Nowhere for your data to go.

What Pensionly stores, and where

Everything you enter is written to a database on your own device, encrypted with a key held in your phone's secure hardware store — the iOS Keychain or the Android Keystore. That includes:

• the pensions you add: provider, plan name, type, value, charges, contributions, statement dates, and any notes you write
• optionally, your salary and employer match percentage, if you enter them
• employers you are chasing a lost pension with, and the status of each
• your planning assumptions and any saved scenarios
• a history of the values you have recorded over time
• your settings, including whether reminders and the home-screen widget are on

None of it is transmitted anywhere.

What Pensionly does not do

No account. There is nothing to sign up for and no username or password.

No servers. Pensionly has no backend. There is no system anywhere that holds your data.

No analytics, tracking or advertising. No usage statistics, no crash reporting, no advertising identifiers, no third-party SDKs that collect anything.

No data sharing or selling. There is nothing to share and nobody to share it with.

Permissions, and why each is asked for

Camera and photo library — only when you choose to scan a statement. The photo is read on your phone using the operating system's own text recognition. The image is not uploaded, is not stored by Pensionly, and nothing read from it leaves the device. You can use the whole app without ever granting these.

Notifications — only if you switch on the yearly check-up reminder. The reminder is scheduled by your phone. There is no push service, and nothing is registered with anyone.

Reading statements

Statement scanning uses Apple's Vision framework on iPhone and Google's ML Kit text recognition on Android. Both run entirely on the device. Pensionly does not send the photograph or the text read from it anywhere.

The home-screen widget

If you turn the widget on, Pensionly writes a small summary where the widget can read it: how many pensions you track, whether your figures have gone stale, and the date of your most recent figure. It never includes a provider name or the value of any individual pension.

Your total is not included unless you separately switch on "Show the total on it". If you switch that off, the figure is deleted rather than merely hidden. Turning the widget off clears the summary entirely.

This summary sits in your phone's storage for the app, outside the encrypted database, because a widget cannot open it. Anyone who can see your home or lock screen can see whatever the widget displays — which is why the total is off by default.

Backups

You can export an encrypted backup file. It is protected with a passphrase you choose, and you decide where the file goes. Pensionly does not upload it and never sees it again.

We cannot recover your passphrase or open the file without it. There is no account behind it and no support team who can help. That is what makes the file safe and what makes losing the passphrase final.

Links out of the app

Pensionly links to gov.uk and MoneyHelper for the government's free pension tracing service and State Pension forecast. Those sites have their own privacy policies. Pensionly does not tell them anything about you, and does not know whether you followed a link.

Deleting your data

Settings → Delete all data removes every pension and tracing note from the app.

Uninstalling Pensionly removes the database and its encryption key.

Because nothing is stored anywhere else, that is the whole of it. There is no request to make and nobody to ask.

Your rights

Under UK data protection law you have rights to access, correct, delete and export your personal data. Pensionly holds none of it, so those rights are exercised directly in the app: your data is already in your hands, editable and deletable, and the backup feature exports it.

Children

Pensionly is intended for adults managing their own pensions and is not directed at children.

This website

The app and this website are different things, and it would be misleading to let the app's promise speak for both. The website:

• Sets no analytics, advertising or tracking cookies. A single functional cookie remembers display settings such as light or dark mode.

• Stores nothing you send. The contact form does not write to any database — your name, email address and message are emailed directly to our mailbox and handled there like any other email. The website itself keeps no copy.

• Is hosted on Vercel, whose infrastructure keeps short-lived technical logs (such as IP addresses) to run and secure the service, as almost all web hosting does. See Vercel's own privacy policy for details.

If you would rather not use the form, nothing in the app ever requires this website.

Changes to this policy

If this changes, the updated version will be published here and the date at the top will change. Any change that affected what leaves your device would be a change to how the app is built, not only to this page.

Contact

Questions about this policy can be sent through the contact form on this site.