ExpenGoals – Privacy Policy

Version 2026-10-11

1. Who is responsible

ExpenGoals is operated by a private individual (the "controller"). Contact for all privacy matters: [email protected].

2. What we collect and why

Data	Purpose	Legal basis (GDPR)
Name, email address, password (stored only as a salted hash)	Create and secure your account, send invites and password-reset codes	Art. 6(1)(b) contract
Items you enter: incomes, expenses, goals, bills, gifts, shopping, budgets, contributions, comments, currency	Provide the app's planning features	Art. 6(1)(b) contract
Push notification token	Notify you about partner activity and bill reminders	Art. 6(1)(a) consent (you can refuse or disable notifications in your device settings)
Technical data (IP address) processed transiently for rate limiting; not stored in the database	Protect against abuse and brute-force attacks	Art. 6(1)(f) legitimate interest

We do not use analytics, advertising or tracking, and we do not sell data. We do not ask for bank credentials or connect to bank accounts.

3. Sharing with your partner

When you link with a partner, items you mark as shared (with their comments) and your name are visible to them. Your personal items are private to you.

4. Who processes data for us

Railway Corp. – hosting of the application server. Servers are located in the EU region we selected; Railway is a US company, so transfers rely on standard contractual clauses / the EU–US Data Privacy Framework.
Supabase Inc. – managed PostgreSQL database that stores your account and app data, hosted in the EU region we selected.
Cloudflare, Inc. – delivery of the website and web app (CDN); it processes technical request data such as IP addresses. Transfers outside the EU rely on Cloudflare's EU–US Data Privacy Framework certification / standard contractual clauses.
Resend – delivery of emails (invites, password-reset codes, account notices). Recipient address and message content pass through Resend; transfers outside the EU rely on standard contractual clauses.
Expo (Expo push service), Apple and Google – delivery of push notifications, only if you enable them. They receive your push token and the notification text. Transfers outside the EU rely on the providers' EU–US Data Privacy Framework certification / standard contractual clauses.

5. How long we keep data

Account and items: until you delete your account.
Password-reset codes and expired invites: deleted automatically once expired.
Push tokens: until you disable notifications, the token becomes invalid, or you delete your account.

6. Your rights

You have the right to access, rectify, erase, restrict and port your data, to object to processing, and to withdraw consent at any time. In the app: change your name, email and password under Settings → Account; download your data as CSV under Settings → Export; delete your account and all your data under Settings → Delete account. For anything else, email [email protected]; we reply within one month.

When you delete your account, your personal data is erased. Shared items are removed and your partner is notified by email.

You may lodge a complaint with your national data protection authority (for example in Greece, the Hellenic Data Protection Authority, dpa.gr).

7. Security

Traffic is encrypted with HTTPS, passwords are hashed, and access is limited to the operator. No system is perfectly secure; in case of a breach affecting you, we will inform you and the authorities as required by law.

8. Age

The app is for people aged 16 and over.

9. Changes

If this policy changes materially, the version date above is updated and we will notify you in the app or by email.