1. Scope and privacy at a glance
This Policy applies to the Hameni Ledger iOS app and the official Hameni Ledger pages at ledger.hameni.net. The app is provided by 上海哈么尼科技有限公司, referred to as “we,” “us,” or “our.”
The current version requires no account or sign-in, does not connect to banks or financial institutions, and contains no advertising, tracking, third-party analytics, or third-party crash-reporting SDKs. Core app features work offline. The app uses Apple CloudKit for relevant data only if the feature is available and you expressly enable iCloud synchronization or consent to accept a shared-ledger invitation.
Your financial content remains on your device by default. We cannot view, recover, or remotely delete that local data.
2. Data processed on your device
To provide personal finance tracking features, the app processes and stores the following information locally:
- ledger names, currencies, time zones, and creation or update dates;
- income, expense, transfer, reimbursement, and refund records, including amounts, categories, dates, and notes you enter;
- tags, image attachments, coordinates, custom place names, or Apple Place IDs you choose for transactions;
- asset names, types, currencies, institution names, identifier suffixes you choose to enter, balances, valuations, and adjustment history;
- custom-category and tag names, icons, colors, hierarchy, and order;
- budgets, recurring-entry rules, savings plans, check-ins, and progress information;
- import batches, import items, deduplication digests, and metadata needed to review history or undo a batch;
- local recognition suggestions and, when you expressly teach or correct recognition, derived rules, models, merchant associations, and category associations;
- language, appearance, recent-asset, and feature-tip preferences; and
- a thumbnail created from a profile image you choose through the system photo picker.
3. Images, screen recognition, spreadsheet import, location, and Apple Maps
When you choose a profile image or add transaction images, the app uses Apple’s system photo picker. It receives only the images you expressly select and does not scan or read your entire photo library. A profile image is processed into a local thumbnail. Transaction attachments are processed and stored with the relevant transaction, and you can remove them through the app.
When you expressly provide a screenshot or image through a Shortcut, learning screen, or test screen, the app uses Apple Vision to recognize text on device and suggest possible transaction details; you still confirm before saving. Recognition does not write the source image to persistent storage. One screenshot may be held briefly in memory while handing it to the foreground learning screen, then removed when it is consumed, discarded, or replaced.
If you expressly teach or correct recognition, the app may store derived features, rules, merchant and category associations, or a personalized model locally to improve later suggestions. These learning files do not contain the source screenshot, are not uploaded to our servers, and are excluded from device backup.
When you choose a CSV, TSV, XLSX, or XLS file, the app reads its contents only on device for preview, field mapping, validation, and deduplication. It writes transactions only after you confirm. The source file is not uploaded or stored as a file copy in your ledger, but the app retains the resulting transactions and import metadata needed for history, deduplication, or batch undo.
Transaction locations are optional. The app requests While Using the App location access only when you choose your current location or enable automatic transaction locations; it does not track location continuously in the background. Coordinates, custom place names, or Apple Place IDs you choose are stored locally with the transaction and can be edited or removed before or after saving.
Map display, place search, and Apple Place ID resolution use Apple Maps services and require an internet connection. In mainland China, Apple Maps services are provided by Amap. When you use these features, Apple or its maps provider may process location, search terms, and related technical information under their own privacy policies. The app does not send transaction amounts, categories, notes, or ledger names to maps services, and it does not upload transaction locations to our servers.
4. Local diagnostics and voluntary sharing
The app records a limited, predefined set of technical events on your device to identify storage, transaction-saving, and image-processing problems. This may include app version and build, Bundle Identifier, iOS version, device family, locale, time zone, language and appearance preferences, technical event names and timestamps, and an error domain with numeric error code when an error occurs.
Diagnostics exclude ledger names, amounts, notes, account names, profile images, photos, record IDs, and persistent device identifiers. The app uses seven days as the event-cleanup threshold and removes older records the next time it starts, records a diagnostic event, or creates a report. Retention of Apple unified logs is controlled by the operating system.
You may create a diagnostic report under Settings — Diagnostics & Support. It leaves your device only when you choose a recipient through the system share sheet. The app attempts to delete its temporary copy when sharing finishes. If that cleanup does not complete, temporary reports older than 24 hours are removed the next time the app starts or creates a report. Copies saved to Files, email, or another app are controlled by you and the relevant provider.
5. Support communications
If you email us, we may receive your email address and display name, message, timestamp, replies, and any screenshots or diagnostic reports you voluntarily attach. We use this information only to respond, troubleshoot, maintain security, and improve the product.
Support information is retained only for as long as needed to handle the request, meet legal obligations, maintain security, or resolve disputes. You may request deletion of support records we actually hold by emailing contact@hameni.net. Redact amounts, account names, notes, and unnecessary financial information before sending screenshots.
6. Official website
These Hameni Ledger website pages have no user accounts, set no advertising cookies, and perform no cross-site behavioral tracking. The current pages do not use analytics or advertising services.
A website host, CDN, or security provider may automatically process IP addresses, browser type, request time, requested pages, and security logs to deliver pages, prevent abuse, and diagnose failures. Retention depends on the actual hosting configuration and applicable law. We do not use this information for advertising profiles and will update this Policy if the hosting arrangement changes.
When you follow a link to the App Store, Apple, or another external site, that provider processes information under its own privacy policy.
7. How we use information
We use information we actually receive only as necessary to:
- provide and maintain the app and website;
- store your preferences locally;
- answer support requests and troubleshoot problems;
- prevent abuse and maintain security; and
- comply with applicable law.
9. Local retention and deletion
Ledgers, transactions, transaction attachments, assets, categories, tags, budgets, recurring rules, savings plans, import metadata, recognition-learning files, and preferences are stored on your device. In the current version, deleting a transaction marks it as deleted and removes it from normal views, but the record remains in the local database. Removing a profile image deletes the thumbnail stored by the app. Removing a transaction image deletes the corresponding attachment record when you save the change.
Offload App may retain documents and data. To remove all local app data from the device, use Delete App. If a system backup contains app data, manage that copy through the relevant Apple device or Apple Account backup settings. We cannot access or delete Apple-managed backups for you.
10. Your rights and choices
Depending on applicable law, you may have rights to access, correct, copy, or delete personal information we hold, or to object to or restrict certain processing.
Most app information exists only on your device and should be managed through the app or device settings. For information we actually hold through support correspondence, submit a request to contact@hameni.net. We may take reasonable steps to verify the request.
11. International processing
We do not operate a developer server that receives ledger content. When you expressly enable iCloud or CloudKit, create or accept a shared-ledger invitation, visit the website, send support email, or share a diagnostic file, Apple or another relevant provider may process information outside your country or region. Processing locations and safeguards depend on that service and applicable law.
12. Children
The app is not specifically directed to children and does not ask children to create accounts or submit personal information. Where local law requires guardian consent or supervision, a parent or guardian should guide and manage the child’s use.
13. Security
The app uses the iOS sandbox and system data-protection capabilities for local files and limits diagnostic content. We apply safeguards appropriate to support information we actually receive. No device, storage, or transmission method can be guaranteed completely secure, so protect your device passcode and keep iOS updated.
14. Changes
If we introduce accounts, a developer-operated server, third-party SDKs, or other data practices, we will update this Policy, required App Store privacy disclosures, and related privacy manifests before enabling them. Material changes to VIP products, StoreKit purchase handling, or conditional iCloud and shared-ledger data flows will also be communicated through the website, release notes, or another appropriate channel.
15. VIP purchases, iCloud, and shared ledgers
VIP offers monthly and annual auto-renewable subscriptions and a one-time lifetime purchase. The annual plan is labeled Recommended in the app. The actual price, currency, tax, trial if any, and payment confirmation are those shown by the App Store at purchase. Apple processes payment, billing details, refunds, and the purchasing account through the App Store and StoreKit; we do not receive your full payment-card number or Apple Account password. The app uses Apple-verified product identifiers, transactions, and current entitlement status only to present plans and unlock features, without sending them to an account server operated by us.
A monthly or annual subscription renews for the period shown on the App Store confirmation screen unless you cancel it in your Apple Account subscription settings before renewal. Canceling auto-renewal normally does not end the already paid period immediately. On expiration, refund, or Apple revocation, the StoreKit-verified VIP entitlement may end and VIP-only operations may become unavailable. Loss of entitlement does not by itself delete existing local financial data. Restore Purchases asks StoreKit to recheck eligible purchases for the same Apple Account; restoration depends on Apple’s purchase history and current entitlement.
The app enables iCloud only if the feature is available and you expressly choose it. Personal synchronization stores the ledgers, transactions, categories, tags, transaction attachments, assets or accounts, budgets, recurring rules, savings plans, import batches, and other metadata needed for synchronization in the private CloudKit database of your Apple Account. Shared ledgers use Apple CloudKit sharing and expose only the separate shared ledger and the related records listed in Section 8 to specified participants, who may have the editing permission shown in the app. If accepting an invitation would also enable iCloud synchronization of personal data, the app first describes the upload scope and requests consent; canceling does not enable synchronization.
After VIP expiration, refund, or revocation, the app may stop new CloudKit writes and restrict synchronization or sharing operations, but cloud records already held by Apple, copies held by other participants, or pending invitations are not necessarily deleted automatically. Manage the relevant content separately in the app and in Apple’s iCloud, subscription, purchase-history, or refund controls. iCloud and sharing depend on an Apple Account, network access, CloudKit availability, and Apple’s service status. This Policy does not state that any cloud feature that has not shipped or completed real-world validation is available.
16. Contact
Operator: 上海哈么尼科技有限公司
Email: contact@hameni.net