Privacy
Last updated: replace this with the date you publish.
Who runs this service
This service is operated by [your name or company], contactable at [your support email]. References to “we” mean that operator.
What we store
Only what you enter or what is needed to run your account:
- Your email address, a password stored as a bcrypt hash, and optionally your display name and preferred currency.
- The financial records you create: accounts and balances, transactions, budgets, goals, debts, recurring items, invoices and mileage entries.
- Your plan, and if you have bought a subscription, the Gumroad license key and purchase email associated with it.
- Basic server logs generated by the hosting platform, which may include IP addresses for a limited period.
We do not connect to your bank, we do not ask for bank credentials, and we do not use third-party analytics or advertising trackers in this application.
What we do with it
Your records are used to display your own dashboards, budgets and reports. We do not sell personal data, and we do not share it with anyone except the processors listed below, where required by law, or where necessary to protect the service.
Processors we rely on
- [Your hosting provider] — runs the server and stores the database.
- Gumroad — handles payments and subscriptions. Card details go to Gumroad and never reach this application. See Gumroad's own privacy policy for how they handle them.
How long we keep it
Your data is kept while your account exists. Deleting your account from Settings removes your records from the live database immediately; residual copies may persist in encrypted backups for up to [your backup retention period] before being overwritten.
Your choices
- Export — download your transactions as CSV at any time, or your full records as JSON on the Pro and Business plans.
- Correct — every record in the app is editable by you directly.
- Delete — clear all financial data, or delete your whole account, from Settings.
- Ask — email [your support email] for a copy of what we hold or to raise a concern. Depending on where you live you may also have the right to complain to a data protection authority.
Security
Passwords are hashed with bcrypt and never stored in readable form. Sessions use signed tokens. The application sends a strict content security policy and loads no third-party scripts. No system is perfectly secure, so please use a strong, unique password.
Children
This service is not intended for anyone under 16, and we do not knowingly collect their data.
Changes
If this policy changes materially we will update the date above and, where the change is significant, notify account holders by email.