The short version
Who we are
Purrfolio (“Purrfolio”, “we”, “us”) is a personal expense-tracking application available on Android and the web, developed and operated by Stefánia Péter, who is the data controller responsible for your personal data under this policy.
This policy applies to the Purrfolio mobile apps, the Purrfolio web app and this website (together, the “Service”).
Data we collect
Information you give us
- Account information — your email address and a password. Passwords are handled by our authentication provider and stored only as a salted hash; we can never see them.
- Financial records you enter — accounts (name, type, currency, starting balance, icon and colour), transactions (amount, date, account, category, notes, payer name, labels), transfers, categories, labels and planned/recurring payments.
- Purchase information — if you buy a paid feature or subscription, the app store tells us the product, purchase status, renewal/expiry dates and an order or transaction identifier so we can unlock the feature. Payments are processed entirely by Google Play (or Apple); we never receive your card number or billing details.
- Imported files — if you use CSV import, the file is read and parsed on your device. Only the transactions you confirm are saved to your account; the original file is not uploaded or kept.
- Support messages — if you email us, we receive your email address and whatever you include in your message.
Information collected automatically
- Technical logs — like nearly every online service, our hosting and database providers record limited technical data (such as IP address, device/browser type, timestamps and error information) to operate, secure and debug the Service. These logs are kept for a short period.
- On-device preferences — your theme choice and the “hide numbers” setting are stored locally on your device (for example in local storage). They are not sent to us.
What we don't collect
We do not collect your bank login credentials, payment card numbers (payments are handled by the app store), precise location, contacts, photos, health data or advertising identifiers. We do not use cookies or similar technologies for advertising or cross-site tracking. Only strictly necessary storage is used to keep you signed in.
How we use your data
- To create and secure your account and sign you in.
- To store, sync and display your financial records across your devices.
- To calculate balances, statistics, comparisons and predictions shown in the app.
- To convert amounts between currencies using reference exchange rates.
- To send essential service emails (for example, sign-up confirmation or password reset).
- To provide, verify and restore paid features or subscriptions you have purchased.
- To respond to your support requests.
- To keep the Service secure, prevent abuse and fix bugs.
We do not use your data for advertising, profiling, or to train machine-learning models, and we never sell it.
Legal bases
If you are in the European Economic Area, the United Kingdom or Switzerland, we process your personal data on the following legal bases under the GDPR:
- Performance of a contract (Art. 6(1)(b)) — to provide the Service you signed up for.
- Legitimate interests (Art. 6(1)(f)) — to keep the Service secure, prevent fraud and abuse, and improve reliability.
- Legal obligation (Art. 6(1)(c)) — where we must keep or disclose information to comply with the law.
Who we share it with
We share personal data only with service providers that help us run Purrfolio, under contracts that require them to protect it and use it only on our instructions:
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Authentication, database and backend hosting | Account info, financial records, technical logs |
| Netlify | Hosting of the web app and this website | Technical logs (e.g. IP address) |
| Frankfurter (European Central Bank reference rates) | Currency exchange rates | None — rates are fetched by our server; no personal data is sent |
| Google Play (and Apple App Store, where applicable) | App distribution and payment processing for paid features | Purchase status and order/transaction ID. Payment details are handled under Google's (or Apple's) own privacy policy |
We may also disclose information if required by law, to protect the rights and safety of our users or others, or as part of a merger or transfer of the Service (in which case this policy will continue to apply to your data).
International transfers
Our providers may process data outside your country, including in the United States. Where data is transferred outside the EEA/UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.
Data retention
- Your account and financial records are kept for as long as your account exists.
- When you delete your account, your account and all associated records are permanently deleted from our production database within 30 days. Encrypted backups are overwritten on a rolling basis and purged within a further 30 days.
- Records of purchases (product, date, amount and transaction ID) are kept for as long as tax and accounting laws require, even after account deletion.
- Support emails are kept for up to 24 months, then deleted.
- Technical logs are kept only as long as our providers' standard retention periods (typically a few days to a few weeks).
Security
All data is encrypted in transit using HTTPS/TLS and encrypted at rest by our database provider. Our database enforces row-level security, so each signed-in user can only read and write their own records. No system is 100% secure, but we work hard to protect your information and will notify you and the relevant authorities of a breach where required by law.
Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you and receive a copy;
- Rectify inaccurate data (most data can be edited directly in the app);
- Erase your data (“right to be forgotten”);
- Restrict or object to certain processing;
- Data portability — receive your data in a structured, machine-readable format;
- Withdraw consent where processing is based on consent;
- Lodge a complaint with your local data protection supervisory authority.
California residents have the right to know, delete and correct personal information, and to not be discriminated against for exercising these rights. We do not sell or “share” personal information as those terms are defined under the CCPA/CPRA.
To exercise any of these rights, email privacy@purrfolio.app. We will respond within 30 days.
Deleting your account
You can delete your account and all of its data at any time. See Delete your account for step-by-step instructions and details of what is removed.
Children
Purrfolio is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will delete it.
Changes to this policy
We may update this policy from time to time. If we make material changes, we will notify you in the app or by email before they take effect. The “Last updated” date at the top always shows the latest revision.
Contact us
Questions about this policy or your data? Email privacy@purrfolio.app — a real human (and possibly a cat) will get back to you.