A personal finance app based in Ukraine is making a case that privacy and convenience need not be at odds. Mirror, operated by Ivannikov Denys, stores its users' transactions, plans, and reflections locally on their iPhones, syncing only through each person's own Apple iCloud account rather than through company-run servers. In an industry where financial apps routinely harvest spending data for advertising or resale, that architectural choice is the policy's most consequential detail.
The approach reflects a broader shift in how privacy-conscious software is built: minimize what leaves the device, and be explicit about the rare exceptions. Mirror's own data controller cannot read the amounts, merchants, or notes users enter, because that information never reaches a Mirror-operated server in the first place. For readers who are used to scrutinizing subscription services before committing their financial data to them, it's worth applying the same habit here - much like comparing providers' logging practices before signing up for a VPN, where understanding what to know before you subscribe often reveals more than the marketing page does. The comparison is apt: both categories of tools ask users to trust a third party with sensitive personal activity, and the fine print on data flows is where that trust is actually earned or lost.
Where the Local-First Model Bends
No privacy architecture is absolute, and Mirror's policy is candid about its two exceptions. The first involves AI-written reflections: when a user opts in, a stripped-down statistical summary - counts, percentages, a movement in a "Spending Score," never amounts, dates, merchants, or notes - travels through Mirror's own server to Anthropic, which generates the narrative text. Custom category names are anonymized to "Other" before anything is sent, so a renamed category referencing an employer or a medical provider never leaves the device. The summary itself is discarded after use; only a monthly usage counter per account persists, and that counter records frequency, not content.
The second exception concerns advertising measurement. Mirror runs ads on Meta and TikTok and wants to know whether they convert into installs. Rather than using a device-level advertising identifier, it relies on Apple's SKAdNetwork and Meta's Aggregated Event Measurement - privacy-preserving mechanisms engineered specifically so platforms can measure ad performance without tracking individuals across apps. This also means Mirror never triggers Apple's App Tracking Transparency prompt, because it isn't requesting the tracking permission that prompt governs.
Processors, Jurisdictions, and Legal Grounding
Mirror's policy names its vendors rather than hiding behind vague language: Mixpanel for de-identified analytics, Sentry for scrubbed crash diagnostics, RevenueCat for subscription entitlements, Superwall for paywall measurement, and Apple's own CloudKit for the actual storage and sync of financial entries, where Apple functions purely as a processor with no visibility into the data. Several of these companies operate in the United States, which means data transferred to them from the European Economic Area or the UK relies on safeguards such as the Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework - the standard legal scaffolding now required for any international service handling European users' data since the Schrems rulings reshaped transatlantic data transfer rules.
For EEA and UK users, the policy grounds its processing in the four recognized legal bases: contractual necessity for core functionality, legitimate interests for security and bug-fixing, consent for optional features like analytics and AI reflections, and legal obligation where regulation demands it. Consent-based features are each given a discrete toggle in Settings, which aligns with GDPR's requirement that consent be granular and revocable rather than bundled into a single accept-all click.
What This Signals for Financial Apps Generally
Financial tracking apps occupy a sensitive category precisely because spending data reveals patterns - health conditions inferred from pharmacy visits, relationship changes inferred from shared accounts, financial stress inferred from overdraft patterns - that users rarely intend to disclose. Mirror's decision to keep that layer of inference entirely on-device, while being specific about the narrow, anonymized exceptions required to power AI features and ad measurement, represents one model for reconciling modern app functionality with data minimization principles. Whether other developers in the category follow suit will likely depend on regulatory pressure as much as competitive differentiation.