Your information.
A clear explanation.

Development preview. This is a technical overview of the current app, not a final privacy policy. The complete policy and provider retention details must be confirmed before public release.

This website

The interactive examples on this page are illustrations. They do not contact an AI service, create an account, save finance data, or move money. This draft has no email collection, tracking scripts, or advertising.

Your records in the app

Operator keeps a local copy of your finance records on your iPhone. Records and pending changes are stored locally, and committed records are backed up through the app’s Appwrite sync service.

Signing in

The app supports email codes, Apple, and Google sign-in through Appwrite. Your email address, account identifier, and session information are processed to authenticate you and restore your records on signed-in devices.

Connected services

Supported services connect through Composio-managed authorization. Composio holds those provider credentials; Operator’s Cloudflare connection storage holds account-owned connection references, status, and bounded provider observations. Authorized reads can collect supported financial evidence without automatically turning it into personal ledger entries. Provider records used by the assistant may be included in its relevant context. Separate action permission and an explicit in-app review are required before Operator executes a supported change in a connected service.

Signing out of Operator keeps connections on your account. Disconnecting a service removes its active connection across your devices while keeping recorded finance history. Deleting your Operator account also removes its active connections.

Talking to the assistant

Assistant requests send your message, bounded recent conversation context, and relevant financial information through the app’s authenticated Cloudflare service for AI processing. The current text route uses Cerebras; image turns use an OpenRouter-routed model. A photo attached to a turn is processed for that request and is not retained in the finance ledger or conversation history. The assistant does not run entirely on your device.

Provider retention and training policies, backup retention, and the final public privacy policy are release requirements still being confirmed.

Membership and operational usage

Apple processes App Store payments. RevenueCat helps verify subscriptions using your stable Operator account identifier, subscription product, and purchase status. Operator uses this verified information to decide access. Billing records are separate from your finance ledger; buying membership does not automatically add an expense.

Operator records operational request counts, model and connection attempts, latency, failures, and available provider costs. These operational records do not contain your prompts, financial amounts, account names, or provider credentials. Detailed usage is retained for 90 days and daily cost aggregates for 13 months, subject to account deletion and any separate billing-record retention obligations.

Your control

The app includes account-deletion controls in Settings. Supported connected-service changes require your review and approval. Operator does not connect to your bank or move real money.