Privacy policy

Who is responsible for this data

This application is run by a private individual, not a company. There is no dedicated data protection officer; the contact below reaches whoever administers the app directly.

What data is collected

• Account: name, email address, and a hashed password (never the password itself). If you sign in with Google, also the account identifier Google gives us and the email address on that account — never a Google password, and no token that would let this app read anything else from your Google account.
• Financial data you enter: accounts, transactions, amounts, dates, payees, free-text descriptions, budgets, goals, and recurring templates.
• Device: if you turn on browser notifications, the subscription your browser gives us to deliver them (not your name or location).
• Receipt photos: only if you use the receipt scanner. The photo is sent to the vision model, read, and discarded — it is never stored by this app, and it does not appear in any backup. What is kept is only what you confirm in the form.
• Monthly summaries: only if you ask for the AI analysis of a month. What is sent is a summary of that month — totals by category, budgets, recurring charges, the trend of recent months — never individual transactions, never account numbers, and never the name or email of anyone in the ledger. The text that comes back is stored with your ledger until you delete it.
• Usage: technical logs kept by the hosting provider for a limited time to operate and secure the service, plus the counters this app itself keeps to prevent abuse (login attempts, sign-ups per day, receipt scans and analyses per day). If you open a support case, it also stores the case, the temporary support permissions you give, and a record of administrative access; it never copies financial content into that audit record.

Why this data is processed, and on what legal basis

Your account and financial data are processed to provide the service you asked for by creating an account: this is "performance of a contract" (GDPR art. 6.1.b), not consent, so it cannot be withdrawn while the account exists — deleting the account is how you withdraw it.

Push notifications are processed only with your explicit consent, given when you turn them on in Settings. You can withdraw it at any time from the same screen, or from your browser settings. The same goes for the two AI features: the receipt scanner only runs when you choose to take a photo, and the monthly analysis only when you press the button that asks for it. Neither ever runs on its own.

The abuse counters (failed sign-in attempts per account and per IP address, sign-ups and scans per day), and the restricted administrative audit trail, are processed under legitimate interest (GDPR art. 6.1.f): without them the service cannot be protected against brute-force attacks, automated sign-ups or unauthorised administrative access. Financial support access is separate: it only happens for an open case with your explicit, revocable seven-day permission. A shared ledger also needs every active member's permission.

How long data is kept

Your data is kept for as long as your account exists. Deleting your account, from Account → Security, permanently erases your personal ledger and any shared ledger where you are the only member, along with everything in it. The 30 most recent encrypted daily backups are kept and older ones are deleted, so a deleted account disappears from the backups within roughly 30 days. The abuse counters are purged after seven days. Password-reset and email-confirmation links expire on their own — one hour and 24 hours respectively — and can only be used once. Administrative audit records are retained for three years and then deleted automatically; active support and rights cases are retained only for the time needed to resolve them and meet the applicable legal obligations.

Who this data is shared with

No data is sold or shared for advertising. It is processed by the infrastructure providers that host the application, acting as data processors under a contract with them, never as independent controllers: • Vercel — application hosting, and the private store holding the encrypted backups. • Neon — database hosting. • Resend — delivering account email (password reset, email confirmation), which includes your email address. • Google — for the two AI features, and only when you use them: reading the photo you take of a receipt, and writing the analysis of a month from that month's totals. Also if you sign in with Google, where the sign-in itself happens on their side. If you turn on browser notifications, delivering them also involves your browser vendor's own push service (Google, Apple, Mozilla, or Microsoft, depending on your browser) receiving the message payload.

The two AI features deserve a note of their own. A receipt can show the payee, the amount, the date, and sometimes part of a card number; the monthly analysis sends less detail but a broader picture — what a household earns and where it spends. This app currently uses Google's free tier, and on that tier Google may use what is sent to it to improve its own models. If that is not acceptable to you, do not use them: they are the only two features that send anything outside, everything else works without them, and entering a transaction by hand sends nothing to anyone.

International transfers

The database runs in Neon's eu-west-2 region, in London. Since Brexit the United Kingdom is a third country for GDPR purposes, covered by the European Commission's adequacy decision of 28 June 2021, so that transfer needs no additional safeguard. Vercel, Resend, and Google are US companies and may process data in the United States under the safeguards GDPR requires — the EU-US Data Privacy Framework, standard contractual clauses, or both.

How this data is protected

Passwords are stored hashed with bcrypt and never in plain text. Password-reset and email-confirmation links are stored hashed too, so reading the database does not hand anyone a working link. Daily backups are encrypted with AES-256-GCM before they leave the server. All traffic runs over HTTPS, and the app sets a content security policy that stops third-party scripts from running. No system is perfect. If a breach happens that is likely to put your rights at risk, you will be told without undue delay at the email address on your account, and the supervisory authority will be notified within 72 hours, as GDPR requires.

Automated decisions and profiling

There are none. Nothing here makes an automated decision with legal or similarly significant effects about you, and no profile is built from your data. The two AI features do use a model, and neither decides anything. The receipt scanner fills in a form that you then check and confirm; the monthly analysis writes a text you read, and it is labelled on screen as written by a model and capable of being wrong. Neither moves money, changes a budget, or alters a single figure — they cannot, because all they can do is fill a field or produce text. Budget alerts and the daily reminder are a fixed rule applied to your own numbers, not a prediction about you.

Children

This service is not directed at children. You must be at least 14 years old to create an account, in line with the terms of use. No data is knowingly collected from anyone below that age; if you believe an account belongs to a child, write to the contact address below and it will be deleted.

Your rights

You can access, correct, delete, or export your data at any time from within the app (Account → Security to delete it, Settings → Data to export it), or by writing to the contact address below. You also have the right to object to processing, to request that it be restricted, and to lodge a complaint with your national data protection authority — in Spain, the AEPD, at www.aepd.es — if you believe your rights have not been respected.

Cookies

This app only sets strictly technical cookies — the kind that do not need consent, which is why no banner is shown. There is no advertising or analytics cookie. If that ever changes, this page will be updated and a banner will be added.

Changes to this policy

If this policy changes in a way that matters, the "last updated" date above will change and, where required, you will be asked to accept the new version again the next time you sign in.