Last updated: 1 August 2026 Poros ("we", "us", "our") is a personal finance application operated for Singapore residents. We are committed to protecting your personal data in accordance with the Personal Data Protection Act 2012 (PDPA) of Singapore. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights available to you. By creating an account and using Poros, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your personal data as described herein. 1. PERSONAL DATA WE COLLECT We collect only the data necessary to operate the app and provide you with financial insights. This includes: Financial profile data — your age, citizenship status, employment type, whether anyone depends on your income and how many, whether you have served National Service, your target retirement age, a display name you choose, CPF account balances (OA, SA, MA, RA), bank and cash account balances, investments, SRS balance, Singapore Savings Bonds and T-bills, property details, vehicle details, home loan and other liabilities, monthly income and expenses, insurance policy details, and financial goals. Each field is optional, and the app explains why it is asked for at the point it is requested. You enter this data yourself or import it; we do not connect to banks or government systems in this version. Transaction data — income, expense and investment records, dates, categories, amounts, account names, quantities, currencies, and notes that you log or import, together with any monthly category budgets you set. Documents and images you provide for import — if you use receipt scanning, the photograph you capture or select. If you import a broker or bank statement, the file you choose (CSV or PDF) and its contents. These are used to extract transactions, as described in Sections 2 and 5. Account credentials — your email address and a hashed password, managed securely via Supabase Auth. We never store your password in plaintext. Device and usage analytics — usage events (screens visited, features tapped, errors encountered) collected via PostHog. These events are linked to a random account identifier so we can tell repeat visits apart, not to your name or email address. Your name, email address, and financial figures are never sent to PostHog. 2. PURPOSE OF COLLECTION AND USE We collect and use your personal data solely for the following purposes: • To create and manage your Poros account and authenticate your identity. • To calculate and display your net worth, cash flow, CPF projections, and goal timelines within the app. • To apply the correct Singapore rules to your situation — for example, your CPF contribution allocation depends on your age, and your SRS contribution cap depends on your citizenship. This is why those fields are requested, and each one explains itself at the point it is asked. • To extract transactions from a receipt or statement when you choose to import one, as described in Section 5. • To personalise the financial insights, tips, and summaries shown to you based on your profile. • To store and retrieve your financial data securely across devices. • To improve app performance, fix bugs, and understand how features are used, via usage analytics that carry no name, email address, or financial figures. • To communicate important updates to this Privacy Policy or the app's Terms & Conditions. We do not use your data for advertising, marketing, credit scoring, sale to third parties, or any purpose not listed above. 3. LEGAL BASIS FOR PROCESSING Under the PDPA, we rely on your consent as the legal basis for collecting and processing your personal data. You provide this consent when you create an account and agree to this Privacy Policy. You may withdraw consent at any time by deleting your account from within the app, which erases your personal data immediately (see Section 6). 4. DATA STORAGE AND OVERSEAS TRANSFER Your profile, transaction data, and account credentials are stored on Supabase, a cloud database platform. Supabase servers may be located in the United States or other countries outside Singapore. By using Poros, you consent to the transfer of your personal data to these servers. Supabase applies industry-standard security controls including encryption at rest and in transit, and operates under applicable data protection frameworks. Usage analytics events are processed by PostHog, which may also store data outside Singapore. As noted, these events carry a random account identifier but never your name, email address, or financial figures. 5. DISCLOSURE TO THIRD PARTIES We do not sell, rent, or trade your personal data. We disclose personal data only to the following third-party service providers, and only to the extent necessary for them to provide their services to us: • Supabase (Supabase Inc.) — cloud database and authentication provider. Stores your profile, transaction records, and account credentials. Acts as a data intermediary under the PDPA. • PostHog (PostHog Inc.) — product analytics provider. Receives usage events linked to a random account identifier. Your name, email address, and financial figures are never shared. • Anthropic PBC — provider of the AI features that read documents and answer questions. Content is sent to Anthropic only when you actively use one of these features, and only the content that feature needs: – Receipt scanning: the photograph you capture or select is transmitted to Anthropic so the merchant, date, amount and suggested category can be extracted. A receipt image may show the merchant, the items purchased, the total, and in some cases the last digits of a payment card. – Broker or bank statement import (PDF, and CSV formats we cannot read locally): the contents of the file you choose are transmitted to Anthropic so the transactions can be extracted. A statement may show your holdings, balances, and account identifiers. – In-app chat, if and when it is made available to you: the message you send, recent conversation turns, and a summary of your financial profile are transmitted to Anthropic to generate a response. Anthropic processes this content to produce the requested output and does not use it to train its models. See Anthropic's privacy policy for its retention practices. We do not send your data to Anthropic in the background — only when you tap to scan a receipt, import a statement, or send a chat message. Some imports never leave your device: IBKR broker CSV files and DBS, UOB and Maybank bank statement CSV files are parsed entirely within the app and are not transmitted to Anthropic or to us. • Frankfurter (frankfurter.app) — public exchange-rate service, used to convert foreign-currency investments into Singapore dollars. We send only currency codes (for example "USD"). No personal or financial data is transmitted. Beyond these providers, we will only disclose your data if required to do so by Singapore law, a court order, or a lawful request from a government authority. 6. DATA RETENTION We retain your personal data for as long as your account remains active. You can delete your account and all of your data at any time from within the app — Settings, then "Delete all my data". You do not need to contact us or ask our permission. Deletion is immediate and permanent: your profile, transactions, cash accounts, properties, vehicles, insurance policies, goals, budgets, net worth history and usage counts are erased, and your login itself is removed. It cannot be undone, and we cannot recover the data afterwards. Usage analytics data held by PostHog is linked to a random account identifier rather than your name or email address, and may be retained indefinitely for product improvement purposes. It contains no financial figures. Once you delete your account, the record connecting that identifier to you is erased, so the remaining analytics data can no longer be traced back to you. Receipt images and imported statements are not stored. When you scan a receipt or import a statement, the image or file is passed through to Anthropic, the transactions are extracted and returned to your device, and the original is discarded. We keep only the resulting transaction records — the same records you would have typed in by hand. The image or document is never written to our database or file storage. We keep a monthly count of how many receipt scans and statement imports you have run, so that fair-use limits can be applied. This is a count only; it does not include the contents of anything you scanned or imported. 7. SECURITY MEASURES We implement the following technical and organisational measures to protect your personal data: • Row-level security (RLS) on our database, ensuring each user can only access their own data. • Encryption of all data in transit using TLS/HTTPS. • Encryption of data at rest on Supabase infrastructure. • Secure authentication managed by Supabase Auth, with no plaintext password storage. • Access to production systems is restricted to authorised personnel only. No method of transmission or storage is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security. 8. YOUR RIGHTS UNDER THE PDPA As a Singapore resident, you have the following rights regarding your personal data: • Right of access — you may request a copy of the personal data we hold about you by contacting us at helloporosapp@gmail.com. • Right of correction — you may correct inaccurate or incomplete personal data directly within the app at any time, or by contacting us. • Right of withdrawal — you may withdraw your consent to the collection and use of your personal data at any time by deleting your account in the app (Settings → Delete all my data). This erases your data and your login immediately, as described in Section 6. • Right to data portability — you may request an export of your financial data in a readable format by contacting us. To exercise any of these rights, contact us at helloporosapp@gmail.com. We will respond within 30 days. 9. COOKIES AND TRACKING Poros is a mobile application and does not use browser cookies. The app does not track your location, access your contacts, or use your microphone. Device analytics are limited to in-app usage events as described in Section 1. Camera and photo library — Poros requests access to your camera and photo library for one purpose only: so you can photograph or select a receipt to scan. Access is requested at the moment you choose to scan a receipt, never in the background, and you may decline. If you decline, every other part of the app continues to work. We do not browse, scan or upload your photo library; only the single image you select is used, and it is transmitted to Anthropic solely to extract the transaction, as described in Section 5. Files — when you import a broker or bank statement, Poros accesses only the file you explicitly choose. Notifications — Poros can send you optional reminders to log your spending. These are off by default, and permission is requested only at the moment you switch them on in Settings, never at launch. The reminders are generated entirely on your device: no notification is sent from our servers, nothing about them leaves your phone, and they contain no financial figures or account details. You can turn them off at any time in your phone's own notification settings. 10. CHILDREN Poros is intended for users aged 18 and above. We do not knowingly collect personal data from persons under 18. If you believe a child under 18 has created an account, please contact us at helloporosapp@gmail.com and we will delete the account promptly. 11. CHANGES TO THIS POLICY We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. When we make material changes, we will notify you within the app and update the "Last updated" date above. Your continued use of Poros after the effective date of changes constitutes acceptance of the updated policy. 12. CONTACT AND DATA PROTECTION ENQUIRIES For any privacy-related questions, data access or correction requests, or complaints regarding our handling of your personal data, please contact: Poros Support Email: helloporosapp@gmail.com If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore at pdpc.gov.sg.
Generated from the Poros app source — this page and the copy shown in-app are the same text. Contact: helloporosapp@gmail.com