What dotMoney keeps, and what it doesn’t.

dotMoney is a prototype that uses test funds only. No real money moves through it, and test balances have no value: they can’t be bought with real dollars or cashed out for them.

Some of what you can type into it is real, though. Here is what the apps and our service store, so you can decide what to type.

Last updated September 23, 2026.

On your device

Your wallet, your activity and any money files you haven’t sent stay in the app on your Mac or iPhone. Your wallet’s key is sealed in the device’s secure hardware. A name or note you put on a money file travels with it.

A .money file carries the key to its own funds, unencrypted. Whoever has a copy can claim the funds while they’re unclaimed. If you turn on iCloud Keychain backup, Apple holds an encrypted copy of your wallet key. A .money file saved into an iCloud Drive folder syncs like any other file, key included.

On our service

Every money file that leaves your device is registered with our service, whether it goes as a link, as the file itself, or by hand over to a nearby phone. We keep its amount, note and name if you gave them, its picture, when it was made and when it expires, its status, and the key to its funds. The key is encrypted at rest, and the service can use it: that is what lets someone accept in a browser with no app.

If you accept in a browser, we make a wallet for you and hold its key. A random id in that browser’s storage is what connects you to it. Clear the browser’s site data and the balance is out of reach, though our record of it remains.

The cash-out forms are real forms. A name, email, date of birth, address or bank detail you type goes to our service and to Lightspark Grid’s sandbox. Use made-up details; nothing about the flow needs real ones.

When a new wallet asks for test money, we see its address and the network address it asked from. We keep a hash of each with a count per day, to stop one person draining the faucet. Our service and Fly.io, which hosts it in the United States, also keep ordinary connection logs: network address, time, path.

Who else sees what

Spark moves the money. Lightspark Grid handles the test cash-out flows you use. Fly.io hosts the service. Apple runs TestFlight and, if you choose it, iCloud. Each works under its own terms.

The person you send a money file to sees what’s on it. The app you send it through, a chat, email or AirDrop, sees what it always sees: who sent something to whom, and often a filename or preview. Hand over sends no name, phone number or device id to the other phone, but while Wallet is open, dotMoney’s presence is visible on the local network.

There are no analytics, no advertising and no third-party scripts on these pages. We don’t sell any of this.

What we don’t do

We don’t delete records when a money file expires or is cancelled; they stay as receipts and for recovering an interrupted transfer. We don’t promise a retention period, because we haven’t built one. We don’t erase the key from a .money file that’s already out there; only the funds moving makes it inert.

Questions about this prototype? Email privacy@lightspark.com.