Denarius privacy policy
Last updated 9 August 2026.
Your financial data stays on your devices. Denarius collects nothing about you, and every network connection it can make is one you configured.
What is collected
- No analytics. None.
- No telemetry. None, and specifically none about financial content.
- No account. Nothing to sign in to, so no profile and no identifier.
- No usage record. There is no server operated by the developer, so there is nowhere for one to exist.
Receipts and statements are read on your device
Denarius reads receipts and bank statements using Vision for the optical character recognition and Apple’s on-device Foundation Models for understanding what was read. Both run locally, on your Mac, iPad or iPhone.
No image of a receipt, no line of a bank statement, and no transaction is sent to any server for processing. There is no cloud OCR step, no third-party AI API, and no fallback that quietly uploads a file when the on-device path fails.
Everything a machine extracts is shown to you before it is used. Nothing is filed into your ledger automatically. A receipt you cancel or skip leaves the journal untouched.
Every network connection Denarius can make
Two, and you create both.
- Your git remote, if you set one up. Denarius pushes and pulls your ledger over HTTPS to GitHub, GitLab, or any git server you nominate. That is your repository on your chosen host, and their privacy policy governs what happens to it there. Credentials are stored in the Keychain, never in the ledger file. Without a remote configured, Denarius never syncs anything.
- A price provider, strictly opt in. A single preference enables fetching security prices from Yahoo Finance. When it is on, Denarius requests prices for the commodity symbols in your ledger, which means those symbols are visible to that provider. It sends no balances, no transactions and no account names. Turning it off changes nothing else: prices entered by hand or imported from CSV always work offline.
Crash reports stay on your device unless you send them
macOS and iOS give an app reports about its own past crashes and hangs. Denarius keeps the ones the system gives it, so that when something goes wrong there is something to look at afterwards.
- They never leave on their own. There is no server to send them to. They sit in the app’s own folder and are pruned as they age.
- They describe the program, not your books. The system reports which code was running and where it stopped. No ledger content, no account names and no amounts are in them.
- Sending one is a deliberate act. Help ▸ Export Diagnostics… writes a single readable text file wherever you choose to put it. What you do with it then is entirely yours. Attach it to an email, or read it and delete it. You can open it first; it is plain text, and it says at the top what it contains.
Where your ledger lives
A ledger is a folder of text files on your disk, or wherever in Files or iCloud Drive you chose to put it. If you put it in iCloud Drive, Apple syncs it the way it syncs any other document, under Apple’s terms.
Denarius runs inside the macOS App Sandbox and reads only the documents you open. Its automatic version history is a real git repository inside the ledger bundle, on your disk, which means the history is as private as the ledger is.
Spotlight integration is off by default and enabled per ledger. When you turn it on, account names, payees and tags become searchable from the system. Turning it off withdraws all of it immediately.
Apple, and changes to this policy
Denarius is distributed through the App Store, so Apple handles the download and any purchase. Whatever Apple records about that is governed by Apple’s privacy policy and by your device settings, and is not visible to the developer beyond the aggregate figures Apple shows every developer.
If this policy changes, the date at the top changes with it and the change is noted in the changelog. Questions go to support at spqr dot dev.