Privacy Policy

Short version: Budgy keeps your money data on your phone. We only handle data if you choose to create an account - and then it is your email address plus, if you share with a household, encrypted data that we cannot read.

Who is responsible

The controller under the GDPR is Daniele Punturo, Kreuzgasse 81, 1180 Vienna, Austria (email: budgy.support@gmail.com). This policy applies to the Budgy app and to the Budgy website.

What stays on your phone

Everything you enter or import - wallets and balances, transactions, bills, goals, budgets, categories, meter readings, what you own as investments and what you type in that it is worth, your answers to the investing checklist, settings - is stored on your device, in the app's own local database (IndexedDB). Bank and broker statements you import (CSV, OFX, QIF, camt, PDF) are read on your device; the files are never uploaded.

We cannot see this data and do not receive it. That is deliberate: data we never have cannot be lost, leaked or misused by us.

Using Budgy as a guest

You can use every part of Budgy without an account. As a guest no personal data is sent to us. The only thing that happens is what happens whenever you open a website: the hosting server receives your IP address, the time and your browser type to deliver the files (see "Who processes data for us").

If you create an account

An account is optional and exists only to share with a household. We process:

• your email address (Apple may give us a private relay address instead) and an account ID, if you sign in with Apple or Google. We ask the provider for your email address only; the provider you choose handles your login under its own privacy policy and learns nothing about your Budgy data,
• a random account ID and the times of account creation and sign-in,
• the date and version of the Terms you accepted, and the date you confirmed that you are 16 or older (kept with your account as evidence of the agreement),
• technical sign-in records (IP address, browser type) kept by our authentication provider for security and abuse prevention.

Backups

Budgy does not store your backups. Backup files and the earlier copies on your phone stay where you put them: on your phone, or in a place you choose, such as iCloud Drive or Files. Budgy never uploads them. Because we hold no copy, we cannot recover your data if you lose your phone and have no backup file.

Sharing with a household (optional)

If you are signed in you can start or join a household: you and up to five other people, such as a partner, a flatmate or family. Nothing is shared until you do, and even inside a household nothing is shared by default: your accounts and expenses stay on your phone. You choose what the others see, in two ways. You can make an account a "joint account" (its balance, and this and last month's transactions with their category, merchant and note). Or you can switch on "Share with household" for a single expense (that expense with its category, merchant and note; the account it was paid from and its balance stay private). The people in the household see only what you shared, read-only. Bills you mark as shared can be seen and changed by everyone in the household, and Home can show what the household can spend together and who paid which shared bill. The other members also see the name you gave yourself in Budgy. Nobody can change another person's balances or transactions.

Everything you share is encrypted on your phone before it is uploaded. The key is made on your phone and given to the others inside the invitation link, in the part after the # sign that browsers never send to any server. We and our providers therefore store only encrypted data that we cannot read: not the amounts, not the account or bill names, not the household's name. What we can see is that a household exists, the account IDs of its members and when they joined, how many encrypted items there are, how large they are and when they last changed, and a short prefix in each item's ID saying which member it belongs to (or that it is a shared bill).

An invitation link works once and runs out after two days. We store only a hash of its code, never the code. Whoever has the link can join, so send it only to the person you mean. What a member has already seen on their own phone cannot be taken back, so share only with people you trust.

Why we may process this data (legal bases)

• Sharing with a household, which only happens when you start or join one: performing the contract you enter into by using that feature (Art. 6(1)(b) GDPR).
• Account and sign-in: performing the contract you enter into by creating an account (Art. 6(1)(b) GDPR).
• Security, abuse prevention and keeping the service running (rate limits, sign-in records, server logs): our legitimate interest (Art. 6(1)(f) GDPR).
• We do not rely on consent because we do not do anything that needs it: no analytics, advertising or profiling.

Who processes data for us

We use these service providers as processors and have, or will have before launch, data processing agreements with each:

• Supabase (authentication, and storage of the encrypted data of any household you join, as described under "Sharing with a household"), project region: Ireland (European Union).
• Vercel Inc. (serving the app's files; server logs include IP address and request time). Vercel may process data in the United States under the EU-US Data Privacy Framework and standard contractual clauses.
• Apple and Google act as independent providers of the sign-in you choose, not as our processors: we receive the result of your login, they learn only that you used Budgy.
• Payments for Budgy Pro are handled entirely by the Apple App Store or Google Play. We do not receive your payment details, and Budgy keeps no purchase records on a server: your phone checks the purchase with the store.
• We do not sell data, share it for advertising, or use any analytics, tracking or advertising service. The app loads no third-party scripts, fonts or images.

Feedback and support emails

If you write to us - from More > Me > Feedback & rating, or directly - we receive your message, your email address and, if you left them on, the few technical lines shown before sending (app version, phone type, language, currency; never any of your money data). We use them only to reply and to improve Budgy, and keep them as long as needed for that. The Feedback screen opens your own email app: Budgy itself sends nothing in the background, and we receive only what you choose to send.

Cookies and local storage

Budgy sets no cookies. It uses your browser's storage only for things you asked for and the app needs to work: your data, your settings (such as the theme), your sign-in session if you have an account, and an offline copy of the app itself. Because this is strictly necessary for the service you requested, no consent banner is required (§ 165(3) Telecommunications Act 2021).

How long we keep data

• Guest: we keep nothing.
• Account: until you delete it. Deleting your account (More > Me > Account > Delete account) removes your account and everything you shared with a household at once.
• Households: until the last member leaves or the person who started it deletes it; then everything stored for it is deleted. When you leave, are removed, or delete your account, what you shared is withdrawn: it disappears from the others' phones the next time they connect, and its stored content is erased. Shared bills stay with the household.
• Invitations hold only a hash of their code. They run out after two days and are deleted when the household closes or the person who made them leaves it.
• Your phone keeps a copy of what the others share so Budgy works offline. It is removed when you leave a household, delete your account or erase the phone.
• Server logs at our providers are kept for a short period set by them and are not used to profile you.
• After deletion, remnants may persist for a limited time in our providers' routine infrastructure backups until those are overwritten.

Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection (Art. 15-21 GDPR). Most of this you can do yourself: More > Me > Backup & privacy exports your data as a file and a spreadsheet, and More > Me > Account deletes your account. For anything else write to us at the address above; we reply within one month.

You also have the right to complain to a supervisory authority. In Austria that is the Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at; you may also contact the authority in your own country.

Children

As a guest, at any age, Budgy sends us nothing: there is nothing for us to process. Accounts are for people aged 16 and over; we do not knowingly create accounts for younger people, and if we learn that we have, we delete the account. Budgy is not designed for children under 13.

Security

• All traffic uses HTTPS.
• Each account can only read the households it belongs to (row-level security).
• Shared household data is encrypted on the phones (AES-256-GCM) and each item is bound to its household and its ID, so it cannot be swapped for another. Only members can read a household, and the server only lets a member change their own items and the shared bills.
• A strict content security policy lets the app talk only to its own server and to the sign-in and sharing service.

No automated decisions

Budgy's insights and tips are simple calculations made on your phone to help you plan. They are not decisions about you with legal or similarly significant effect, and they are not financial advice.

Changes

This is version 2026-10-08.3. If we change it in a way that matters, we will tell you in the app before it applies.