Budget · Privacy

Budget

A private ledger you keep by hand — no bank login.

DRAFT — Law Specialist + DSS facts 2026-11-04. E2EE/Health/Supabase region filled; remaining TODOs (controller identity, age gate, deletion timeline, SDK inventory, signed DPA) still block App Store / Play submission.

Budget Privacy Policy

Effective date: TODO (set at launch; no earlier than public availability, planned after July 2028)

Claims marked TODO must be verified against the real design and SDK inventory before publishing. Prefer underclaiming over overclaiming.

Who we are

Life Tracker operates Budget.
Contact: support@example.invalid (replace placeholder before any store review)
Controller / operator: TODO (legal or trading name; mailing address if required in a market)

What we collect

  • Account data: email address and authentication identifiers. (TODO: verify exact auth fields — e.g. user id, session tokens)
  • App content you create: personal Budget enc rows are end-to-end encrypted; Budget shared groups, Habit Health sync, and current Habit/Recipe content are not E2EE (see encryption section). (TODO: refine Habit/Recipe field lists when schemas freeze.)
  • Technical / sync metadata: limited data needed to run sync and secure the service (e.g. timestamps, record IDs, approximate sizes, device/app version). (TODO: exact list — treat as visible to the server)
  • Device permissions you grant: may include camera, photo library, notifications, and (if you opt in) Apple Health or Health Connect. (TODO: per-app permission matrix)
  • Purchase / subscription status: if you buy a subscription, Apple or Google process payment; we receive entitlement / subscription status, not your full card number. (TODO: verify fields)
  • Support emails: if you email us, we process the content of that correspondence.
  • Advertising SDKs: none — no advertising or ad-measurement SDKs were found in Budget (DSS, 2026-11-04). (Re-check before each release.)
  • Analytics / crash reporting: Budget does not include analytics or crash-reporting SDKs.

How we use data

We use the data above to: provide and sync Budget; authenticate you; maintain security; provide support; and honor subscriptions. We do not sell your personal information. We do not use Apple Health / Health Connect data for advertising or marketing. (TODO: verify)

End-to-end encryption: scope

Live coverage (as of 2026-11-04, DSS): Only personal Budget rows on the encrypted (enc) path are end-to-end encrypted. Not E2EE today: account email/auth ids; sync metadata; Budget shared/group rows (plaintext by design); Habit Health / Health Connect sync (plaintext); Habit and Recipe content until an encrypted path ships for those apps.

For Budget personal enc rows — the server can see: account email, authentication identifiers, ciphertext blobs, record counts/sizes, timestamps, device/app metadata needed for sync, subscription entitlements, and wrapped recovery material (not unwrapped by staff).

For those same rows — the server cannot see: the plaintext contents of the end-to-end encrypted entries.

Key recovery (Budget E2EE): a 256-bit master key is created on your device; the server holds only wrapped copies, and staff do not unwrap them. You unlock with your passphrase (Argon2id) or your 12 recovery words. There is no server, email, or support recovery. Losing passphrase and the 12-word recovery phrase = unrecoverable encrypted content. Login/password reset ≠ encryption-key recovery. Recovery attempts rate-limited (live: 5/hour and 15/day).

Other limits: Metadata can show patterns (timing, volume). Unlocked-device access is outside E2EE.

On-device processing

Some features process data on your device (for example OCR or QR scanning). (Product facts as of 2026-11-04, pending Law Specialist wording: Budget has no bank linking; camera, receipt OCR and Taiwan e-invoice QR are TBD, not built. Recipe: manual typing/paste; on-device OCR of an image chosen from the photo library (and camera, if offered; TODO confirm), image not uploaded to our server; optional source link and author saved as plain-text attribution, never fetched or scraped; no automatic URL import; no third-party tokens stored.) On-device processing does not by itself upload that media unless a sync or backup path does — (TODO: verify).

Service providers (processors)

We use companies that process data on our instructions:

We require processors to use data only to provide their service to us.

International transfers

Your data may be processed in us-east-1 (United States) and other countries where our processors operate. (TODO before launch: describe safeguards for TW / JP / KR / EEA / UK users, e.g. SCCs or provider terms.)

Apple Health and Health Connect (opt-in)

Budget does not read from or write to Apple Health or Health Connect.

Sharing

We share personal information only with: processors above; when required by law or valid legal process; or in connection with a merger or transfer of the app, with notice where required. We do not sell personal information. We do not share personal information for cross-context behavioral advertising. (TODO: verify against final SDK and contracts.)

Retention and deletion

  • We keep account and synced data while your account is active. Backups: TODO retention period.
  • One account for all Life Tracker apps: deleting your account deletes it for every Life Tracker app, not only Budget.
  • Delete account in the app: not available in Budget yet (TBD). Until then, email support@example.invalid.
  • Timeline: TODO. Backup purge window: TBD.
  • Export: see Budget support.

Children's privacy

Budget is not directed at children under TODO (align with store age rating and in-app gate; do not use “13” alone if the product gate is 15+ or 16+). We do not knowingly collect personal information from children under that age. If you believe we have, contact support@example.invalid and we will delete it.
Regional notes for counsel/product before launch: US COPPA (under 13), Korea PIPA (under 14), Japan APPI (under 16), Taiwan capacity rules (under 18). Family / parental-consent features are not in v1 unless separately built and disclosed.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, and to object or restrict certain processing. Contact support@example.invalid. We will respond within TODO (or the period required by local law). You may also contact your local data-protection authority.

California: We do not sell or share personal information as those terms are defined under the CCPA/CPRA. (TODO: re-verify.) To make a request, email support@example.invalid.

Security

We use end-to-end encryption for personal Budget entries, encryption in transit to our servers, and account authentication. No method of transmission or storage is 100% secure.

Changes

We will update the effective date when this policy changes and notify you of material changes (TODO: how — in-app notice, email).

Contact

Life Tracker — support@example.invalid