Privacy policy
This page describes exactly what NETbudget does with your data. It separates two very different situations: the app without an account, where nothing leaves your phone, and the subscription, where some data is synchronised so it follows you across devices and can be shared. We would rather be precise than reassuring.
Without an account: nothing leaves your phone
Your budget, income, expenses, loans, currency, language and chosen city are stored on your device. No account is needed, and in this mode none of it is sent to a server. Notifications are scheduled by your phone itself: no notification token is created, so nothing passes through a third-party delivery service.
With an account: what gets synchronised
Creating an account is optional. It lets you find your data on several devices, share a budget, and receive advice matched to your situation. We then store on our servers: your email address (or the identifier provided by Apple or Google), your username, optionally your first and last name, your date of birth, your country, region and city, your occupation, your profile picture if you add one, the date you accepted this policy, along with your savings goals, event budgets, monthly history, and the profile used to tailor advice — age, family situation, housing, tax band, children or pets. You choose what you fill in: blank fields are not inferred.
End-to-end encryption
It is on by default, from the moment the account is created, and cannot be switched off. A key is created on your phone and never leaves it: your data goes out encrypted, we cannot read it, and we cannot hand it to anyone who asks. There is nothing for you to configure. It is turned on at your first sign-in; in the rare case where that fails for lack of network, the app tries again at the next launch, and anything synchronised in between is not yet protected. Twelve words, viewable at any time from your profile, let you recover that access on another device; we do not know them. As a result, changing phone without having kept them makes your synced data inaccessible — your budget stays intact on the original device. That is the unavoidable price of encryption we cannot bypass, and we would rather write it down than let you discover it. In a shared space, the space has its own key, and each member keeps a copy encrypted with theirs. Traffic to our servers is encrypted in transit, and your session token is kept in the operating system's secure keystore.
Shared budgets
If you create a shared space or join someone else's, the members of that space can see the budget, goals and events that live in it, along with your username and profile picture. They never see your personal space. An invitation is a single-use code valid for fourteen days; no email address is required to invite someone. Leaving a space ends your access to its contents immediately.
Network connections
Without an account, the app contacts three services and never sends an identifier: open.er-api.com for exchange rates, with a local cache, itunes.apple.com to check whether an update is available, and our own server, at most once a week, to refresh the inflation rates shown in the advice. That last request deserves a note, because it is the one that could give away where you are: it carries no parameter and receives the table for all seventeen countries covered, exactly the same for everyone. We therefore never ask a statistics institute for «the inflation rate in France», which would tell it where you live; the sorting happens on your device. With no network, the app falls back on the table bundled at build time. With an account, it talks to Supabase, which hosts the database, authentication and photo storage. If you sign in with Apple or Google, that provider is contacted at sign-in time. If you subscribe, the app asks RevenueCat what your account is entitled to open. The many links to official websites quoted in the advice are only opened if you tap them, and in your browser.
Processors
Supabase hosts account data. Apple and Google are involved if you use their sign-in method, and for selling and charging subscriptions. RevenueCat, which manages subscriptions on our behalf, receives an account identifier and the purchase information passed on by the store — never your budget data, which it could not read anyway, and never your payment details, which we do not see either. open.er-api.com supplies exchange rates. No other third party receives your data: inside the app there is no advertising, no analytics, no tracker, no resale. The netbudget.app website is hosted by Vercel, which measures its traffic in aggregate — page views, country, device type — without cookies or persistent identifiers, and with no link to any app account. You can refuse this measurement from the notice shown on your first visit, or at any time from the footer; your browser's Global Privacy Control signal is honoured. We do not sell data, and it is not our business model — the app is funded by subscriptions.
Permissions requested
Notifications, for the reminders you choose to switch on, which you can disable category by category. Access to images, only at the moment you add a profile picture; we never browse your gallery. Vibration. Camera, microphone and location are explicitly blocked: the app cannot reach them, not even by mistake.
How long data is kept
Local data stays on your device until you erase it or uninstall the app. Account data is kept for as long as the account exists. Deleting your account erases it immediately and permanently, with no retention period on our side. Budget history is limited to the last twenty-four months.
Your rights
The General Data Protection Regulation gives you the right to access your data, correct it, erase it, object to its processing and obtain a copy. Deletion is available directly in the app's settings, under « Delete my account »: it is immediate and irreversible. For anything else, write to us and we will reply within thirty days. You may also complain to your national data protection authority if our answer does not satisfy you.
Minors
The app can be used without an account at any age. Creating an account is restricted to people aged fifteen or over, the age of digital consent in France. We do not seek to collect data about children; if an account was created for a younger minor, write to us and we will delete it.
Testing programme
A closed testing session precedes general sale. Participants are invited by name, approve a testing agreement from within the app, and in doing so send us the name they enter, the date of their agreement and the plan assigned to them. These records exist only to prove that consent was given and to open the right testing scope. They are deleted at the end of the session, together with the test access itself, and serve no commercial purpose. Declining the agreement removes tester status, with no further consequence.
Changes and contact
Any change to this policy will be published here with its date. A change that would broaden how your data is used will be flagged in the app before it takes effect. Any questions: contact@netbudget.app.
Last updated : 2026-09-09