Privacy Policy
Last updated 23 August 2026
Nornas helps you see what is coming: bills, paydays and reminders, before they arrive. Almost everything it knows stays on your iPhone. This page explains the exceptions.
The short version. Your bills, plans and reminders live on your device and are never uploaded. We do not use analytics, we do not track you, we show no advertising, and we never sell or share your information. Data reaches our servers only when you choose to share something with another person, or when you connect a bank. We never see your bank credentials.
Who we are
Davfalcon Company LLC, of 640 W 53rd Terrace, Hialeah, FL 33012, United States (“we”, “us”), is the controller of the personal data described here.
Questions, requests, or anything about this policy: davidm@davfalcon.com.
What stays on your device
The following never leaves your iPhone and we never receive it:
- Your bills, paydays, reminders and the amounts attached to them
- Your plans, their budgets, destinations and cover photos
- Which entries you have marked paid, received or done
- Your profile name and photo
- Anything Nornas reads from Calendar or Reminders
- Text recognised from a screenshot or email you share into Nornas
- Reminder notifications, which are scheduled by iOS on the device itself
If you use Nornas without signing in and without connecting a bank, we hold no personal data about you at all.
The permissions Nornas asks for, and why
| Permission | Why Nornas asks | What happens to it |
|---|---|---|
| Calendar | To find dated events that carry an amount, so a bill already in your calendar can become an entry without retyping it. | Read on the device. Never uploaded. Nornas never writes to or deletes your calendar. |
| Reminders | The same, for reminders that mention an amount. | Read on the device. Never uploaded. Nornas never changes your reminders. |
| Location | Only while you are choosing a destination for a plan, so the map opens near you instead of somewhere arbitrary. | Used by Maps on the device for that moment. We do not store it, log it or receive it. |
| Photos | To set a cover photo on a plan or a profile picture. | You pick a single photo through Apple’s picker; Nornas never gets access to your library. The photo is stored on the device. |
| Notifications | To remind you the day before a bill is due, and on the morning of a payday. | Scheduled locally by iOS. There is no push server and no notification content reaches us. |
Every one of these is optional. Nornas works without them; it just does less. You can change any of them at any time in the Settings app.
What we do receive, and when
When you sign in with Apple
Signing in is only required for sharing and for a bank connection. Apple gives us an account identifier and, if you allow it, your name and an email address, which may be Apple’s private relay address rather than your real one. We use it to identify your account and nothing else. We do not email you.
When you share a bill or a plan
Sharing uploads that one entry so the other person can see it: its name, amount, date, how often it repeats, who has paid, and the display names of the people sharing it. Everything you have not shared stays on your device.
Invitation links are single use and expire after thirty days. We store only a hash of the link, never the link itself, so a copy of our database does not give anyone access to your shared entries.
Turning sharing off, or deleting the entry, removes it from our servers.
When you connect a bank
Bank connections are not available yet. This section describes what will happen when they are, so you can decide before it arrives rather than after. Nothing below is taking place today.
Bank connections are handled by Plaid Inc. You enter your bank credentials in Plaid’s own screen. Nornas never sees, receives or stores your bank username, password or security answers.
With your permission, Plaid gives us:
- The name of your bank and of the connected accounts
- Recurring transactions Plaid has identified, meaning the merchant, the amount and how often it repeats, so Nornas can offer to add them as bills
- For credit cards, the next due date and the minimum payment
We use this only to suggest entries and to keep amounts current. We do not use it for advertising, we do not profile you with it, and we never sell or share it. You can disconnect a bank at any time in Account, which deletes the connection and the data derived from it.
Plaid processes your information under its own terms. Please read Plaid’s End User Privacy Policy.
When you subscribe
Payment is handled entirely by Apple. We never receive your card details. Apple gives the app a signed receipt, which we verify to know whether your subscription is active and when it expires. We store that status and the transaction identifier. Nothing more.
What we never do
- No analytics or usage tracking of any kind. There is no analytics SDK in the app.
- No advertising, and no advertising identifiers.
- We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in California law.
- No profiling and no automated decisions with legal effects.
- We do not read your email. iOS does not permit it and Nornas does not attempt it.
Who else processes data for us
| Who | What for |
|---|---|
| Apple | Sign in with Apple, subscriptions, App Store delivery |
| Google (Firebase) | Authentication, database and hosting for shared entries and subscription status |
| Plaid | Bank connections, if you choose to connect one |
Each is bound to process data only on our instructions, except where they act as controllers in their own right under their own policies.
Where your data is held
Our servers are in the United States. If you are in the United Kingdom, the European Economic Area or Switzerland, this means your data is transferred outside your region. Those transfers rely on the European Commission’s Standard Contractual Clauses, and on the UK Addendum where it applies.
How long we keep it
- Shared entries. Until you stop sharing or delete them.
- Invitations. Until used, or thirty days, whichever comes first.
- Bank connection data. Until you disconnect the bank, or within a day of a subscription lapsing.
- Subscription status. While your account exists.
- Your account. Until you delete it. Deleting it removes your data from our servers.
Deleting the app removes everything held on the device. If you have an account, delete it from Account first. Removing the app does not delete server-side data on its own.
Your rights
Wherever you live, you may ask us to give you a copy of your data, correct it, or delete it. Write to davidm@davfalcon.com. We answer within thirty days and we will not treat you differently for asking.
If you are in the UK, the EEA or Switzerland
You also have the right to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting what was done before. We process your data to perform our contract with you (running the app and its features), on the basis of your consent (device permissions, bank connections), and on our legitimate interest in keeping the service secure and working.
You may complain to your national data protection authority. In the UK that is the Information Commissioner’s Office.
If you are in California
You have the right to know what we collect and why, to delete it, to correct it, and to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of, but the right stands. You may use an authorised agent, and we will not discriminate against you for exercising any of this.
Children
Nornas is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has given us information, write to us and we will delete it.
Security
Data in transit is encrypted. Bank access tokens are held in Google Secret Manager and are never readable by any app, including ours on the device. Database rules deny all client access by default. Requests from the app are attested with Apple’s App Attest, so a modified copy of the app cannot reach our servers.
No system is perfect. If you find a security problem, please write to us before disclosing it publicly.
While Nornas is in testing
Nornas is distributed to testers through Apple’s TestFlight before it reaches the App Store. If you received it that way, two more things are true for as long as the testing lasts.
Apple sees more than usual. TestFlight collects crash reports and any feedback you send through it, and passes them to us. That is Apple’s processing under Apple’s privacy policy, and it stops when the app leaves TestFlight.
Server data may be cleared without notice. A test build can change the shape of what is stored, and we may reset it between versions. Anything you shared could disappear. What is on your device is not affected, but please do not treat a beta as a place to keep something that matters.
Changes
If we change this policy in a way that matters, we will say so in the app before the change takes effect. The date at the top always reflects the current version.