Privacy Policy

Controller and Contact

Data We Process

• Account identity data, including email, name, and profile image.
• Financial app data you enter, including accounts, assets, transactions, budgets, categories, subscriptions, debts, debt repayments, recurring transactions, and notification preferences.
• Billing state handled through Stripe, such as subscription status, customer identifier, invoice access, and limited payment method display data.
• Technical data needed to run the service, including sessions, device/browser information, security logs, and app diagnostics.
• Aggregated public-page analytics through Vercel Analytics, with authenticated routes excluded from those pageviews and query strings or hash fragments stripped before events are sent.
• When enabled, limited signed-in product events tied to an internal user reference. These events have no financial values or content.

Purposes and Legal Bases

• Provide the app, authenticate users, sync account data, and save preferences because this is necessary to perform the service.
• Process subscriptions and billing because this is necessary for paid plans and related contract administration.
• Maintain security, prevent abuse, troubleshoot errors, and improve reliability based on legitimate interests.
• Send requested service messages and enabled reminders because they are part of the service or based on your preferences.
• Measure public website traffic and improve marketing pages using cookie-free aggregated analytics based on legitimate interests.
• When enabled, measure onboarding and use of core app features with limited product events. Our proposed basis is legitimate interests in improving the service, subject to legal review before activation.

Processors and Recipients

We use service providers to operate the app. They process data only for the purposes described here and under their own security and data protection terms.

• Clerk: Authentication, account management, and user sessions
• Convex: Application database, real-time sync, and backend functions
• Stripe: Checkout, subscriptions, billing portal, invoices, and payments
• Resend: Delivery of opt-in Premium reminder emails
• Vercel Analytics: Cookie-free aggregated web analytics for public pages with sensitive URL data stripped
• Vercel Inc.: Hosting, delivery, logs, and operational security

Retention, Export, and Deletion

We keep account and finance data while your account is active or as needed to provide the service, meet legal obligations, resolve disputes, and maintain security. You can export your account data from Settings. If you delete your account from Settings, we first cancel any active paid subscription in Stripe. If cancellation fails, deletion stops. We then delete your authentication account and associated app data. Stripe may retain billing records where required by law.

Your Privacy Rights

Depending on your location, you may have rights to access, correct, delete, export, restrict, or object to processing of your personal data and to withdraw consent where processing is based on consent. You may also have the right to complain to your local data protection authority.

Transfers and Security

Our providers may process data in countries outside your own. Where required, transfers should be protected by appropriate safeguards such as standard contractual clauses, adequacy decisions, or provider data processing terms. We use HTTPS in production, authenticated sessions, access controls, provider security controls, and data minimization practices to protect personal data.

Product Analytics

Signed-in product analytics are off while we complete legal review. If enabled, Rinalance will record limited events to understand whether people can start using the app and keep using its core features. Examples include completing onboarding, creating a first record, starting checkout, and requesting an export.

These events contain an internal user reference and event time, but no financial values, currencies, record descriptions, names, debt details, or AI content. We will delete or aggregate individual events after 12 months. Public-page Vercel Analytics remains separate.

Cookies and Analytics

Essential storage is used for authentication, security, preferences, and app functionality. Public-page analytics use Vercel Web Analytics without third-party analytics cookies. See the Cookies and Storage page for more detail.