For the In Unity app for iPhone and the In Unity web command center.
If you connect In Unity to ChatGPT and approve read access, the connection can retrieve your recorded purchases, structured receipt facts, recurring payments, saved bills, returns, spending summaries, and upcoming attention items. In Unity checks the connected account and permission on every request. Connecting is optional and does not give the agent permission to change records or make payments.
The connection returns selected financial facts and links to In Unity. It does not return raw email bodies, receipt files, email or sign-in credentials, complete bill account identifiers, login identifiers, or precise purchase coordinates. It does not grant the agent access to your whole mailbox.
Clerk manages the sign-in and OAuth authorization. You can pause agent access immediately under Settings → Connected agents; resuming permits existing authorized connections again. The pause preference is stored with your Clerk account. To remove a connection, disconnect In Unity in ChatGPT. Disconnecting or pausing does not erase information already shared in a conversation; that information is governed by the connected provider's retention, privacy policy, and your data settings there.
PickMe tells you which credit card in your wallet earns the most on the purchase you are about to make. There are two separate places your information can live, they work very differently, and the difference is the most important thing on this page.
On your iPhone. The app keeps a detailed record of the merchants you confirm, the advice it gave you, and your corrections to it. That record is never uploaded. There is no code in the app that sends it anywhere.
On the server when you choose a server feature. A PickMe account is optional. If you make one, PickMe syncs your wallet and reward settings to the In Unity web hub. The hub also holds the data you put into it and — if you set up the optional Wallet Shortcut — a record of your card transactions, including the amount, merchant, and card used. A tester report can also reach the server when you send it while signed in or privately share a report file for an authorized reviewer to import.
Neither the app nor the server ever connects to your bank or your card issuer. Nothing here asks for card numbers, PINs, or online banking credentials, and no screen anywhere accepts them.
PickMe and the MoneyTalks web hub are built and published by Zubair Muwwakil, an individual developer, not a company. There is no incorporated entity behind this, no team, and no data protection department.
That means the person responsible for the protection of your personal information is Zubair Muwwakil, reachable at zmuwwakil1@gmail.com. Requests and complaints go to the same address, because there is nobody else to route them to.
The most common way to misread a privacy policy like this one is to conclude that PickMe holds nothing at all. That is true of the server for people who never sign in. It is not true of your iPhone, and it is not true of the server once you have an account.
| On your iPhone | On the server | |
|---|---|---|
| Exists | Always, from first launch | Account data only if you create an account; anonymous community evidence only if you separately opt in; a tester report only if you send or privately share it |
| Holds | Merchants you confirmed with their coordinates, every recommendation made, your corrections | Everything attached to your account, including Wallet Shortcut transactions; plus optional community evidence and tester reports you chose to deliver |
| Can I read it | No. It is never uploaded | Yes for account data and tester reports. Anonymous community reports are intentionally not linked to an account or device |
| Erased by | Erase This iPhone's History, or deleting the app | Delete my data or Delete account for account data; in-app or reviewer deletion and 30-day expiry for tester reports; separate 90-day or 180-day expiry for anonymous community reports |
Apple's App Privacy labels describe the on-device store as data not collected, because Apple treats information that is processed only on the device and never sent off it as uncollected. That is a correct answer to Apple's question. It is not a claim that the app holds nothing — it plainly does, and this policy describes it in detail below.
All of this is written to the app's storage area on your device. If you stay signed out, it stays there. If you sign in, the wallet and reward settings identified below are also copied to your account on the server; the merchant history, recommendations, and corrections are not.
Which card products you picked from the catalogue built into the app — for example an American Express Cobalt Card. The catalogue ships with the app. Your choices remain only on the device while signed out and are synced to your account while signed in.
Taken together, this is a running record of where you shopped, when, roughly how much you spent, and which card you used — including precise coordinates sitting at rest on your phone. Your card settings also include approximate figures for your annual spending in certain categories. That is genuinely personal information, and it is treated as such.
The shopping record described above — merchants, recommendations, purchase entries, corrections, and local MCC-learning evidence — never leaves your device as account data. If you choose Import issuer MCC CSV, PickMe reads that file locally. It may compare the imported merchant, date, CAD amount, and card network transiently against purchases already on this iPhone so a literal MCC can be attached to one store location only when exactly one purchase matches. Those matching fields are not copied into the MCC-learning ledger or sent to In Unity. PickMe keeps only normalized merchant, literal MCC, optional network, observation date and, after a safe unique match, the already-local store coordinates; it does not retain the raw issuer file, imported purchase amount, card/account number, filename, or statement text. When you sign in, the separate wallet configuration listed under Your cards and Your card settings does sync so the server can evaluate Wallet Shortcut captures. Optional community evidence is narrower and separate: only the specific gift-card or literal-MCC fields described below can be shared anonymously when you enable those settings.
This section replaces a claim in earlier drafts of this policy, written before accounts existed, that Apple Maps was the only network activity the app performed. That stopped being true when account sync shipped, and the correction matters more than the tidier sentence did.
Searching for nearby merchants sends a request to Apple, which answers it. By default, nothing else goes anywhere while you are signed out. If you separately enable an optional community feature, PickMe can send the narrow anonymous store evidence described below. Report a problem can also prepare a JSON file locally; it reaches the reviewer only if you choose to share it and the reviewer imports it.
The app talks to the MoneyTalks server, and this is the complete list of what it sends:
The tester-report route described below is the other outbound surface of the signed-in app. Cap-ledger sync is otherwise a pull: the app asks the server for figures and receives them. It does not push your prediction log, purchase entries, saved merchant history, or locally imported MCC-learning evidence as account data.
Report a problem prepares a versioned JSON report on your iPhone and shows you the complete contents before anything is sent or shared. The required fields are the expected and actual behaviour you type, optional reproduction steps, the report time, and the PickMe app, build, iOS, and card-catalogue versions.
Diagnostic attachments are separate choices. Category diagnostic counts are aggregate totals. A Wallet Capture diagnostic contains delivery stages and errors but removes merchant, amount, card, and coordinates. A detailed arrival log can contain precise locations, merchant names, candidate cards, and arrival times; PickMe names those contents before you include it.
If you are signed in and tap Send report, the report is linked to your account and stored in the authorized review inbox. You can see its review status in PickMe and delete it there. Deleting your data or account also removes reports linked to that account.
If you are signed out, PickMe creates a JSON file for you to inspect, save, or share privately. Preparing or sharing the file does not submit it automatically. If you send that file to the reviewer and the reviewer imports it, the report is stored without an account link. It may still identify you through text or optional details you chose to include, so it is not treated as anonymous.
For community gift-card inventory, PickMe can ask whether anonymous reports exist for the nearby stores Apple Maps already returned. That query sends the target gift-card name plus each candidate store's Apple place identifier. If a place identifier is unavailable, it sends the merchant name with store coordinates rounded to four decimal places instead.
When you tap Found it or Not here, a later nearby scan can anonymously submit that observation. The submission contains a random observation UUID, the same store identity described above, the gift-card name, Found it or Not here, and the observation time. If an Apple place identifier exists, PickMe omits the coordinates from the submission. These community inventory submissions do not include your credit card, card number, purchase amount, account, email, user identifier, or device identifier.
For community MCC learning, PickMe only queues an upload after you explicitly reconcile a purchase with a literal four-digit MCC. The upload contains a random observation UUID, PickMe's canonical merchant identifier, store coordinates rounded to three decimal places (a coarse roughly 100-metre location bucket), the confirmed MCC, and the observation time. It does not contain the card used, purchase amount, Wallet merchant descriptor, reward amount, account, email, Clerk identity, user identifier, or device identifier.
Community MCC queries use the canonical merchant identifier plus the same three-decimal coarse store-location bucket, matching the upload scope while tolerating normal Wallet-versus-MapKit GPS drift. The server returns only bounded aggregate MCC signals. The anonymous community tables have no user or device relation: raw MCC reports contain no user, account, device, or contributor identifier and have no relation to a User row in the database.
Community MCC reports older than 180 days are ignored for results and removed opportunistically. A store/network/MCC can contribute at most two aggregate evidence units per UTC day, and PickMe receives no MCC signal until that MCC has support on at least three distinct days. Raw storage is also bounded per physical store and day to resist request flooding. This is a privacy-preserving anti-burst threshold, not proof that three different people submitted the reports. PickMe always treats community MCC results as weaker external evidence; they can never become trusted terminal truth without the owner's own repeated direct MCC observations.
Community gift-card reports older than 90 days are ignored for results and are removed opportunistically. Gift-card results are grouped by physical store and day and capped at three evidence units per store, gift card, and day. PickMe — not the server — applies the freshness and confidence rules used to rank a route.
Turning a community setting off stops its future queries and submissions and clears its community evidence cache when PickMe next evaluates that setting. Because submitted community rows deliberately contain no account or device identity, they cannot later be selected by account for individual deletion; they stop contributing after their retention window and are eligible for opportunistic cleanup.
With your permission, the app takes a single location reading to ask Apple Maps which shops are near you, so you can pick the one you are standing in from a short list instead of typing its name.
If you turn on ambient alerts, the app also asks iOS to watch geofences around up to twenty merchants you have already confirmed, so it can offer advice as you arrive. Those geofences are set on your device, evaluated by iOS, and removed when you erase your local history.
If you say no to location, the app remains fully usable. Every feature is reachable by searching for a merchant by name. Declining costs you the shortcut, not the product. You can revoke permission at any time in iOS Settings, under Privacy & Security, then Location Services.
When you look for nearby merchants or search for one by name, iOS sends that request to Apple to answer it. I do not receive that request, I am not told what you searched for, and I get no copy of the result.
Apple's handling of those requests is governed by Apple's Privacy Policy, not by this one. Because no copy reaches me, there is nothing on my side to delete.
Creating an account is optional and the app works without one. If you create one, the following is stored on the server against your user record.
There is no analytics SDK, no advertising, no ad identifiers, no cross-app or cross-site tracking, and no data broker anywhere in this system. Your information is not sold, rented, or shared for anyone else's purposes. It is used to operate the features you are using.
The server does not connect to your bank or card issuer, and it holds no payment instrument of yours. It cannot move money.
The Wallet Shortcut is an Apple Shortcut you build and install yourself, on your own device. It is optional, it is off unless you set it up, and it is the route by which your actual card transactions reach the server. It is worth reading this section carefully even if you skipped the rest.
When it runs — typically as an automation after an Apple Pay tap — it posts to the wallet-events endpoint on the server, authenticated by an installation token you created. It sends:
The payload is also kept verbatim as received, so that improved parsing can re-read your history later rather than silently misreading it once. That means a raw copy of the above is retained alongside the interpreted version.
If your Shortcut sends location, those coordinates are stored precisely and kept as part of your transaction history. They are not blurred or discarded after the merchant is identified. They support the purchase-detail Maps link and auditing an incorrect match. The nearby-place lookup itself happens on your device; the server receives only the nearby businesses' names, Apple's place-category labels, and distances, then compares that evidence with the transaction description. But it means the server holds a map of where you paid for things, and you should decide about that deliberately rather than by default.
The Shortcut is a transport, not an observer. It reads what you hand it at the moment it runs. It does not have access to your Apple Wallet history, your bank, or your card account, and it cannot run on its own without the automation you configured.
The web hub can read receipts and order confirmations out of your mailbox so purchases, returns, and subscriptions fill themselves in. This is optional and off until you connect an account. It is also the most invasive permission in the whole system, so here is the unflattering version.
Connecting Gmail requests the gmail.readonly scope, along with basic profile and email address. That scope grants read access to your entire mailbox — every message, including bodies and attachments, not only receipts. It does not grant permission to send, modify, or delete anything.
From scanned mail the server keeps what it extracted — merchants, amounts, dates, order and tracking numbers, line items, and the linked purchase, return, or subscription records. Access tokens are encrypted at rest.
You can disconnect an email account at any time from Settings, then Privacy & Data, in the web hub. Disconnecting removes the stored credentials. Records already extracted remain until you delete your data, so that your purchase history does not develop holes; deleting your data or your account removes them.
Until you erase it. There is no expiry, and I cannot reach it to remove it on your behalf — it was never uploaded, so there is nothing on my side to act on. Deleting the app removes its database with it, in the ordinary iOS way.
Account data is kept until you delete it, because it is the history the product is for. Tester reports are different: they expire after 30 days and can be deleted earlier from PickMe or by an authorized reviewer. Anonymous community evidence follows the separate 90-day or 180-day periods below.
When you delete your data or your account, deletion is immediate rather than scheduled, and it is not a soft delete — the rows are removed. No shadow copy is retained, and no record of the deletion survives it. If a deletion fails partway, a record of the failure remains so you can retry, because in that case your account still exists.
Because there are two stores, there are separate controls, and one of them deliberately does not require an account.
| Control | Where | Account needed | What it removes |
|---|---|---|---|
| Erase This iPhone's History | PickMe, gear icon, This iPhone | No | The entire on-device store: recommendations, corrections, saved merchants and their coordinates, mute list, counters, and any live geofences |
| Delete my data | Web hub, Settings, Privacy & Data | Yes | Every server record belonging to you. Your account and sign-in survive, so you can start over with an empty slate |
| Delete account | PickMe, gear icon, Danger zone — and the web hub, Settings, Privacy & Data | Yes | Your entire server record and the account itself, including the sign-in held by Clerk |
The local erase is not gated on being signed in, on purpose. The app has never required an account, so somebody who has never signed in still has a local history — and should not have to create an account, or delete one, in order to erase it.
Deleting your account does not erase this iPhone's history unless you ask it to. The account deletion screen offers that as a separate, explicit choice, and defaults to keeping it. Your local record never left the phone, so the account has no claim on it, and an accidental deletion should cost you the account rather than your own record of what the app advised.
Canadian federal privacy law (PIPEDA) and, if you are in Quebec, Law 25 give you rights over your personal information. Where they apply to information on your own device, you exercise them yourself, immediately, without asking anyone. Where they apply to information on the server, write to me.
| Right | On your iPhone | On the server |
|---|---|---|
| Know what is held | Listed in full above, and visible on screen in the app | Listed above; the web hub shows a live count of every record type held for you |
| Access and portability | No export control exists in the iOS app today. If one ships, this policy will say so | The web hub exports your data as a structured file you can keep or take elsewhere |
| Correction | Edit cards, settings, valuations, and merchant categories at any time | Edit your records in the web hub, or write to me |
| Deletion | Erase This iPhone's History, or delete the app | Delete my data, or Delete account |
| Withdraw consent | Turn off Location in iOS Settings | Disconnect your email, revoke a Wallet Shortcut installation, or delete your account |
The app deliberately never rewrites a recommendation after the fact. If a prediction was wrong, your correction is stored beside it rather than over it, so accuracy is measured against what you were actually told at the time rather than a tidied-up history. You can erase a prediction; you cannot silently edit one — and neither can I.
The recommendation engine makes automated calculations, but it does not make decisions about you: it does not score you, rank you, grant or refuse you anything, and nothing it produces has a legal or similarly significant effect. It tells you which card pays more and shows its arithmetic. If that ever changes, Law 25 requires that you be told, and you will be.
The server and its database are operated through service providers who may store or process data outside Canada, including in the United States, where local authorities may be able to compel access under their own laws. Authentication is handled by Clerk. Information on your iPhone stays on your iPhone.
If a confidentiality incident occurs that presents a risk of serious injury, you will be notified, and the regulators will be notified, as PIPEDA and Law 25 require. I will not wait to be asked, and I will tell you what I actually know rather than a reassuring summary of it.
On your iPhone, your data sits in the app's private storage area, protected by the iOS app sandbox and file protection. Those protections lean on your device having a passcode or biometric lock. If your iPhone has no passcode, its local data is much less protected — true of every app, including this one.
On the server, traffic is encrypted in transit, sign-in is handled by Clerk rather than by hand-rolled password code, Wallet Shortcut tokens are stored only as hashes, and email credentials and complete bill account identifiers are encrypted at rest. Bill identifiers are masked by default and revealed only after an authenticated request for a bill owned by that user.
This is built for adults who hold credit cards. It is not directed at children, and I do not knowingly create accounts for them. If you believe a child has created an account, write to me and I will delete it.
Recommendations are calculated from a catalogue of published card terms and from your own settings. Card terms change, and merchants code purchases in ways nobody outside the payment network can see in advance. Each recommendation shows when its rules were last verified and how confident it is.
It is a calculator you can audit, not a promise about what your issuer will pay you, and it is not financial advice.
Updated versions are posted at https://moneytalks.zubairmuwwakil.com/privacy with a new effective date.
If a future version ever collects something materially new, you will be told in the app or the web hub before it starts, and asked separately, rather than finding this page quietly rewritten. This version exists because an earlier draft had drifted out of step with the code; keeping the two aligned is the standard being held to here.
Questions, or to exercise any right above: zmuwwakil1@gmail.com. This reaches Zubair Muwwakil, who is the person responsible for the protection of personal information.
If you are not satisfied with how a request was handled, you can complain to a regulator, and you do not need permission to do so: