Privacy Policy

Who we are

Rollo (previously called Ladders) is provided by James Leggatt, an individual (sole trader) in the United Kingdom, who is responsible for your data under UK data protection law (the UK GDPR). You can reach us at [email protected].

What we store

• On-device app: budgets, entries, goals, categories, currency, time zone and preferences are stored on your phone. Daily budgeting does not require a Rollo account or an internet connection.
• Free budget allowance: a flag in your phone’s secure storage remembers whether a budget has been used. This flag stays on your device and is not included in exported backups.
• Optional usage statistics: while sharing is on, PostHog receives selected app events with a random analytics ID, app version, platform and event time. This ID is separate from your purchase ID and is not linked to your name or email.
• Former online version: if you used the earlier online version (called Ladders), the account email and entries you stored there remain in our hosted database until you ask us to delete them. The app no longer signs in to that account.
• Your currency and time zone, so amounts show correctly and each day ends at the end of your own day.
• What you enter: your budgets, income, spending entries (amount, note, date and, if you use them, a category), pot entries, goals and the names of any custom categories.
• Your subscription: RevenueCat and the app store check your plan using a persistent purchase ID. Budget entries are not sent to RevenueCat.

Rollo never connects to your bank. When you subscribe in the iPhone app, Apple takes the payment: we never see your card details.

Why we use it

We use your data only to provide Rollo to you: to work out your daily amount, keep your pot and goals, and know which plan you're on. That is the legal basis we rely on: it's needed to provide the service you've asked for.

Optional usage statistics help us understand app use, setup completion and the steps from seeing a paywall to completing a purchase. Sharing is on by default unless you have already switched it off. You can turn it off during setup or anytime in Settings → Account → Privacy.

What we don't do

• No ads.
• No advertising tracking or cross-app tracking. This website has no analytics tools.
• No financial entries, amounts, balances, notes, category names, email addresses, purchase IDs, receipts or backup contents are sent to PostHog.
• No automatic screen or tap capture, session recordings, or location enrichment in our app analytics.
• We never sell your data or share it for marketing.

Who helps us run Rollo

A few companies process data for us, only to run Rollo:

• Turso holds account data and entries from the former online version until you ask us to delete them. The app never uploads budget data to it.
• RevenueCat keeps track of your subscription status. It knows you by a purchase ID, retained from your account when you import an older export.
• Apple takes App Store payments and manages subscriptions.
• PostHog processes optional app usage statistics while sharing is on. It does not receive your financial records or RevenueCat purchase ID from Rollo.
• Railway hosts this website.

These providers may store data outside the United Kingdom. Where they do, appropriate safeguards are in place to protect it, as UK data protection law requires.

Cookies and storage

The on-device app uses a local database. The app stores your usage-sharing choice separately from financial records. While sharing is on, it also stores a random analytics ID and a limited queue of usage events on your phone. This website does not use cookies. We do not use tracking cookies.

Your usage-sharing choice

Sharing is on by default when there is no saved choice. A previous opt-out stays off. You can switch it off during setup or in Settings → Account → Privacy → Share usage statistics. Rollo works normally with sharing off and without an internet connection.

The selected events are app opens, setup started, first budget created, paywall viewed (including whether it was for budgets, categories or an upgrade), purchase started and purchase completed. These measure actions, not the contents of your budget. Creating a first budget means successfully saving it, not reaching its end date. Restoring purchases and importing backups are not counted as new purchases or newly created budgets.

Events use a random identifier so we can count returning installations and understand conversion steps. This is pseudonymous usage data, not fully anonymous data. PostHog receives the IP address needed to handle a network request, but Rollo does not add IP addresses or location information to event properties and disables location enrichment.

While offline, enabled usage sharing queues a limited number of events and sends them when a connection returns. Turning sharing off stops new collection and uploads, discards queued events and resets the analytics identity; a request already in transit may complete. Events already received by PostHog are not recalled by turning sharing off. Your choice and analytics identity are not included in exported financial backups.

How long we keep it

Budget data stays on your phone until you erase it or uninstall the app. Importing a backup retains one local recovery copy of the replaced data; a later import replaces that copy, and deleting local data erases it. The app retains your purchase ID and the free-budget-used flag when you delete local budget data. Secure storage may survive reinstall on iOS. Files you export and any operating-system backups remain wherever you save them. Data from the former online version is kept until you ask us to delete it.

Backups and deletion

In the on-device app, use Settings → Account → Export backup or Import backup to move your data. Exported JSON files are readable and include your purchase ID; share them only with people you intend to receive that data. Settings → Account → Delete local data erases budgets, entries, goals, categories and preferences on that phone, including the local recovery copy. It keeps your purchase ID and does not reset your free budget allowance. It does not delete exported files or a former online account. To delete a former online account, contact us. Deleting data does not cancel an App Store subscription: cancel it in your App Store account settings.

Your rights

Under UK data protection law you have the right to:

• get a copy of the data we hold about you;
• have it corrected if it's wrong;
• have it deleted;
• get it in a form you can take elsewhere;
• object to how we use it.

To use any of these rights, email [email protected].

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Children

Rollo is not meant for children under 16, and we don't knowingly collect their data.

Changes to this policy

If we change this policy, we'll update the effective date at the top of this page.

Contact

Questions about your data? Email [email protected].