Your privacy is
our priority.

Wallet names, transaction details, categories, labels, and any financial data you enter. By default this is stored only in your device's private local storage. If you turn on Online Mode — which is optional and off unless you enable it — an end-to-end encrypted copy is also stored on our servers so it can sync between your devices. See Section 05 for exactly what that means.

If you choose to sign in with Google to enable Google Drive backup, we access your Google account ID and display name solely for that purpose and to identify your subscription with RevenueCat.

Anonymous crash reports and performance data may be collected by third-party SDKs (RevenueCat, Google AdMob) to help us improve app stability. This data is never personally identifiable.

Your name, email address, an optional subject, and your message. We use these solely to read your inquiry and reply by email.

Along with your message we automatically collect technical metadata from your browser to help us reproduce bug reports, diagnose issues, and prevent abuse:

• Browser user agent, Client Hints (brands, platform, architecture, model, bitness), vendor/product strings, and webdriver flag
• Language, languages list, locale, Intl locale details, timezone name/offset, and formatted date/time sample
• Screen size, available size, color/pixel depth, orientation, device pixel ratio, viewport and visual-viewport metrics
• Hardware concurrency (CPU cores), device memory, max touch points, battery status (where available)
• Network connection type/effective type, downlink, RTT, save-data flag; WebRTC-discovered local/LAN IPs when the browser exposes them
• Canvas, audio, and WebGL fingerprints (GPU vendor/renderer and related capability params)
• Storage estimate (quota/usage), media-device counts (camera/mic/speaker), permission states, plugins and MIME types
• Speech synthesis voice list (sample), cookie/online/DNT/GPC flags, PDF viewer enabled, history length
• CSS media-query preferences (color scheme, reduced motion, pointer/hover, contrast, display mode)
• Page URL, pathname, search, hash, origin, referrer, document title/character set/visibility, and a session id for the tab
• Performance timing and JS heap memory (where exposed)
• API availability flags (USB, Bluetooth, HID, serial, XR, share, credentials, service worker) — presence only, not device contents

Browsers do not expose your OS username or laptop hostname to websites. We cannot collect those fields.

When the form reaches our server, we additionally log the following technical request data:

• Your IP address (from x-forwarded-for, x-real-ip, cf-connecting-ip, or true-client-ip)
• Forwarded proto/host/port, Host, Via, CDN-Loop, and request IDs when present
• Request headers: User-Agent, Accept*, Referer, Origin, DNT, Sec-GPC, Cache-Control, Priority
• Client Hints headers (sec-ch-ua*, viewport, DPR, device-memory, prefers-color-scheme) when the browser sends them
• Fetch metadata (sec-fetch-site/mode/dest/user)
• Cloudflare / edge metadata when available: country, city, continent, region, postal code, latitude/longitude, timezone, ASN, bot score, JA3/JA4, CF-Ray, and related CF headers

This metadata is used strictly to:

• Reply to your message at the email address you provided
• Reproduce and debug bug reports (browser, device, locale, network conditions)
• Detect and prevent spam, abuse, and automated submissions
• Maintain a basic audit trail of legitimate support requests

Submissions are forwarded to our private email inbox via our mailer service and retained only as long as needed to handle your request and keep a record of legitimate correspondence. We never sell, rent, or share contact-form data with any third party for marketing.

Your data lives in your device's private app storage. It is not accessible to other apps and is permanently removed when you uninstall Budgetify: Money Manager.

No account is required to use Budgetify, and with Online Mode off your data never leaves your device unless you explicitly create a backup. If you enable Online Mode, we do store an encrypted copy on our servers — see Section 05.

Your data is encrypted on your own device before it is sent, using a key derived from your password. We store that key only in a form that your password (or your recovery key) can unlock. Amounts, wallet and transaction names, balances, notes, and currencies are unreadable to us — not as a policy promise, but because we do not hold the means to decrypt them.

Being honest about the limits of the above: to keep your data consistent and enforce plan limits, our servers do store some structural information in readable form — how many transactions and wallets exist, the dates they are dated, which wallet and category each belongs to (by random ID, not by name), and status flags. We can see that a transaction exists on a date; we cannot see what it was for or how much it was.

Your data cannot be recovered — by you or by us. This is a direct consequence of the encryption design, not an operational limitation. Please store your recovery key somewhere safe.

Deleting your account from the app or the web dashboard permanently removes your encrypted data from our servers. Deleted individual records are retained briefly as empty markers so your other devices learn about the deletion, and carry no content. An account created but never email-confirmed is deleted automatically after 7 days.

Encrypted account data is stored on servers operated by Render and on a virtual private server, with the website served through Cloudflare. Transactional email (verification codes, security notices) is sent via Resend.

Every backup file — whether saved locally or to Google Drive — is encrypted using AES-256. No third party, including us, can read the contents of your backup without the app.

Save an encrypted backup directly to your device storage at any time. Available to all users, including the free tier.

Encrypted backups are uploaded to the hidden app folderof your personal Google Drive — invisible to other apps and only accessible by Budgetify: Money Manager. Google's privacy policy governs this storage.

Pro subscribers can schedule automatic backups at custom intervals and configure how many backup versions to retain. Your backup history is viewable and any version can be restored at any time.

Used optionally for authentication when enabling Google Drive backup. We request only the minimum permissions needed: your account ID, display name, and Drive app folder access.

Used exclusively to read and write your encrypted backup file to the hidden app-specific folder. We never access any other files in your Drive.

Used to display advertisements on the free tier. AdMob may collect device identifiers and usage data to serve personalised ads. See Section 07 for more details.

All payment transactions are handled entirely by Google Play. We never receive or store your payment card information.

We use RevenueCat to track subscription status and entitlements. RevenueCat may store your Google account ID as a subscriber identifier. Their privacy policy is available at revenuecat.com/privacy.