Privacy Policy
Last updated: 2026-08-17
Astorik Pte Ltd. ("we," "us," "our", "Astorik") operates Ultimately (the "App"). This policy explains what data the App collects, why, and where it goes. If you have questions, contact us at support@astorik.com.
The short version
Your expense data — amounts, categories, descriptions, payment sources, dates — lives on your device by default. If you sign in, it's automatically backed up to our servers too — on every plan, not just Premium. Premium is what lets you pull that backup down onto a second device; a free account still gets the backup, just not the ability to restore data when switching devices.
We never ask for, and never have access to, your bank account or card details. There is no bank/Account Aggregator integration in the App. All financial data is what you choose to type or say into it.
Voice logging sends your recording to our transcription and extraction providers to turn it into a draft expense, then discards it — we don't keep a copy on our servers.
We don't sell your data to anyone and don't ever intend to either. Our goal is to build a world-class money intelligence companion for folks who like staying on top of their finances and understand the value of their data. We only share data with the service providers that make the App work, each processing only what their role requires.
What we collect
Expense data you create
Amount, currency, category, description, payment source, and date for each expense you log. This is always stored locally on your device (in an on-device database). If you sign in, the same data is also backed up to our servers automatically.
Voice recordings
If you use voice logging, your recording is sent to our servers, which pass it to our AI providers (Open AI and Anthropic)to transcribe and extract structured expense fields from the transcript) to produce a draft you then review before anything saves. We do not store the audio or the transcript after this happens — only a count of how many voice logs you've made in a period, used to enforce free-tier limits.
Account information
Signing in is optional — voice and manual logging both work without an account. If you do sign in (required to upgrade to Premium, and what triggers the automatic Cloud Sync backup described below), we collect your email address via a one-time passwordless code, handled by our backend provider, Supabase.
Device identifier
If you use the App without signing in, we generate a random identifier stored only on your device, used solely to enforce free-tier voice-logging limits. It is not a persistent cross-app tracking identifier, is scoped to this App only, and resets if you reinstall.
Cloud Sync
If you sign in, your expenses, categories, and payment sources are automatically backed up to our servers (hosted by Supabase, in Singapore) — on every plan, with no separate toggle to turn on. Retrieving that backup onto a device — restoring it, or picking it up on a second device — requires a Premium subscription; a free account's data is backed up but stays where it was created until you upgrade.
Subscription and payment information
Purchases are made through the Apple App Store or Google Play, and processed by Apple/Google and our subscription-management provider, RevenueCat. We never receive or store your payment card details. We store only your subscription status (active, expired, etc.) so the App knows what you're entitled to.
Basic analytics
We use PostHog to understand basic app usage — app opens, crash/error reports, and product events like completing onboarding or adding a category. This never includes amounts, descriptions, payment source names, or other financial content you enter. One exception: if you create a custom expense category, the name you typed is included in that event, so we can see what categories people actually create — this is app-level text, not a financial figure or free-text expense description.
What we don't collect
Bank account credentials, bank transaction history, or anything via Account Aggregator/Open Banking frameworks — the App has no such integration, in any country.
Your payment card number, expiry, or CVV — these never reach us.
Precise location, contacts, photos, or anything the App doesn't need to log an expense.
Who we share data with
We share data only with the service providers that make the App work, each processing only what their role requires:
Provider | Role | What they process |
|---|---|---|
Supabase | Backend hosting, authentication, database | Email (if signed in), your expense/category/payment-source data (backed up automatically once signed in), usage counters |
OpenAI | Voice transcription (Whisper) | Voice recordings, transiently — not stored after transcription |
Anthropic | Expense field extraction (Claude) | Transcribed text, transiently — not stored after extraction |
RevenueCat | Subscription management | Purchase/subscription status |
Apple / Google | Payment processing, app distribution | Payment details (never shared with us), purchase receipts |
PostHog | Basic product analytics | App-level events (opens, crashes, feature usage) and custom category names you create — no amounts, descriptions, or other financial content |
We do not sell your data to any third party, and we do not share it for advertising purposes.
Where your data is processed
Server-side data (for signed-in users) is hosted in Singapore. Our sub-processors above may process data in other countries, including the United States, under their own data protection commitments. By using the App, you consent to this transfer.
Data retention
Local, on-device data persists until you delete it or uninstall the App.
Server-side data (once you've signed in) persists while your account is active; contact us to request deletion at any time.
Anonymous usage counters are automatically deleted after 3 months.
Your rights
You can request access to, correction of, or deletion of any personal data we hold about you by emailing support@astorik.com. If you never sign in, we hold effectively nothing about you beyond an anonymous device identifier and transient processing logs, which age out automatically.
Children's privacy
The App is not directed at, and we do not knowingly collect data from, children under 13 (or the minimum age of digital consent in your jurisdiction, if higher).
Changes to this policy
We may update this policy as the App changes. Material changes will be reflected by updating the "Last updated" date above.
Contact
Astorik — support@astorik.com. Governing law: Singapore.