The core of this policy in one sentence:
Your financial data stays on your device. There is no Lens cloud database holding it, we do not sell it, and we do not share it for advertising. It leaves your phone only for features that need it: the Pro AI features (Ask AI, AI receipt parsing, and the weekly briefing Pro shows on Today), which send your question, your receipt, or a few lines of your own figures through Lens to Google's paid Gemini API (never before you have agreed to it in the app), and optional live investment prices, which send only ticker symbols (never amounts, quantities, or your identity) through Lens to a market data service. Bank Sync, if you turn it on, brings data the other way: it reads bank data Apple already holds on your device and sends nothing out. Details in sections 4, 5 and 10.
Edniroya Ltd ("Lens", "we", "us") operates the Lens Finance mobile application (the "App").
To contact us, email hello@edniroya.com or use the Share Feedback option in Settings, under Support.
Lens is engineered so that your financial records are not copied to a Lens server. There is no Lens cloud database holding your transactions, accounts, goals, or budgets. All of it is stored in a local database on your device only, protected by the operating system at rest: iOS Data Protection on iPhone, app-private storage on Android.
The AI features are the exception, used only with your permission, and only while a request is in flight. What you send to Ask AI, to AI receipt parsing, or to the weekly briefing passes through a Lens-operated Cloud Function on its way to Google, and is not stored there. Sections 4 and 10 set out exactly what is sent and what is kept.
This means:
The following data is stored exclusively on your device. It is never transmitted to Lens:
While Lens itself does not collect your data, the App uses a small number of third-party services that process limited, non-financial information to function.
RevenueCat: Subscription and in-app purchase management. Receives a pseudonymous device ID and your App Store or Google Play purchase receipt. No financial data. No name or email.
Firebase Cloud Messaging (Google): Push notifications sent by Lens (if you allow notifications). Receives a pseudonymous device notification token. No financial data. Bill reminders are scheduled by your own device and do not go through Firebase. Notifications are off by default.
Google Gemini API: AI receipt parsing, Ask AI, and the weekly briefing (Pro only). Receives only what each feature needs. For receipt parsing: the receipt OCR text or a downscaled image of the receipt. For Ask AI: your question, the last 8 messages of that conversation, and a snapshot of your finances built on your device, listed in full in section 10 (it includes your account names and balances, your goal names and progress, this month's totals by category, and your last 20 transactions). For the weekly briefing: a few lines of your own figures for the period: what you spent against your budget, how that compares with the period before, how many days you were on track, and the name of your biggest everyday category. Nothing is sent until you have agreed to the AI features in the app (section 10).
Lens uses the paid Gemini tier. Google processes these requests as a data processor for Lens under its Data Processing Addendum for the Gemini API. Google states that prompts and responses submitted through the paid Gemini API are not used to train Google's models, and they are not used for advertising. We are satisfied that this gives your data the same or equal protection to what this policy promises.
Firebase Cloud Functions and Cloud Firestore (Google): All AI requests (Ask AI, AI receipt parsing, and the weekly briefing) are sent first to a Lens-operated Cloud Function which verifies your Pro entitlement, counts your AI usage, and forwards the request to the Gemini API on your behalf. The Gemini API key is held server-side; it does not exist in the app binary. Lens does not log or store your questions, your receipt text, your receipt images, or Ask AI answers.
Four things are kept on the server against your anonymous sign-in id: how many AI actions you have used this month and today, how many live price and stock search requests you have made each day (a count per day, used to cap them at 300 a day), your Pro status as reported by RevenueCat, and, on Pro, the wording of your current weekly briefing so that reopening Today does not generate it again. None of them contain your transactions, balances, or account details.
Firebase Authentication (Google): Anonymous sign-in. The App signs in without a name, email, or password, so the Cloud Function above can tell one device from another when checking your Pro entitlement and counting AI usage. The same id is what you see as your support code if you contact us, and it is passed to RevenueCat so your purchases and your usage line up. No personal identifier is collected.
Firebase Crashlytics (Google): Crash reporting, enabled in release builds. Receives crash stack traces plus device model and OS version. It does not receive your transactions, balances, or any other financial data.
Firebase App Check (Google): Abuse protection for the Lens-operated Cloud Functions. Before a request, your device asks Apple (App Attest on iPhone) or Google (Play Integrity on Android) for a token showing the App has not been tampered with, and sends that token with the request. Verification of the token is not switched on yet, so at present it is collected rather than enforced, and it is not what protects those endpoints. The AI and price endpoints require a signed-in device, an active Pro entitlement checked against the App Store or Google Play, and daily and monthly usage limits, all applied on our server where they cannot be bypassed. The token says nothing about you and carries no financial data.
Firebase Analytics (Google): Anonymous product analytics, on by default and switchable off in Settings, under Privacy. Receives bucketed counts and fixed labels describing which screens were opened and where people stop, for example that an onboarding step was viewed or that the Pro screen was shown, together with your platform, app version, app language, and whether you are on Pro. It never receives your amounts, balances, transactions, or the names of accounts, goals, categories, or merchants, and it never receives anything you typed. Lens does not collect an advertising identifier, does not ask for tracking permission, and does not link your activity across apps or devices. Turning the switch off stops collection immediately.
Finnhub: Live investment prices and stock search (optional, off by default). When you search for a stock in the holding form or turn live prices on for an investment account, only ticker symbols and your search text are sent through a Lens-operated Cloud Function to Finnhub to fetch prices. Your quantities, holdings values, account names, and identity never leave the device. The Finnhub API key is held server-side, and Lens caches prices for up to a day so symbols are requested at most once per day.
Yahoo Finance: The same optional feature, for markets outside the United States. Here the App queries Yahoo directly from your device rather than through the Cloud Function, so your device IP address reaches Yahoo for that request. Only the ticker symbol or your search text is sent. Amounts, quantities, and your identity are not.
Frankfurter: Published European Central Bank reference exchange rates, used to show a converted estimate when you hold accounts in more than one currency. The App requests the current rate table for your base currency directly from your device. No amounts, balances, or personal data are sent.
Google Fonts: The App uses four typefaces (Outfit, JetBrains Mono, Space Grotesk, and Manrope) served by Google's font service. They are fetched the first time they are needed and then cached on your device, so a fresh install makes a request to Google to collect them. No financial data, and nothing identifying you, is sent with that request.
Apple and Google: App distribution and in-app purchases, through the App Store on iPhone and Google Play on Android. Governed by their own terms. Lens receives only subscription entitlement status.
On iPhone, the App also reads Apple's signed record of which version of Lens your Apple Account first downloaded. It does this on your device, through Apple's StoreKit, only to work out whether you keep the earlier free plan described in the Terms of Service. Lens does not send that record anywhere.
Lens does not sell, rent, or share any data with third parties for advertising or marketing purposes.
Bank Sync is optional, iPhone only, and off until you turn it on. It does not connect Lens to your bank. Lens reads bank data that Apple already holds on your device, using Apple's FinanceKit.
Three things must happen before any bank data reaches the App, and you control all three:
Once enabled, transactions and balances pass from Wallet's on-device store, through Apple's framework, straight into the App's local database on your device. There is no aggregator, no screen scraping, no third-party bank data provider, and no Lens server involved at any point. Your bank credentials are never seen by Lens; the connection lives between you, your bank, and Apple.
Synced data is stored on your device under the same terms as everything else in section 3. Turning off a linked account, or revoking access in iOS Settings, stops further syncing.
If you enable bill reminders or other push notifications in Settings, the App registers a pseudonymous device token with Firebase Cloud Messaging (Google). This token is used solely to route notifications to your device. It is not linked to your identity or your financial data.
Notifications are disabled by default. You can turn them off at any time in Settings or in your device's notification settings.
If you enable Face ID, Touch ID, or fingerprint lock, all authentication is handled by your device's operating system. Lens does not have access to your biometric data. The App receives only a pass or fail result from the OS.
The backup feature exports a file of your App data to a location you choose (typically iCloud Drive on iPhone, or Google Drive on Android). This file is transferred directly between your device and your chosen storage service. Lens does not receive or store copies of your backups.
Your Pro entitlement status is excluded from backups; it is restored from your App Store or Google Play purchase history when you re-install the App. A backup does record whether the App is on the earlier free plan or the trial-based plan, so that restoring it keeps the right one. On iPhone, Apple's record described in section 4 takes precedence. The security of your backup depends on the security of your chosen cloud storage account; iCloud Drive encrypts files at rest by default.
CSV files are processed entirely on your device. Exported CSV files are shared via your device's native share sheet to wherever you choose to send them. Lens does not receive copies.
Your permission comes first. None of the three AI features sends anything anywhere until you have read what will be shared and agreed to it in the app. Lens asks once, before the first AI request, and does not run the weekly briefing until you have agreed. You can withdraw that permission at any time in Settings, under Privacy, and the AI features stop sending data straight away. Everything else in the App keeps working without it.
Receipt scanning uses two paths depending on your tier:
Ask AI (Pro only) follows the same routing: your question, the last 8 messages of that conversation (yours and the AI's), and a snapshot of your finances are sent through the same Lens-operated Cloud Function to Google's Gemini API. The snapshot is built on your device from your own records and is the same for every question. It contains: your base currency; this month's income, expenses, budget, amount saved, savings rate, and fixed and everyday outgoings; your spending by category, with amounts and percentages; each account's name, type, and balance; each goal's name, progress, and target; your cash, invested, other assets, and debts; months of runway and monthly burn rate; your net worth; and your last 20 transactions, each with its description, amount, and date. Lens does not log prompt content, image bytes, or responses.
The weekly briefing (Pro only) is the one AI feature you do not trigger yourself, so it waits for the permission described above and never runs before it. On Pro, the Today screen shows a short written check-in once a week, and a month-end edition at the end of each month. To write it, Lens sends a few lines of your own figures for the period through the same Cloud Function to Gemini. The wording that comes back is stored against your anonymous sign-in id until the next period, so that reopening Today does not generate it again. You can dismiss the card for the period.
Pro includes a fair-use allowance of 100 AI actions a month, and no more than 20 in any one day, covering both Ask AI and AI receipt parsing. The allowance refreshes on the 1st of each month. The weekly briefing does not count against it, because it is already capped at one generation per period. On-device OCR has no limit.
Receipt images are never stored on a Lens server. Any copy stays on your device.
Lens Finance is not directed at children under 13. If you believe a child under 13 has provided data through the App, please contact us via hello@edniroya.com and we will address it promptly.
Lens is a tracking tool, not a financial adviser. The data displayed in the App reflects only what you have entered. It is not financial advice. See the Terms of Service for more detail.
Because Lens does not collect or hold your financial data, most data subject rights (access, deletion, rectification) are exercised directly on your device by editing your data or deleting the App. For data held by our third-party processors (RevenueCat, Firebase, including Firebase Analytics, and Google Gemini), please refer to their respective privacy policies. To exercise rights regarding any limited data we may hold, contact hello@edniroya.com.
We will update this policy if our practices change. Material changes will be notified within the App.
The "Last updated" date at the top reflects the most recent version.
Questions about this policy? Email us at hello@edniroya.com or use the Share Feedback option in Settings, under Support.
