Privacy policy

Who provides Ice

Ice is provided by Pixrain Limited. Contact us at support@pixrain.com about privacy, support, or your information. This policy describes the Ice app and its privacy and support pages.

Accounting records on your device

Ice stores profiles, accounts, transactions, budgets, conversation history, imported statement evidence, preferences, and diagnostics on your device. Manual accounting does not require an Ice account or permission to use the assistant. CSV statement processing and dictation use on-device processing; PDF statement extraction uses OpenAI with your permission. Dictation may first download an Apple speech model.

Your data is stored in your Ice account. You choose when to import, export, or share files in Files. Deleting a record in Ice does not delete exported copies.

Optional assistant and OpenAI

Before sending assistant requests, Ice asks you to allow sharing with OpenAI. With your permission, it sends your messages, relevant recent conversation history, and the account, balance, budget, or transaction summaries needed to respond. These can contain personal and financial information. When you import PDF statements, Ice lets you mask personal details locally, then sends only the reviewed PDF copies to OpenAI for extraction. Original copies and imported evidence remain on your device.

If you enable Daily review for a profile, Ice also sends selected unchecked activity descriptions, dates, amounts, and journal summaries to OpenAI automatically, including during background runs. Reviews are saved on your device. Findings can create a conversation and a local notification; they never change journal entries without your approval. Turn this off in Settings → Journal review.

Ice sends a randomly generated, persistent safety identifier stored in the device Keychain to help OpenAI prevent abuse. It is separate from accounting account numbers. OpenAI also receives connection information, such as your IP address.

Ice sets the Responses API store option to false. This does not mean zero retention: abuse monitoring, safety processing, and prompt caching follow OpenAI’s applicable terms and account controls. See OpenAI data controls and OpenAI’s privacy policy.

Revoking permission stops subsequent assistant requests; it cannot recall information already sent. Manual accounting remains available. If you supply a personal API key, Ice saves it in the device Keychain. Removing that key does not revoke a credential at its provider.

Apple Wallet

You can select individual eligible Wallet transactions or give Ice permission through Apple FinanceKit to read the accounts and transactions you share. You choose which accounts to connect and map to your accounting profile. Ice refreshes connected transaction history when you choose to sync, including pending, booked, changed, and removed records. This version does not run a background-delivery extension.

Sync and reconciliation run on your device. Ice retains source evidence, local connection mappings and sync checkpoints in your profile. Imported transactions are retained as activities with source evidence. Journal entries provide their accounting treatment; reconciliation links evidence of the same occurrence. Provider updates do not silently change posted journals. Optional assistant sharing is controlled by the separate consent described above.

You can disconnect Wallet in Ice to stop future sync or revoke financial-data access in device Settings. Previously imported accounting records and source evidence remain in your profile until you delete that profile; exports and backups can retain copies. Wallet availability depends on your device, region, and eligible accounts.

Optional Lunchflow connection

If you connect Lunchflow, Ice sends your personal API key directly to Lunchflow over HTTPS to retrieve the accounts you allow, reported balances and posted transactions. Lunchflow receives request information, such as your IP address. Account access and bank connections are managed in your Lunchflow account.

The API key is stored in the device Keychain separately for each Ice profile. Source evidence, account mappings and sync metadata are stored on your device. Ice does not send your local journals or statement files to Lunchflow. Optional assistant sharing remains subject to the separate OpenAI consent described above.

Disconnecting stops future imports and retains your accounting history. Removing the API key disconnects Lunchflow for this profile. Revoke the key in Lunchflow to invalidate it at the provider. Lunchflow’s own terms and privacy policy govern the financial data it receives from your bank.

Waiting list

If you join the waiting list on ice.pixrain.com, we keep your email address, when you joined and confirmed, and whether we have invited you. We use it only to invite you to Ice, on the basis of your consent. We email you a link to confirm; an address that is not confirmed within 7 days is deleted.

Cloudflare Turnstile checks that the sign-up comes from a person; Cloudflare processes your IP address and browser information for that check under Cloudflare’s privacy policy. You can leave at any time: the confirmation email has a link that deletes your address, or ask us at support@pixrain.com.

Support, TestFlight, and website delivery

When you contact support, we receive the information you choose to send, such as your email address and issue description. Avoid sending credentials, bank statements, or other unnecessary financial information. We retain support correspondence only as needed to resolve requests, maintain necessary records, and meet legal obligations.

Apple processes TestFlight diagnostic and feedback information under its terms and may share test feedback with us. You decide whether to send feedback. See Apple’s privacy policy.

Cloudflare serves these website pages and receives information needed to deliver and protect web requests, such as IP addresses and request details. See Cloudflare’s privacy policy.

Purposes, retention, and international processing

We use information to provide requested app and support functions, with your consent for optional assistant sharing and our legitimate interests in security and resolving support requests. We may also retain information when required by law. We do not sell your accounting records or use them for advertising.

Local records remain until you remove them or their containing profile, or delete the app; exports, backups and Keychain items have separate lifecycles. External providers may process information outside your country under their applicable safeguards and retention arrangements. A local storage setting does not control third-party retention.

Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to certain processing of information we hold. You may withdraw optional consent without affecting earlier lawful processing. Contact support@pixrain.com to exercise your rights; we may need to verify your request. For local-only records, use the app’s export and removal controls.

You may raise a concern with your local data-protection authority. In the UK, contact the Information Commissioner’s Office. Children should not use optional third-party services contrary to those providers’ age requirements.

Changes

We update this policy when Ice’s data handling changes. The date above identifies this version. Material changes to assistant sharing will require renewed permission in the app.