speech is recognised on your iPhone by Apple's on-device speech recognition. The audio never leaves your phone and is not stored.

The words, the transcript, go to our server. Our server asks our AI provider, Anthropic, to turn them into entries, and sends it the transcript with what is needed to read it:

• your household's line names and aliases, the names of your categories, and the planned amounts: each line's budget, the price and count of a line like a car wash four times a month, and an amount you planned in another currency;
• member names, nicknames and aliases;
• the names of your incomes and who earns them, but not how much they pay;
• your most recent spending entries, each with its date, line, amount and who logged it, with no income entries and no transfers;
• your main currency, your time zone and today's date there.

Our server then discards the transcript. Only the resulting entries are stored. Anything you type goes the same way.

If your phone is offline, Hearth first tries to read the words on the phone itself. If it can't, they wait on your phone until they can be read, and are then deleted from it; words our server can't make sense of stay on your phone for you to finish by hand. If your household's plan has lapsed, the words are read on your phone only and never sent.

The spoken setup interview works the same way. Anthropic receives each answer and the draft of your household so far: the household's name, the people, incomes with the amounts you said, budget lines and accounts you have described, and the savings you set aside. Each answer is then discarded. The draft is kept on our server so you can pick up where you left off. It becomes your household when you finish, and it is deleted with your account.

What gets stored

• On your phone: the anonymous device identifier and secret, and sign-in tokens, in the iOS Keychain; a working copy of your household in the app's own database, so Hearth works offline; changes waiting to sync; words waiting to be read; and a small summary (what's left this month, the pace and the next payment) that Hearth's widgets and Siri shortcuts read on the phone.
• On our server: your account (the hashed secret, a hashed device identifier, your language, and the Apple identifier and email if you signed in with Apple); sign-in refresh tokens, stored hashed; your household, as above; invites; your setup draft, kept after you finish until your account or the household is deleted; subscription status; push tokens; a log of every change to those records (what changed, by whom and when), so phones can sync; and daily exchange rates.
• Counts, not content: tallies of how often reading what you said worked, fell back to Hearth's simpler reader, or failed, so we know when it breaks. They contain no words, amounts or names.

Spending sources (a later update)

Hearth does not catch spending by itself yet: everything in it today is something a person said or typed. A later update will add optional ways in. Each will be off by default, turned on by an adult for themselves, and switched off again in one tap. This policy will be updated before any of them ships. What each is planned to read:

• Apple Pay taps: an iOS Shortcuts automation that you set up passes the merchant, amount and card name of each tap. Nothing else in Wallet.
• Bank text messages: a Shortcuts automation passes the text of the messages you choose, for example those that mention your currency. Not your other messages.
• Forwarded receipts: a private address for your household at in.sayhearth.com. Only the emails you forward reach it, never your mailbox. Each email is read and then discarded; only the entries are kept.
• Statement files you share: read and then discarded; only the entries are kept.

Spending caught this way will land in "Needs a look" for a person to confirm, never straight in the budget. Connecting a mailbox directly (Gmail or Outlook) comes later still, and only after Google's and Microsoft's security reviews.

Money and banks

Hearth is bookkeeping only. It never moves money, pays bills or cancels anything. It never asks for bank passwords and never reads bank balances: when you check your savings against the bank, you type the balance yourself. Exchange rates come from a daily rates provider; our server asks it for the day's rates and sends nothing about you.

Notifications and sync

Every notification starts off; you choose the ones you want. To keep phones in sync, our server sends silent pushes through Apple when someone in your household changes something. They show nothing on screen and carry only an internal household identifier: no amounts, names or text.

How long we keep it

Your household is kept for as long as it exists.

• If you delete your account and other adults are still in the household, the household stays with them. Your member becomes an unlinked name, and the entries you logged stay with the family.
• If you are the last adult, the household is deleted with your account.
• The owner can delete the household for everyone.

A deleted account or household leaves our active systems within 30 days (usually at once), and encrypted backups roll off within 90 days after that. Something you delete inside a household, such as an entry, disappears from every phone at once, but earlier versions of it stay in our server's log of changes until the household itself is deleted. Transcripts, email bodies and statement files are never kept. Network logs (IP address, request time, the requested path, and the app and iOS version) are kept for at most 30 days, for security and debugging.

Companies that help run Hearth

A few companies help run Hearth. They process data on our behalf, under contract, and only for what is described here.

Anthropic, PBC

Reads the words you say or type, with the household context listed under Voice and typing (line, category, member and income names, planned amounts and recent spending), and turns them into entries. In the setup interview it reads each answer and the draft of your household so far, including the income amounts you said. Under its commercial terms it does not train its models on this data. It processes data in the United States.

Does not receive: your audio, your device identifiers, your Apple ID or any payment details. When you log spending, it gets no income amounts, no income entries and no transfers.

Fly.io, Inc.

Runs our servers, in Frankfurt, Germany.

Does not receive: your audio, which never leaves your phone. Fly.io hosts our servers and does not use the data on them for anything else.

Supabase, Inc.

Hosts our Postgres database in Frankfurt, Germany. Its public data API is switched off and row-level security is on, so only our server can read the database.

Does not receive: your audio, or transcripts, email bodies or statement files, which are never stored.

Apple Inc.

Distributes Hearth through the App Store, handles payment for the Family plan, provides Sign in with Apple, delivers push notifications, and recognises speech on your iPhone.

Does not receive: your budget, entries or transcripts from us. Our pushes carry only an internal household identifier, and speech recognition runs on the phone.

RevenueCat, Inc.

Keeps track of your subscription for us, from the App Store's transaction events. It processes data in the United States.

Does not receive: anything but a pseudonymous user identifier and those transaction events, plus the device and app details its SDK needs. No names, budget amounts, household data or text.

Sentry (Functional Software, Inc.)

Collects crash reports and errors from the app and our servers, with personal data turned off, so we can fix bugs. It processes data in the United States.

Does not receive: amounts, names, or anything you said or typed.

Cloudflare, Inc.

Serves this website. In a later update it will also receive the receipts forwarded to your household's receipts address and pass them to our server.

Does not receive: anything from the app today, and never your mailbox: only emails you choose to forward.

Open Exchange Rates

Provides the daily exchange rates Hearth converts other currencies with.

Does not receive: anything about you or your household. Our server asks it only for the day's rates.

We do not sell your personal information and we do not share it for advertising. There are no advertising, attribution or product-analytics SDKs (such as Mixpanel, Amplitude or Firebase Analytics) in the app or on this website. The crash reporting we do is the Sentry entry above.

This website

sayhearth.com sets no cookies and runs no analytics. It remembers whether you picked the light or the dark theme in your browser's local storage, under the key hearth-theme; that choice never leaves your browser. Cloudflare, which serves the site, sees the standard request data every website receives, such as your IP address.

Data security

Traffic between the app, our servers and this website is encrypted in transit (TLS), and our servers verify the database's certificate. Your phone's secret stays in the iOS Keychain, and our server keeps only its hash; sign-in refresh tokens are stored hashed too. Every request about a household checks that you belong to it. No system is impervious. If we learn of a breach that affects your data, we will tell the people affected without undue delay, as the law requires.

Children

Hearth is for adults. You must be at least 18, or the age of majority where you live if that is higher, to create or join a household. Children do not use Hearth in this version: an adult may add a child's name or nickname so spending can be recorded for them, and Hearth collects nothing else about them. If you believe a child has used Hearth, write to [email protected] and we will delete the data. A later update may let a teenager join on their own phone with a limited role; this section will change before that happens.

Your rights

You can do the main things yourself, in the app, on the Family tab:

• Export everything gives a CSV file of every entry, whenever you like once your household has started the plan or its trial, even after it lapses.
• Delete household (for the owner) deletes the household for everyone in it.
• Delete my account removes you, as described under How long we keep it.

If you set up Hearth but never started the Family plan or its trial, or stopped partway through setup, write to [email protected] and we will delete everything: it leaves our active systems within 30 days.

You can also write to [email protected], and we will act within 30 days. Depending on where you live, you may have more rights, described below. We will not treat you differently for using any of them.

If you're in the EU, UK or EEA

Under the GDPR and the UK GDPR you have the right to access your personal data, correct it, have it erased, restrict or object to its processing, take it with you, and withdraw any consent you gave. You can also complain to your local data protection authority. Our legal bases are: performing our contract with you (running Hearth for your household); your consent, where you give it (Sign in with Apple, notifications); and our legitimate interest in keeping Hearth secure and working. We do not have an EU representative or a data protection officer; write to the address above for anything about the GDPR.

Our servers and database are in the EU (Frankfurt, Germany). Anthropic, Sentry and RevenueCat process data in the United States; those transfers rely on the European Commission's Standard Contractual Clauses and the UK Addendum, with the safeguards described on this page: encryption in transit, access controls, and no training on your data.

If you're a California resident

Under the California Consumer Privacy Act, as amended by the CPRA, you have the right to know what personal information we collect about you, to delete it, to correct it, to opt out of its "sale" or "sharing", and not to be treated differently for using these rights. We do not sell or share personal information as California law defines those terms. To use any of these rights, write to the address above. You can also authorise an agent to act for you, subject to verification.

Where data is processed

Our servers (Fly.io) and database (Supabase) are in Frankfurt, Germany. Anthropic, Sentry and RevenueCat process data in the United States. Apple and Cloudflare run worldwide networks. If you use Hearth from elsewhere, your data is processed in these places.

Changes

If we change this policy in a way that matters, we will update the date at the top and tell you in the app before the change applies. Wording fixes are not announced.

Contact

[email protected]