This notice describes how BudgetApp stores and uses your data.

We never use your data to profile you, and we never sell it, in either mode described below.

What we encrypt in the database

We encrypt the identity of people and companies you pay or receive money from, plus a few financial identifiers. That includes:

• party names and budget names
• transaction descriptions and bank-import remarks
• bank account numbers
• the last four digits of a credit card, if you store them

We do not encrypt your own labels (profile names, account names) or amounts. Those stay as ordinary database values so totals and unique names can use the database.

Who holds your encryption key

When you first connect, you choose one of two ways to protect the encrypted data above:

• We hold the key. The simple default. We manage the encryption key for you, so there is no passphrase to set or remember. This is ordinary encryption at rest: it protects a stolen disk or a leaked backup, but the operator can still decrypt your data, the same as with most other online services.
• You hold the key. You choose a passphrase (or have one generated for you), and we wrap the encryption key with it. Without that passphrase — or the one-time recovery key shown when you set it up — a database backup or a SQL query cannot show who you pay. You may also choose to let us keep a backup copy of your key, as a safety net if you lose both the passphrase and the recovery key.

You can switch between these at any time from Settings. Switching never re-encrypts your data — it only changes who can unwrap the same underlying key — but going from "we hold the key" to "you hold the key" is the only direction that gives you the passphrase-based guarantee above; the reverse hands the key back to us.

If you hold your own key: we cannot reset your passphrase for you unless you opted in to a backup copy. If you forget it, use the recovery key shown when you set it up. Unlocking with that key requires you to choose a new passphrase; we then issue a new recovery key and the old one stops working. If you opted into a backup copy, the operator can issue a one-time reset token instead. That token never shows your financial data to the operator. You use it to set a new passphrase.

You can remember a device. That device holds its own key. The operator cannot use it.

What we can still read

We can read data that is not counterparty identity, because we need it to run the product:

• your email address and display name
• your own account and profile names, amounts, and dates
• Paddle subscription, license, and donation records

What the running app can see

BudgetApp runs on the server (Blazor Server). While your session is unlocked, the server decrypts your financial data so it can show screens, match imported transactions, and generate reports.

That means a changed copy of the app, or a live unlocked session, could send your decrypted data somewhere else. We state that we will not do that. This notice is that promise in writing. Encryption in the database does not make that promise cryptographically impossible to break.

What we log

BudgetApp does not put personal or financial information in its application logs. These logs contain only non-personal technical information needed to run the service, such as timestamps, event types, and status codes.

Your choices

• You choose whether to connect, and whether we hold your encryption key or you do.
• If you hold your own key, you choose whether the operator may keep a backup copy of it.
• You can switch who holds the key later, from Settings.
• You can remember a device so this browser can unlock without a passphrase.
• You can disconnect. Encrypted rows stay in the database until they are deleted. If you hold your own key, we still cannot read them without your secret.

Contact

Questions about this notice go to the operator of this instance.