MochiBook — Privacy Policy

Last updated: 2026-06-03

MochiBook is a voice-driven personal expense tracker. This policy describes what data the app processes, where it goes, and how long it stays. We collect the minimum needed to make the voice loop work; nothing else. There is no user account, no analytics SDK, no advertising identifier, no third-party tracker.

The short version: When you hold the mic, your voice goes (encrypted, over HTTPS) to OpenAI's Whisper for speech-to-text and GPT-4o-mini for understanding. The audio is discarded after transcription; only the structured text entry (amount, category, note) is saved on your device. You are asked to acknowledge this on the fourth onboarding slide before any recording is possible.

1. Data the app processes

Voice recordings. When you press and hold the mic button, the app captures a short audio clip (up to ~10 seconds). The clip is sent over HTTPS to our proxy (voice-keys-proxy.tyler90177.workers.dev, a Cloudflare Worker), which forwards it to two third-party AI services:

OpenAI Whisper — converts the audio to text.
OpenAI GPT-4o-mini — parses the text into a structured entry (amount, category, currency, note).

The clip lives in memory only on our proxy; we do not write it to disk and we do not store it anywhere. OpenAI's data-retention policy governs the brief interval the clip exists on their servers — see OpenAI's API data usage policy for details. API traffic is not used to train OpenAI's models.

Consent. On first launch the app shows an onboarding slide that explains the above in plain language. You proceed past that slide by tapping "Get Started," which records your acknowledgement locally. Until that flag is set, the mic button does not transmit anything off-device.

Transcripts and parsed transactions. The text returned from the voice loop is saved on your iPhone in Apple's SwiftData store inside the app's private container. This data never leaves your phone unless you explicitly export it (CSV / JSON) or share it via the iOS share sheet.

Device attestation key. On first launch the app generates a unique cryptographic key in your iPhone's Secure Enclave and registers the public half with our proxy (via Apple's App Attest framework). The private half never leaves your device. This key replaces a login — it lets our proxy enforce the free daily request cap fairly without us needing your name, email, or any identifier we'd have to store.

2. Data we do NOT collect

No analytics SDK (no Firebase, Mixpanel, Sentry, Amplitude, etc.)
No advertising identifier (IDFA), no advertising or marketing pixels
No location data, no contacts, no photos beyond the optional "Save Mochi photo" feature you trigger manually
No name, email, phone number, or account login — the app has no user accounts
No browser cookies (the web pages on this domain are static HTML and set no cookies)

3. Optional AI Observations

If you enable AI Observations in Settings, the app sends an aggregated monthly summary of your transactions (categories and sums, no individual notes unless you opt in) to OpenAI for natural-language insight generation. The summary is generated on demand and discarded after the response returns. The toggle is OFF by default; you can disable it at any time from Settings.

4. Where data lives

On your iPhone: all transactions, budgets, categories, recurring rules, mochi mascot state. Backed up via iCloud iff you have iCloud Backup enabled at the OS level (MochiBook does not use iCloud sync directly).
On our Cloudflare Worker proxy (KV store): the device attestation public key and a daily request counter. Both are keyed by an opaque hash, not by anything that identifies you personally.
On OpenAI's servers (transient): the in-flight voice clip and parsed text for the seconds it takes Whisper and GPT-4o-mini to respond. Subject to OpenAI's retention policy linked above.

5. Retention

On-device data: lives until you delete the app. Uninstalling MochiBook wipes the local SwiftData store; there is no remote backup we keep.
Proxy device records: kept while you use the app; deleted on request (email below).

6. Children

MochiBook is not directed to children under 13. We do not knowingly collect data from children under 13. The App Store age rating is 4+ because no objectionable content is present, but the app's purpose (personal finance) is intended for adults.

7. Your rights

You can:

Delete all on-device data by uninstalling the app.
Request deletion of your proxy-side records by emailing the address below; we'll confirm within 30 days.
Withdraw consent for AI processing at any time by uninstalling the app — there is no other path to transmit voice off-device, so removing the app removes all future processing.

8. Third parties

The app's voice loop relies on two third parties whose privacy policies apply to the data while it transits their systems:

OpenAI — Whisper transcription + GPT-4o-mini parsing. openai.com/policies/privacy-policy
Cloudflare — hosts the Worker proxy that authenticates devices via App Attest and forwards requests. cloudflare.com/privacypolicy

9. Changes to this policy

If we change this policy materially we'll update the "Last updated" date and post the change here. For non-trivial changes affecting how data is used, we'll surface the change in-app on next launch.

10. Contact

Questions or deletion requests: tyler90177@gmail.com