Legal
Privacy Policy
This policy explains what personal data Needt Budget processes, why, and what your rights are.
1. Who is responsible
The controller is Maksym A., Kravchyka 4, Lutsk 43000, Ukraine. Contact: [email protected].
2. What we collect
- Account: username, email address, a password hash (never the password itself), language, currency, time zone and display preferences.
- Financial records you enter or import: transactions, wallets, categories, goals, limits, reserves, expected and recurring payments, investments and your notes.
- Bank import: statement rows from your own PostFinance helper, which runs on your Mac. You sign in to PostFinance yourself; we never receive your bank credentials.
- Notifications: if you turn on push notifications, the subscription your browser gives us (an endpoint address and keys).
- Connected AI apps: the connector (MCP) tokens you create, stored as hashes, and an audit log of what each connected app read or changed.
- Billing status: your access type and the Creem customer, order, checkout and subscription IDs, the date you paid and, for the yearly plan, the end of the paid year. No card data.
- Technical logs: IP address and request lines in server logs, kept for a short period for security and troubleshooting.
3. Why, and on what basis
- To provide the service you signed up for — performance of our contract with you.
- To keep the service secure and fix errors (logs, audit log) — our legitimate interest.
- To keep billing records — our legal obligation.
We do not sell your data, show ads or use tracking.
4. Who receives data
- Oracle Cloud Infrastructure hosts the server and database: Oracle Cloud Infrastructure, region eu-zurich-1 (Zurich, Switzerland).
- Cloudflare carries the traffic between your browser and our server (it sees IP addresses and requests in transit).
- Creem processes payments as Merchant of Record; what you enter at checkout goes to Creem under its own privacy policy, and Creem tells us that a payment succeeded.
- Google Fonts: the public website, these pages and some app screens load fonts from Google, which sees the visitor’s IP address.
- Apple, Google or Mozilla web-push services deliver notifications, if you turn them on.
- Receipt scanning: if you use it, the image you choose is sent to the AI service configured on our server (Google Gemini or xAI) to read it.
- Claude or another AI app you connect: if you connect one through the connector, the data it asks for is sent to that app’s provider (for Claude: Anthropic) by your own choice and under that provider’s terms.
Exchange rates, stock quotes and merchant locations are looked up by our server; those requests contain no account data.
5. Cookies and browser storage
We use no tracking or advertising cookies. We set a login session cookie (access_token, valid for 7 days) and, right after a change, a cookie that lives one minute so the page can offer Undo (last_action). Forms are protected by CSRF tokens. Display settings such as the theme and the app lock are kept in your browser’s local storage; the lock passcode stays on your device, as a hash.
6. How long we keep data
We keep your data while your account exists. Delete your account any time in Settings → Delete account; it is removed immediately. You can also ask at [email protected]. Safety copies of the database made before updates stay on our server until they are replaced; on request we also remove your data from them. Payment records are kept by Creem, the Merchant of Record, as long as tax and accounting law requires.
7. International transfers
Needt Budget is operated from Ukraine; our server is in Switzerland. Creem, Cloudflare, Google and the push services may process data in other countries under their own safeguards (such as adequacy decisions or standard contractual clauses).
8. Your rights
Under the data protection law that applies to you — the GDPR in the EU, the Swiss Federal Act on Data Protection (FADP) in Switzerland, and the Law of Ukraine “On Personal Data Protection” — you can ask for access to your data, correction, deletion and a copy in a portable format, and you can object to processing. Most of this you can do yourself: edit your details in Settings, export everything under Settings → Export and delete your account under Settings → Delete account. For anything else write to [email protected]; we answer within 3 business days. You can also complain to the Ukrainian Parliament Commissioner for Human Rights, to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or to a data protection authority in the EU.
9. Changes
We will announce material changes to this policy by email or in the app at least 30 days before they take effect.
Back to Needt Budget