Privacy Policy

Effective 6 November 2026. Last updated 5 November 2026.

Summary

• Your financial records stay on your iPhone, or in your own private iCloud if you turn on iCloud Sync. We never receive them.
• Pace has no account and no sign-in.
• Usage data is sent only if you turn on Share Usage Data. It never includes amounts, balances, names, notes, or dates you entered.
• Pace shows no ads and does not track you across other apps or websites.
• We do not sell or share your personal information.

Who is responsible

Pace is made and published on the App Store by Mal Kazazi, an individual developer, of Marigona Residence, Str. New York, 10000 Prishtina, Kosovo, referred to here as "we" or "us". Mal Kazazi is the controller of the personal data this policy describes.

You do not have to give us any personal data to use Pace. Every feature works with Share Usage Data turned off.

Privacy questions and requests: email us at the address on our support page. It is the one address for support and privacy.

We are established in Kosovo, which is outside the European Union and the United Kingdom. Kosovo's Law No. 06/L-082 on the Protection of Personal Data applies to how we handle personal data, and so do the GDPR and the UK GDPR for people in the EU, the EEA and the UK.

We have not appointed a representative in the EU or the UK under Article 27 of the GDPR or the UK GDPR. If you are in the EU, the EEA or the UK, contact us directly at the address on our support page, and you can also complain to your own data protection authority.

Data that stays on your iPhone

Everything you enter in Pace is stored in Pace's private storage on your iPhone. That includes wallets, transactions, categories, plans, goals, investments, recurring transactions, notes, receipt photos and other attachments, imported CSV files, and your settings. We have no copy of it and no way to see it.

• Attachments are saved with iOS's complete file protection.
• Device backups. If your iPhone backs up to iCloud or to a computer, iOS includes Pace's data in that backup. Apple's terms govern those backups.
• Backup files you export from Settings → Data Management → Backup & Restore are unencrypted files you create. Where you save or send them is up to you. They never include API keys or app lock settings.
• Face ID, Touch ID and passcode. iOS checks them. Pace only learns whether unlocking succeeded.
• Camera and photos are used only when you attach a receipt, and the image stays on your iPhone.
• Reminders are scheduled on your iPhone. Pace has no notification server.
• Siri, Shortcuts and Control Center. "Add expense in Pace" and the Add Expense control only open Pace on Add Transaction. They read and show nothing from your records, and app lock still applies.
• Diagnostics. When saving or opening your data fails, Pace keeps a local note of the failure type, a numeric error code, the time, and a random identifier for the note. It keeps at most 50 notes for 30 days and never includes your records. The report leaves your iPhone only if you review it and then choose Share, or attach it to an email to us from Contact Support. You can delete it in Settings → Data Management → Review Safe Diagnostics.

Data that leaves your iPhone

Optional iCloud sync

If you turn on iCloud Sync in Settings, Pace stores your records in your own private iCloud database, using your Apple Account. Apple holds that data under Apple's privacy policy. We have no access to it and never receive it. Sync is off unless you turn it on. Turning it off keeps a full copy on your iPhone. To delete the copy in iCloud, open the Settings app, tap your name, then iCloud, then Manage Account Storage, then Pace.

Usage data, only if you allow it

Pace asks at the end of setup whether to share usage data. The answer starts as no. You can change it at any time in Settings → Privacy & Security → Share Usage Data. Until you say yes, nothing is sent and the analytics service is not contacted.

If you say yes, Pace sends events about what you do in the app to PostHog, our analytics provider, so we can see what works and what to fix. An event names an action, such as a transaction saved or a screen opened, with simple facts about it:

• the type of entry, wallet or investment, and a built-in category's fixed name. A category you created is sent as "custom", never its name.
• yes or no facts, such as whether a note was added, never the note itself.
• a choice from a fixed list written into Pace, such as the screen opened, the setting changed and its new value, the import format, the Premium plan, or the kind of failure. Never an error message.
• counts and durations in ranges, such as "4 to 5" or "5 to 15 seconds".
• a random identifier Pace creates on your iPhone. It is not your Apple ID, your name, or the device's advertising identifier.
• the app version and build, iOS version, device type and model, whether the app came from TestFlight or runs in a simulator, the analytics library's version, and a session identifier.
• when the app is opened, sent to the background, installed or updated.

Never sent: amounts, balances, prices, quantities, exchange rates, anything you typed, the dates of your records, record identifiers, currency codes, or your location. Time zone, language, screen size and network type are removed on your iPhone before sending. Screen recording, automatic tap capture and crash capture are off.

Your IP address reaches PostHog as part of the connection. Our PostHog project is set to discard it, and its location lookup is off.

Turning sharing off stops it immediately and gives your iPhone a new random identifier, so later events cannot be joined to earlier ones.

Legal basis: your consent, under Article 6(1)(a) GDPR and UK GDPR.

Currency exchange rates

When you save a transaction in another currency without entering a rate, tap to look up a rate, or choose Refresh Exchange Rates in Settings, Pace asks Frankfurter (frankfurter.dev) for a rate. The request contains two currency codes and, for a past transaction, its date. Nothing else from your records is sent. Frankfurter states that it does not log personal data, IP addresses, or request addresses. Rates come from the European Central Bank's euro reference rates, and cross rates are calculated by Frankfurter.

Legal basis: our legitimate interest in providing the conversion you asked for, under Article 6(1)(f) GDPR and UK GDPR. No personal data is kept.

Investment prices

When an investment is linked to automatic prices, Pace asks our price service at prices.pacemoneyapp.com for its latest price, and searches it when you look up an investment to link. A request contains only the kind of investment (crypto, stock or fund, or metal), the investment's ticker symbol or provider identifier, the text you type into the search, the currency you want the price in, and a fixed tag that tells the service the request comes from Pace. It never contains quantities, values, costs, wallet names or notes. Pace asks for prices when you open your investments and a saved price is out of date, or when you pull to refresh, never in the background.

The service runs for us on Cloudflare Workers, provided by Cloudflare, Inc., in the Cloudflare data centre nearest to you. It gets prices from CoinGecko for crypto, Marketstack for stocks and funds, and MetalpriceAPI for metals. They receive the symbol or search text and the currency from our service, never your IP address and never anything from your iPhone directly.

The service writes no logs of IP addresses or requests, and Cloudflare's request logging is off for it. To stop abuse, it turns your IP address into a salted one-way code, used only to count your requests over one minute. It stores prices and search results so that one lookup can answer many people: a price for up to 7 days, and the results for a search text for 7 days. What it stores is not linked to you or your IP address.

You can stop these requests at any time in Settings → Privacy & Security → Allow Market-Data Requests. Prices already saved stay, and you can enter prices yourself.

Legal basis: our legitimate interest in providing the prices you asked for, under Article 6(1)(f) GDPR and UK GDPR.

Pace Premium

Pace Premium is sold through the App Store, as a subscription or as a one-time lifetime purchase. Apple handles payment and your Apple Account. We never receive your payment details or Apple ID. Pace checks on your iPhone, through Apple's StoreKit, whether you have Premium. Apple gives us sales and subscription reports that do not identify you. You manage or cancel a subscription in your Apple Account settings.

If you turned on Share Usage Data, usage data includes where the Premium screen was opened from, which plan you started to buy, whether the purchase succeeded, was cancelled or is waiting for a parent's approval, whether Restore Purchases found Premium, and whether a subscription is in its free trial. It never includes the price paid. If you cancel from Pace, it includes the reason you picked from a fixed list, if you picked one, which step you left from, and whether you saw an offer or tapped to redeem it. Pace never asks you to type a reason. The trial reminder, if you turn it on, is a notification scheduled on your iPhone, and nothing about it is sent to us.

Crash reports from Apple

If you turn on Share With App Developers in iOS Settings → Privacy & Security → Analytics & Improvements, Apple sends us crash reports and performance data about Pace. Apple collects these under its own privacy policy, and they do not include your Pace records. TestFlight testers can also send us feedback and crash reports through TestFlight.

Messages you send us

When you email us, we receive your email address and what you write. Settings → Contact Support writes the email to our address with the subject "Pace Support" and adds nothing about your finances. You send it yourself, from your own email account. If you chose to attach the diagnostic report you reviewed, we also receive the app version and build, the data format version, your device model and iOS version, and the failure notes described under Diagnostics, never your records. If you turned on Share Usage Data, usage data says whether you opened, sent, cancelled or could not send a support email, and whether a report was attached, never its content. We use what you send only to answer you and fix problems. Please do not send backup files, screenshots of balances, or other financial details we have not asked for. We keep support emails for 12 months after the conversation ends, then delete them.

Legal basis: our legitimate interest in answering you, under Article 6(1)(f) GDPR and UK GDPR.

This website

This site uses no cookies and no analytics. Cloudflare Pages, provided by Cloudflare, Inc., serves the pages and processes your IP address to deliver them and protect the site from attacks.

What we do not do

• We do not sell personal information or share it for cross-context behavioural advertising.
• We do not show ads, use advertising identifiers, or track you across other companies' apps or websites.
• We do not use your data for automated decisions about you.
• Because we do no cross-site tracking, Pace and this site have nothing for a browser's Do Not Track or Global Privacy Control signal to switch off, so they do not change behaviour for those signals. In the app, Share Usage Data is the control.

Service providers

We run Pace from Kosovo. Kosovo's Information and Privacy Agency lists EU countries, and the United States following the EU's adequacy decision, as giving adequate protection, so data can go to these providers without its further approval. When we look at usage data stored in the EU, or read support email, we do it from Kosovo.

PostHog and Cloudflare process personal data for us under their data processing terms, which require them to protect it at least as well as this policy describes. Analytics data is stored in the EU. Both companies are certified under the EU-U.S. Data Privacy Framework, with its UK extension, which covers any access to personal data from the United States. Our agreements with both also include the EU Standard Contractual Clauses and the UK addendum: PostHog's apply alongside the framework, and Cloudflare's apply if its certification ever lapses.

How long we keep data

• Your records on your iPhone: until you delete them or delete Pace. We never hold them.
• Usage events: PostHog's retention for our plan, currently one year, then deleted.
• Support emails: 12 months after the conversation ends.
• Local diagnostics: at most 50 notes for 30 days, on your iPhone only.

Your rights

You control your financial records directly. You can view, change, export and delete them in Pace, and deleting Pace removes them from your iPhone.

For usage data, you can withdraw consent at any time in Settings → Privacy & Security. Withdrawing does not affect events already sent.

Usage events carry only a random identifier that neither you nor we can link to your name or email. Because of that, we may be unable to find the events that came from your iPhone in order to show or delete them, as Article 11 GDPR allows. If you can give us details that let us find them, we will act on your request.

EU, EEA and UK

You have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent. You can also complain to your local data protection authority. In the UK that is the Information Commissioner's Office. We have no establishment in the EU, so there is no single lead authority, and you complain to the authority where you live or work.

Kosovo

You have the same rights under Kosovo's Law No. 06/L-082 on the Protection of Personal Data. You can complain to Kosovo's Information and Privacy Agency (Agjencia për Informim dhe Privatësi).

California and other US states

We honour the rights below for every user in the United States, whether or not a state privacy law requires it of a developer our size. In the last 12 months, and only from users who allowed usage data, we collected these categories under the CCPA, as amended by the CPRA: identifiers (the random app identifier and, briefly, the IP address), internet or other electronic network activity (in-app usage events), and commercial information (which Premium plan was bought, from those usage events, never the price). They came from your iPhone and are used to improve Pace. We do not collect sensitive personal information. We have not sold or shared personal information, and we do not knowingly sell or share the data of anyone under 16.

You have the right to know, access, correct and delete your personal information, to opt out of sale or sharing, and not to be discriminated against for using these rights. You or an authorised agent can email us at the address on our support page. We may need to verify a request before acting on it.

Canada

We handle personal information with your consent and in line with PIPEDA. You can access and correct your personal information and withdraw consent. Mal Kazazi is accountable for privacy and answers privacy questions at the contact address above. You can also complain to the Office of the Privacy Commissioner of Canada.

Children

Pace is not directed at children under 13, and we do not knowingly collect personal data from them. In the EU and the UK the age at which you can consent yourself is between 13 and 16, depending on your country. If you are younger than that, please leave Share Usage Data off unless a parent agrees. If you believe a child has sent us personal data, contact us and we will delete it.

Security

Pace keeps your records on your iPhone, offers app lock and hidden amounts, uses HTTPS for every request, and removes unneeded fields on your iPhone before usage data is sent.

Changes

When Pace's data handling changes, we update this page and its date before the app update that changes it reaches the App Store. Significant changes are also noted in the app's release notes.

Contact

Mal Kazazi
Marigona Residence, Str. New York
10000 Prishtina, Kosovo
Email: support@pacemoneyapp.com