Privacy Policy

1. Who is responsible

[LEGAL ENTITY NAME], [STREET, POSTCODE, CITY, COUNTRY], Chamber of Commerce number [KVK NUMBER], is the controller of the personal data described here. For anything in this policy, write to [PRIVACY EMAIL].

2. What we collect

There are three kinds of data, and that is all.

• Account data. Your email address, the name you give us, and a hashed version of your password. We store a hash, produced with argon2 — we never hold your actual password and cannot recover it. If you sign in with Google instead, we store the account identifier Google gives us.
• The figures you enter. Your monthly statements: income, expenses, assets, liabilities, cash flow allocations and any notes you write. This is financial information about you, which is why the rest of this policy exists.
• Technical data. Ordinary server logs produced by hosting the site — IP address, browser, which pages were requested and when — and a session cookie that keeps you signed in.

We do not connect to your bank. We do not import transactions. Every financial figure in the app is one you typed in yourself.

3. Why we use it, and on what basis

• To give you the service you signed up for — storing your statements, calculating your totals, showing your history. Legal basis: performance of our contract with you.
• To keep the service secure and working, and to investigate abuse. Legal basis: our legitimate interest in running a service that is not broken or under attack.
• To contact you about your account: a password reset you asked for, a change to these terms, a problem with your subscription. Legal basis: performance of our contract, and our legitimate interest in telling you things you need to know.
• To meet legal obligations, such as keeping records required for tax. Legal basis: legal obligation.

4. What we do not do

We do not sell your data. We do not share it with advertisers. We do not use your financial figures to build a profile of you, to train models, or for anything other than showing them back to you. There is no advertising or analytics tracking on this site.

5. Who else processes it

Running the service means other companies handle data on our behalf, under contract and on our instructions. These are all of them:

• Neon — Hosts the database holding your account and your statements. (processing location: EU / US, depending on the region the database runs in; their privacy policy)
• Railway — Runs the application servers and keeps operational logs. (processing location: US; their privacy policy)
• Google — Verifies your identity if, and only if, you choose to sign in with Google. (processing location: US; their privacy policy)

Where a processor operates outside the European Economic Area, transfers are covered by the European Commission’s Standard Contractual Clauses.

6. Cookies

The site sets one cookie: the session cookie that keeps you signed in. It is strictly necessary for the service to work, which is why there is no cookie banner asking for consent — there is nothing to consent to. We set no analytics, advertising or tracking cookies.

7. How long we keep it

Your account and your statements are kept for as long as your account exists. Delete your account and we delete them, along with the statements, items, allocations and notes attached to it. Server logs are kept for a short operational period and then rotated away.

Records we are legally required to retain — invoices and payment records, for example — are kept for as long as tax law requires, even after an account is deleted.

8. How it is protected

Traffic is encrypted in transit. Passwords are stored as argon2 hashes, never in readable form. Every request for your statements checks both that you are signed in and that the statement belongs to you.

No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will tell you and the supervisory authority as the law requires.

9. Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, hand it over in a portable format, restrict what we do with it, or object to processing we base on legitimate interest.

Write to [PRIVACY EMAIL] and we will answer within one month. You do not have to give a reason, and exercising these rights costs you nothing.

If you are unhappy with how we handled it, you can complain to the Autoriteit Persoonsgegevens in the Netherlands, or to the supervisory authority where you live.

10. Children

The service is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, tell us at [PRIVACY EMAIL] and we will remove it.

11. Changes

If this policy changes in a way that affects you, we will tell you by email before it takes effect. The date at the top always shows the current version.

12. Contact

[PRIVACY EMAIL], or by post to [LEGAL ENTITY NAME], [STREET, POSTCODE, CITY, COUNTRY]. Our Terms of Service explain the rest of the agreement.