Your financial records live in a wallet on your device. We do not receive a server copy of your accounts, transactions, budgets or goals.
1. Who this policy covers
Plumb is published by ZIX DEV Inc. This policy covers the Plumb app and this website. Stores, email providers and destinations you choose for exported files handle information under their own policies.
2. What Plumb holds
The wallet contains information you enter: account names and balances, transactions, categories, budgets, savings goals, recurring items, budget cycles and income figures. Plumb does not connect to your bank or ask for banking credentials.
Plumb has no online account or sign-up and does not require a login password. If you create an encrypted wallet backup, you choose a separate backup password, which Plumb does not store. Display preferences, language, App Lock settings and the local subscription entitlement are also kept on your device.
3. Where your information is kept
Wallet information is stored in the app’s own local storage. Plumb does not automatically sync it between devices or keep a copy on a developer-operated server. The app uses the device’s storage protections; on iOS, files are protected by iOS file protection.
Depending on your device and backup settings, an iCloud, Android system or computer backup may include local app data. These device backups are separate from Plumb’s password-encrypted wallet backup feature. Their storage, protection and retention depend on the service and settings you use. We do not receive those copies.
5. Subscriptions and payments
Apple handles purchases on iPhone; Google Play handles them on Android. The store handles payment, renewal, refunds and cancellation. Plumb does not receive your payment-card number, billing address or store-account password, and does not process your payment.
Plumb uses StoreKit or Google Play Billing to check and restore purchases and stores the active plan, product and available entitlement dates locally so it knows which features to unlock. It does not send these records to a Plumb server. Store processing is covered by Apple’s privacy policy and Google’s privacy policy.
6. App Lock and biometrics
App Lock asks the operating system to authenticate you using Face ID, Touch ID, Android biometrics or your device PIN/passcode where supported. Plumb receives the result of that check. It does not receive biometric templates or your passcode.
The app requests biometric authentication when needed for App Lock. It does not request access to your contacts, location, photo library or microphone. You can also hide financial figures inside the app.
7. Exports and encrypted backups
Export ledger creates a CSV file of your transactions and real financial figures. CSV exports are not password-encrypted.
Wallet backup creates a password-encrypted copy of your accounts, transactions, categories, budgets, goals and schedules. You choose the password and the destination through the system share sheet. Plumb does not store the password or send the backup to us. We cannot recover a forgotten backup password.
A wallet backup does not transfer your store subscription or device security preferences. Restoring a backup replaces the current local wallet after you review and confirm the replacement. Export and backup run only when you request them.
8. Deleting your information
Settings → Reset all Plumb data erases the wallet held in the app. Deleting the app removes its local storage. We do not hold a server copy to restore.
These actions do not remove files you previously saved or shared, nor copies in device backups. Manage those copies through the destination or backup service where you stored them. Resetting the local wallet does not cancel your store subscription or disable App Lock.
9. Advertising, this website and support
Free includes Google AdMob banner ads on Home and an interstitial after a successful transaction, goal or account creation, at most once every four hours across these actions on this installation. Pro and Max are ad-free. An ad failure never prevents a record from being saved.
Plumb does not send financial records, balances, merchants, notes, categories or goals to Google or other advertisers. Ad requests are non-personalized. The Google Mobile Ads SDK may still process your IP address (including approximate location), device or app identifiers, diagnostics and ad interactions to deliver and measure ads and prevent fraud. Non-personalized ads do not mean that no data is collected. Plumb does not request Apple's tracking permission and removes Android's advertising ID permission. Other SDK data processing can still occur.
Where required, Google's consent form appears before ad requests. You can revisit available choices in Settings → Ad privacy choices. A timestamp stored on your device enforces the four-hour limit and is kept when you reset or restore your wallet. It contains no financial data. See Google's advertising information and Google's Privacy Policy.
Plumb uses Sentry for production error and crash diagnostics on iPhone and Android. Reports include technical information such as the app version, operating system, device model, error type and code stack traces so we can identify and fix failures. These reports are processed by Sentry in the United States for ZIX DEV Inc.
Crash reporting does not attach your wallet database, exports, backups, screen images or recordings. Session replay, interaction tracking and application-log collection are disabled. The app removes free-form exception text and other fields that could contain financial details; additional server-side scrubbing is enabled. Sentry is configured not to store IP addresses with events, although network services process an IP address to receive a request. This diagnostic service operates on Free, Pro and Max and is separate from advertising. See Sentry's privacy information. Apple and Google may also provide store diagnostics or testing feedback under their respective settings and terms.
The iPhone and Android app use Plausible Analytics hosted by us at plausible.zixdev.com under mobile.plumbwallet.app. We measure screen visits, app launches, onboarding completion, use of the add transaction/account/goal features, and startup duration ranges. Reports include the app version and platform, but never account names, balances, amounts, currencies, merchants, categories, notes, wallet identifiers or financial records. There are no analytics cookies, advertising IDs or persistent user or installation identifiers. Plausible processes a request's IP address and a coarse platform user-agent to estimate daily visitors and approximate location; it does not store raw IP addresses in its analytics database. These are estimates, not identifiable users or a count of installations. Network and security logs on the host are separate from analytics data.
Usage analytics operates on Free, Pro and Max, separately from ads and crash diagnostics. You can turn it off in Settings by opening “Your wallet stays on this device” and disabling “Share anonymous usage”. This device preference is not included in wallet backups. Offline analytics events are discarded rather than saved or sent later.
This website also uses Plausible Analytics hosted at plausible.zixdev.com to measure page views, page engagement (such as time on a page and scroll depth), clicks on download-related links and our Product Hunt badge, and automatic redirects to app stores from our download page. Analytics requests include the page URL, referring page and event name. Campaign tags in promotional links help us understand which campaign brought a visit. Download events also include the link or redirect placement and the selected store. A store redirect or download-link click does not tell us whether you installed the app.
The website does not set analytics cookies or send app wallet records to Plausible. Your browser sends technical information, including its IP address and browser information, to the website host and analytics host when making requests. Hosting logs and security processing are separate from the app’s local wallet. The website’s fonts and app screenshots are served by the website itself.
The homepage’s Product Hunt badge image loads from Product Hunt, which receives the technical information needed to serve that request, such as your IP address and browser information. The image request sends no referring page. Clicking the badge opens Product Hunt in a new tab.
If you email support, we receive your email address and whatever information you choose to include so we can respond. Do not send your backup password or private financial records. There is no automatic wallet attachment or support upload.
10. Children
Plumb is a personal budgeting tool and is not directed at children. It does not ask for an age or create a personal profile. If you believe information about a child has been sent to support, contact us.
11. Changes and contact
We may update this policy as Plumb changes. The date at the top identifies the current version. For privacy questions, or a request about information you have sent to support, email contact@zixdev.com.
For help managing your wallet or backups, visit Plumb support. Read our Terms of Use for more about the app.