Privacy policy
Last updated 2 October 2026
JOTR for YNAB ("JOTR", "we") is an iPhone and Apple Watch app that records purchases in your YNAB plan. The short version: JOTR has no account system and no database; the developer never receives your budget data. Everything JOTR knows lives on your own devices or in your own YNAB account. The one small server we run, a sign-in relay, handles sign-in tokens only and keeps nothing.
What JOTR stores, and where
| Data | Where it lives |
|---|---|
| Your YNAB access and refresh tokens | Your iPhone's Keychain only. They never leave the iPhone except to reach YNAB through our relay (below), and are never sent to the Apple Watch. |
| A cached copy of your plan data — plans, accounts, categories and balances, payees, and recent unapproved transactions | On your iPhone and Apple Watch, in the app's own storage, so the app and complications work without waiting for the network. |
| Entries waiting to be sent to YNAB | On the device where you made them, until YNAB confirms them. |
| Your settings — pinned categories, favorite payees, which Wallet card maps to which YNAB account, and the merchant names you've corrected so JOTR picks the right payee next time | On your iPhone and Apple Watch. |
| How many entries you've made on the free tier (a number, nothing else) | In JOTR's storage and in your iPhone's Keychain, labelled with a one-way hash of your YNAB user ID rather than the ID itself. See "Deleting your data" for why it stays after you delete the app. |
We have no copy of any of this.
What JOTR sends, and to whom
- YNAB. Your iPhone reads your plan from YNAB's API and writes the transactions you capture to it: the payee, amount, date, account, category and a short memo such as "via Apple Pay". YNAB's own privacy policy covers that data once it reaches them.
- Our sign-in relay (
relay.jotrforynab.com). YNAB requires a secret key to issue long-lived sign-ins, and that key can't safely ship inside an app. So when you sign in, and roughly every two hours after, your iPhone sends the relay either a one-time sign-in code or a refresh token. The relay adds the key, asks YNAB for new tokens, and hands them straight back. It never sees a transaction, balance, payee or account; it has no way to accept or return one. It stores nothing and we don't log request contents. To stop abuse, Cloudflare counts requests per IP address and per one-way hash of the refresh token, and those counters expire within a minute. - Apple. If you buy the one-time unlock, Apple processes the purchase through the App Store. We never see your payment details.
Your Apple Watch never connects to the internet for JOTR. It talks only to your paired iPhone.
Apple Pay capture
If you set up the optional Shortcuts automation, iOS passes JOTR the merchant name, amount, card name and date of each Apple Pay purchase on your device. JOTR uses them to create the transaction in YNAB and nothing else. You install the automation's shortcut yourself, from a link in the app. Payee and category suggestions are worked out on your device.
On your devices
- Notifications and Live Activities. After a capture, JOTR shows the payee, amount and category balance in a notification and, if you allow it, a Live Activity. These can appear on your Lock Screen and are mirrored to your Apple Watch, like any other notification. On the watch, amounts are hidden when your wrist is down.
- Siri and Shortcuts. If you log an entry or ask for a balance with Siri, Apple processes your voice request under Apple's privacy policy. JOTR receives only the result (for example, the amount and payee).
- On-device intelligence. On iOS 27 and later, JOTR may use Apple's on-device language model to tidy merchant names and suggest categories. It runs entirely on your iPhone or watch. Only merchant names and category names go into it.
- Diagnostics. JOTR can export a diagnostics log for support. Nothing is sent unless you choose to email it to us yourself. It contains no tokens, and amounts are rounded.
What JOTR does not do
- No analytics, advertising, crash-reporting or other third-party SDKs.
- No tracking, profiling, or sale or sharing of data.
- No location tracking. JOTR never reads your location. watchOS itself may bring a category widget to the top of the Smart Stack when you arrive somewhere.
- No access to your bank credentials or your YNAB password. You sign in on YNAB's own page.
How it's protected
Tokens are stored in the iPhone Keychain, available only on that iPhone and only after it has been unlocked once since starting up. Cached data is protected by iOS and watchOS Data Protection. All of JOTR's internet traffic uses HTTPS. Traffic between your watch and iPhone is encrypted by Apple.
How long it's kept
Cached YNAB data is kept until you sign out or delete the app. Entries waiting for YNAB stay until YNAB confirms them. After that, JOTR keeps a short record on the device for undo and diagnostics and deletes it within 30 days.
Our website, relay and email
Our website, relay and email address run on Cloudflare, which has servers worldwide, including in the United States. Cloudflare processes request metadata such as your IP address transiently, to deliver pages and rate-limit the relay. We have turned off request logging, and we don't log request contents. This site uses no cookies and no analytics.
Emails you send to privacy@jotrforynab.com are forwarded to the developer's mailbox. We keep them only to answer you and delete them within 12 months. These providers handle data under their own data-processing terms, and your information may be processed outside Québec and Canada.
Deleting your data
- Sign out in JOTR's settings. This deletes your tokens and all cached data (everything except the free-tier entry count, below) from your iPhone, and from your Apple Watch the next time it connects to your iPhone.
- Delete the app. This removes everything JOTR stored on the device except the free-tier entry count in the Keychain. That count is kept on purpose so reinstalling doesn't reset the free tier. It never leaves your iPhone, is not copied to a new iPhone, and is erased when you erase your iPhone.
- Revoke access in your YNAB account settings, under connected apps. This invalidates JOTR's tokens at YNAB.
- Email us at privacy@jotrforynab.com and we'll delete anything we hold, which is normally only your email.
Transactions JOTR created in YNAB are ordinary YNAB transactions; edit or delete them in YNAB.
Your rights
You can ask to see, correct or delete personal information we hold, or withdraw your consent. You can also complain to the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.
Person in charge of the protection of personal information: Privacy officer, privacy@jotrforynab.com.
Children
JOTR is not directed at children under 13 (14 in Québec).
Changes
If this policy changes, we'll update the date above and describe the change in the app's release notes. If JOTR starts using a kind of data not described here, we'll update this policy and ask for your consent in the app before using it.