Privacy Policy

Short version: Budgy keeps your money data on your phone. We only handle data if you choose to create an account - and then it is your email address plus, if you share with a household, encrypted data that we cannot read.

Who is responsible

The controller under the GDPR is the individual developer named on Budgy's App Store listing (the App Store shows the developer's name and address there), based in Austria (email: budgy.support@gmail.com). This policy applies to the Budgy app and to the Budgy website.

What stays on your phone

Everything you enter or import - wallets and balances, transactions, photos of receipts you attach, bills, goals, budgets, categories, debts and trips, meter readings, what you own as investments and what you type in that it is worth, your answers to the investing checklist, settings - is stored on your device, in the app's own local database. Bank and broker statements you import (CSV, OFX, QIF, camt, PDF) are read on your device; the files are never uploaded.

We cannot see this data and do not receive it. That is deliberate: data we never have cannot be lost, leaked or misused by us.

A small summary (the number safe to spend and your next bill) is also kept in a storage area shared with Budgy's Home Screen and Lock Screen widgets, so they can show it. It stays on your phone. The widgets show nothing when you have hidden amounts or switched on the app lock, and on a locked phone iOS hides their numbers until you unlock it.

If you use iCloud Backup, or back up your iPhone to a computer, Apple may include Budgy's data in that backup. That is between you and Apple: Budgy itself never uploads your data.

Using Budgy as a guest

You can use every part of Budgy without an account. As a guest no personal data is sent to us and the app does not connect to our servers. Visiting the Budgy website is separate: like any website, its hosting server receives your IP address, the time and your browser type to deliver the pages (see "Who processes data for us").

Features of your iPhone

• App lock uses Face ID, Touch ID or your passcode through the system. Budgy only learns whether it worked, never your face, fingerprint or passcode.
• The camera and photo library are used only when you choose to attach a photo of a receipt to an entry. The photo is stored in Budgy's own storage on your phone.
• Reminders are notifications that your phone schedules by itself. Budgy has no notification server and sends nothing to one.
• Siri and Shortcuts: when you ask Siri how much is safe to spend, or to add an expense, Apple handles the request under its own terms. Siri asks you to unlock your phone first, so nobody else can hear your numbers. Budgy answers from the small summary on your phone and opens the add screen on your phone.
• Files: when you import a statement you pick the file yourself in the system file picker. It is read on your phone and never uploaded.

If you create an account

An account is optional and exists only to share with a household. We process:

• your email address (Apple may give us a private relay address instead) and an account ID, if you sign in with Apple or Google. We ask the provider for your email address only; the provider you choose handles your login under its own privacy policy and learns nothing about your Budgy data,
• a random account ID and the times of account creation and sign-in,
• the date and version of the Terms you accepted, and the date you confirmed that you are 16 or older (kept with your account as evidence of the agreement),
• technical sign-in records (IP address, browser type) kept by our authentication provider for security and abuse prevention.

Backups

Budgy does not store your backups. Backup files and the earlier copies on your phone stay where you put them: on your phone, or in a place you choose, such as iCloud Drive or Files. Budgy never uploads them. Because we hold no copy, we cannot recover your data if you lose your phone and have no backup file.

Sharing with a household (optional)

If you are signed in you can start or join a household: you and up to five other people, such as a partner, a flatmate or family. Nothing is shared until you do, and even inside a household nothing is shared by default: your accounts and expenses stay on your phone. You choose what the others see, in two ways. You can make an account a "joint account" (its balance, and this and last month's transactions with their category, merchant and note). Or you can switch on "Share with household" for a single expense (that expense with its category, merchant and note; the account it was paid from and its balance stay private). The people in the household see only what you shared, read-only. Bills you mark as shared can be seen and changed by everyone in the household, and Home can show what the household can spend together and who paid which shared bill. The other members also see the name you gave yourself in Budgy. Nobody can change another person's balances or transactions.

Everything you share is encrypted on your phone before it is uploaded. The key is made on your phone and given to the others inside the invitation link, in the part after the # sign that browsers never send to any server. We and our providers therefore store only encrypted data that we cannot read: not the amounts, not the account or bill names, not the household's name. What we can see is that a household exists, the account IDs of its members and when they joined, how many encrypted items there are, how large they are and when they last changed, and a short prefix in each item's ID saying which member it belongs to (or that it is a shared bill).

An invitation link works once and runs out after two days. We store only a hash of its code, never the code. Whoever has the link can join, so send it only to the person you mean. What a member has already seen on their own phone cannot be taken back, so share only with people you trust.

Why we may process this data (legal bases)

• Sharing with a household, which only happens when you start or join one: performing the contract you enter into by using that feature (Art. 6(1)(b) GDPR).
• Account and sign-in: performing the contract you enter into by creating an account (Art. 6(1)(b) GDPR).
• Security, abuse prevention and keeping the service running (rate limits, sign-in records, server logs): our legitimate interest (Art. 6(1)(f) GDPR).
• Keeping proof of the terms you accepted and of your age confirmation, so we can show them if there is a dispute: our legitimate interest (Art. 6(1)(f) GDPR).
• Replying to your support emails and feedback: our legitimate interest in answering you, or performing the contract if you are our user (Art. 6(1)(f) and (b) GDPR).
• We do not rely on consent because we do not do anything that needs it: no analytics, advertising or profiling.

Who processes data for us

We use these service providers to run Budgy. Where one of them processes personal data on our behalf, it does so under its own standard terms; for Supabase these include a data processing agreement with standard contractual clauses:

• Supabase (authentication, and storage of the encrypted data of any household you join, as described under "Sharing with a household"), project region: Ireland (European Union).
• Vercel Inc. (serving the Budgy website and these legal pages; server logs include IP address and request time). Vercel may process data in the United States; it is certified under the EU-US Data Privacy Framework.
• Apple and Google act as independent providers of the sign-in you choose, not as our processors: we receive the result of your login, they learn only that you used Budgy.
• Payments for Budgy Pro, a subscription, are handled entirely by the Apple App Store. We do not receive your payment details, and Budgy keeps no purchase records on a server: your phone asks the store whether your subscription is active. If Family Sharing is on for the subscription, Apple shares it with your family group. The Apple App Store handles that data as an independent controller under its own privacy policy.
• We do not sell data, share it for advertising, or use any analytics, tracking or advertising service. The app and the website load no third-party scripts, fonts or images.

Feedback and support emails

If you write to us - from More > Me > Feedback & rating, or directly - we receive your message, your email address and, if you left them on, the few technical lines shown before sending (app version, phone type, language, currency; never any of your money data). We use them only to reply and to improve Budgy, and keep them as long as needed for that. Our support mailbox is a Gmail account, so Google processes these emails for us under its own terms; do not send anything you would not want in an email. The Feedback screen opens your own email app: Budgy itself sends nothing in the background, and we receive only what you choose to send.

Cookies and storage on your device

Budgy sets no cookies, in the app or on the website. The app stores on your phone only what you asked for and what it needs to work: your data, your settings (such as the theme), and your sign-in session if you have an account (kept in the iPhone's Keychain). Because this is strictly necessary for the service you requested, no consent banner is required (§ 165(3) Telecommunications Act 2021).

How long we keep data

• Guest: we keep nothing.
• Account: until you delete it. Deleting your account (More > Me > Backup & privacy > Account > Delete account) removes your account and everything you shared with a household at once.
• Households: until the last member leaves or the person who started it deletes it; then everything stored for it is deleted. When you leave, are removed, or delete your account, what you shared is withdrawn: it disappears from the others' phones the next time they connect, and its stored content is erased. Shared bills stay with the household.
• Invitations hold only a hash of their code. They run out after two days and are deleted when the household closes or the person who made them leaves it.
• Your phone keeps a copy of what the others share so Budgy works offline. It is removed when you leave a household, delete your account or erase the phone.
• Server logs at our providers are kept for a short period set by them and are not used to profile you.
• After deletion, remnants may persist for a limited time in our providers' routine infrastructure backups until those are overwritten.

Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection (Art. 15-21 GDPR). Most of this you can do yourself: More > Me > Backup & privacy exports your data as a file and a spreadsheet, and More > Me > Backup & privacy > Account deletes your account. For anything else write to us at the address above; we reply within one month.

You also have the right to complain to a supervisory authority. In Austria that is the Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at; you may also contact the authority in your own country.

Children

As a guest, at any age, Budgy sends us nothing: there is nothing for us to process. Accounts are for people aged 16 and over; we do not knowingly create accounts for younger people, and if we learn that we have, we delete the account. Budgy is not designed for children under 13.

Security

• All traffic uses HTTPS.
• Each account can only read the households it belongs to (row-level security).
• Shared household data is encrypted on the phones (AES-256-GCM) and each item is bound to its household and its ID, so it cannot be swapped for another. Only members can read a household, and the server only lets a member change their own items and the shared bills.
• Your sign-in session and your household keys are kept in the iPhone's Keychain, on that phone only.
• The app connects only to its sign-in and sharing service and to the Apple App Store. It contains no analytics or advertising code.
• Files you import (statements, backups) are read on your phone with size and shape limits, so a damaged or hostile file is refused instead of slowing or crashing the app. Exported spreadsheets neutralise cells that a spreadsheet program could run as formulas.
• When you copy a household invitation link, it stays on your own device's clipboard (not shared with your other devices) and is removed after five minutes.

No automated decisions

Budgy's insights and tips are simple calculations made on your phone to help you plan. They are not decisions about you with legal or similarly significant effect, and they are not financial advice.

Changes

This is version 2026-11-06.1. If we change it in a way that matters, we will tell you in the app before it applies.