What Bearing knows about you.

MPC Digital Ltd is the data controller for the information described on this page. The company is registered in England and Wales and is registered with the Information Commissioner's Office.

For anything on this page — a question, a request, or a complaint — write to michael@mpcdigital.co.uk.

This policy covers the Bearing iOS app. It also covers this website, which sets no cookies, runs no analytics, and loads nothing from a third party — the fonts are served from this site.

Your money never leaves your phone. Balances, history, the names you give your own accounts, and every screenshot are stored on the device and are transmitted nowhere, ever.

Behaviour is a separate question, and it is opt-in. If you say yes, the app records what you do — which screens you use, where the screenshot reading fails, whether you come back next month. It never records what you are worth.

Those two claims are deliberately kept apart. A privacy claim that is nearly true is worse than none.

None of the following leaves your device, whether or not you opt in to analytics:

• Any amount — a balance, your net worth, a change, a rate, a fee
• The name or label you give an account
• A provider name you type yourself
• A date you enter, such as when a bonus rate ends
• Any screenshot, any text read from one, and any image metadata
• Anything you type into a search box
• Your name, email address, or any contact detail — the app asks for none
• The advertising identifier (IDFA) or the vendor identifier (IDFV)

This is enforced by the shape of the code rather than by care: an analytics event can only carry a fixed option, a count, a duration or a yes/no. There is no way to put text or an amount into one.

When you add an account from a screenshot, the reading happens on your phone using Apple's Vision framework. It works with no network connection at all.

No pixel of a screenshot leaves the device, ever, for any reason including debugging. The image is discarded once you have confirmed the figures.

Choosing a photo uses Apple's own picker, which runs outside the app, so Bearing never gets access to your photo library.

The app asks once, after it has shown you your first net worth figure — never on launch. Until you answer, events are held on the device only and no network request of any kind is made.

If you say no, the held events are deleted and nothing is ever sent. You are not asked again. If you say yes, they are sent and collection continues. You can change your mind either way in Settings.

What is recorded is behaviour: which route you took to add your first account, how long a monthly snapshot took, how often a screenshot read needed correcting, which explainers get opened, whether a second monthly snapshot happens.

Analytics are processed by Mixpanel on servers in the European Union. Automatic event collection, session recording, heatmaps and user profiles are all switched off.

By a random identifier the app generates on first launch. It is not your device's identifier, not the advertising identifier, and not a fingerprint. It is never joined to a name, an email address or an account, because the app holds none of those.

It is stored in the app's own settings rather than the keychain, deliberately: keychain entries survive deleting the app, and the identifier should not outlive your data.

Storing and reading analytics information on your device relies on your consent under the Privacy and Electronic Communications Regulations. Processing the resulting data relies on your consent under the UK GDPR. Consent is opt-in, nothing is pre-selected, and declining costs you no feature.

The app does not ask for App Tracking Transparency permission because it does not track you: it never touches the advertising identifier, and analytics data is never shared with an advertising network or a data broker.

Two years, and we do not choose that. Mixpanel deletes events two years after the date the event happened, automatically and on an ongoing basis. It is a platform-level policy rather than a setting, so there is no dial here to move.

You do not have to wait. Turning analytics off in Settings sends a deletion request immediately — see Your rights below.

Everything on your device — balances, history, account names — is kept until you delete it or delete the app, and is never on a timer, because it is never anywhere but your phone.

Analytics are sent to Mixpanel's European Union region. Sending personal data from the UK to the EEA is covered by the UK's adequacy regulations, so no additional safeguards are required for that transfer.

Mixpanel is a company incorporated in the United States. Whether any of its staff or sub-processors access EU-hosted data from outside the EEA is governed by the data processing agreement between MPC Digital Ltd and Mixpanel, and by the transfer mechanism in it. If that arrangement changes, this section changes with it.

Withdraw consent. Settings carries a switch. Turning it off stops collection immediately, sends a deletion request to Mixpanel for your identifier, and generates a new identifier so that opting back in later does not rejoin the old history.

Deletion. The step above is the Article 17 route and it needs no email. Deleting the app removes everything held on the device — your balances, your history, your account names. It does not by itself remove analytics already sent, which is why the switch does both.

You also have the rights of access, rectification, restriction, objection and portability under the UK GDPR. To use any of them, write to michael@mpcdigital.co.uk. You can also complain to the Information Commissioner's Office at ico.org.uk.

One honest limit: the identifier is random and joined to nothing, so if you ask for a copy of your data we can only find it if you can tell us the identifier. Settings shows it.

The app downloads one file of public reference data — rates, provider entries, explainers, key dates. Every user requests the identical file, so the request tells us nothing about you. It carries no identifier and no data of yours.

Reminders about dated events are scheduled on the device itself. There is no push server, so no server ever learns which products you hold.

There is no account, no login, no password and no sync.

Usage Data (product interaction) and an app-generated device identifier — both declared as not linked to you and not used for tracking. Financial information is not declared, and that must stay true.