Penny uses an AI model for one job: working out what you’re asking. That model never sees your money. Every total, chart and list in Penny’s answer is worked out on your phone, or in your browser on the web, from data already in Copper.

​
What happens when you ask

1

Some questions stay on your device

Changes like “Move $50 from Fun to Groceries” or “Pause Gym until January”, what-ifs like “What if I cancel Netflix?”, and your answers to Penny’s “did you mean…?” questions are all read on your device. Nothing is sent.
2

Other questions go to Copper's server

Over an encrypted connection, signed in as you. The server checks that it’s you, then passes the question on to be read.
3

The AI model picks from a short list

It answers a few multiple-choice questions about what you asked: what kind of question it is (total spent, top stores, subscriptions, bills and so on), the time period, and which store, category or bucket it’s about, if any. On a follow-up, it also says whether your question carries on from the one before.
4

Only its picks come back

Your device turns them into an answer from your own data. If the model isn’t sure, Penny asks you what you meant instead of guessing.
If the server can’t be reached, or we’ve switched it off for a while, your device reads the question itself. Answers read by the model are marked Read by Copper.

​
What’s sent

​
What’s never sent

  • Amounts, balances, transactions or dates from your accounts
  • Your bank or account names
  • Stores you didn’t mention
  • Your name, email or anything else that identifies you. Requests go out under Copper’s own account, so the AI provider can’t tell one person from another.
  • Penny’s answers

​
What Copper keeps

Conversations aren't saved

Chats stay in memory on your phone or in the browser tab, and clear when you start a new chat, close the app, or reload or close the tab.

Questions are kept without your details

To check that Penny reads questions right, Copper keeps a copy with store, category and bucket names and dollar amounts taken out (“How much did I spend at [store] in June?”), along with how it was read and any rating you gave.
Copper’s server logs never record what you typed. Questions are read through OpenRouter and TypeSafe, both listed in the privacy policy.