Privacy policy

Who we are

Budg is made by Goodwill Enterprise.

What we never do

We don't sell or rent your data, show ads, share data for advertising, or connect to your bank.

What you put into Budg

You type in your spending, income, categories, budgets, goals, accounts and repeating entries, and choose settings such as your currency and theme. All of this is saved in a database on your phone. Without cloud backup, none of it is sent anywhere.

When you first open Budg, it reads your phone's language and region settings to suggest a currency. That reading stays on your phone.

Backups and exports

Budg can write your data to a file when you ask it to:

• Back up now saves everything to a backup file.
• Export data saves your entries to a spreadsheet file (CSV).

These files are not encrypted. Budg hands each one to your phone's share menu, and you decide where it goes: a folder on your phone, a cloud drive, an email or a chat. From that point the file is yours, and its safety depends on where you keep it. Anyone who can open the file can read your entries.

Before a restore replaces your data, Budg keeps a copy of what was there on your phone, so that a mistaken restore can be undone. It keeps only the three most recent copies. It also opens your phone's share menu with that copy, so you can save it somewhere you can reach. Like any backup file, it is not encrypted, and it goes only where you send it. If you close the share menu, the restore still goes ahead and the copy stays on your phone.

Budg turns off Android's automatic app backup and its phone-to-phone copy of app data, so your data is not copied to your Google account or to a new phone by Android. To move to a new phone, use Back up now and restore the file there, or use cloud backup.

Your account and cloud backup (optional)

If you sign in, Budg uses Google sign-in. Google tells Budg's account service, Supabase, your email address, your name and the link to your Google profile picture, and Supabase gives your account a random user ID. Supabase stores this in Singapore. Like any sign-in service, Supabase also keeps a security log of sign-ins and sessions, with the IP address and device information, for a limited time. Budg uses the account only for cloud backup and so that Budg Pro follows you to a new phone.

Cloud backup is part of Budg Pro. When you tap Back up now in Cloud backup, or once a day when you open Budg and your data has changed, Budg sends a full copy of your data, the same contents as a backup file, to your account. Each copy is stored with the date, its size and the app version that made it. Each backup is kept in private storage that, in the app, only your signed-in account can open. Budg's developer and Supabase, as the host, can technically reach stored data; we do not look at your backups except to answer a request from you or when the law requires it. Backups are encrypted on the way to Supabase and encrypted where Supabase stores them. Budg keeps your five most recent backups and deletes older ones.

Signing out stops cloud backup on this phone. Your backups stay in your account until you delete them or the account.

Crash reports

If Budg runs into an error, it can send a crash report so the bug can be found and fixed. Reports go to Sentry, an error-reporting service, which stores them in the EU. The connection is encrypted.

A report contains only the type of error, where in Budg's code it happened (the stack trace), your phone's Android version and Budg's version number. Before a report leaves your phone, Budg removes amounts, notes and the names of your categories, accounts and goals. It sends no user or account ID, no email and no device name, and asks Sentry not to store your IP address. Budg sends at most 20 reports a day.

Crash reports are on when you install Budg. You can turn them off at any time in Settings → Privacy → Send crash reports, and Budg stops sending them straight away. Turn them on again the same way.

Usage analytics

To learn which parts of Budg are used, Budg can send short, named records of app interactions to PostHog, an analytics service, which stores them in the US. The connection is encrypted.

Each record names one action, such as "an entry was added", "a budget was set", "a backup was made", "someone signed in", "an account was deleted" or "the theme was changed", with at most a fixed choice that describes it: for example whether the entry was spending, income or a saving, whether a backup was made by hand or automatically and whether it went to a file or the cloud, or which theme was picked. Purchase events say only that the Pro screen was opened or closed, or that a trial or purchase was started, completed, cancelled, failed or restored, with the plan; they carry no payment details: no price, currency, order number or account. It also says when the app is opened or closed, and carries Budg's version, the screen size and a random ID made when Budg is installed. That ID is not linked to you, your phone or your account, and Budg never sends a name, email or account ID with it. A record never contains an amount, a note, a category, account or goal name, or the date of an entry. PostHog does not store your IP address, and does not work out your location from it.

Usage analytics are on when you install Budg. You can turn them off at any time in Settings → Privacy → Share usage analytics, and Budg stops sending them straight away. Turn them on again the same way.

Budg Pro purchases

Budg Pro is bought, renewed and cancelled through Google Play, under your Google account. Google handles the payment, and Budg never sees your card or other payment details.

To know whether you have Pro, Budg uses RevenueCat, a service that processes purchase status for apps, which stores it in the US. Signed out, RevenueCat knows this install only by a random ID it makes. Signed in, Budg gives RevenueCat your account's random user ID instead, so Pro follows your account to another phone; it never gives RevenueCat your name or email. Budg sends RevenueCat that ID, the app and Android version, your Play Store country, and, once you buy Pro, Google Play's record of the purchase: the purchase token and order number, which plan, its price and currency, when it started, and when it renews or ends. Like any server, RevenueCat's sees your IP address when Budg connects. RevenueCat answers with whether Pro is active. The connection is encrypted. This runs whether or not usage analytics is on, because it is how Pro works; it never includes your budget data.

Budg keeps the last answer on your phone, so Pro keeps working offline. You can cancel at any time in Google Play → Subscriptions.

Reminders

If you turn on the daily reminder, Budg schedules a notification on your phone. It is created and shown by your phone, not sent from the internet. Budg does not use push notifications.

App lock

If you turn on app lock, Budg asks your phone to check your fingerprint, face, PIN, pattern or password. Your phone does the check and only tells Budg whether it passed. Budg never sees or stores your fingerprint, face or passcode.

Permissions

The only permission Budg asks you for is notifications, for the reminder. Android also lists permissions that need no prompt: for example internet access, the fingerprint and face prompt for app lock, setting the reminder again after your phone restarts, and vibration. Budg uses internet access only to send crash reports and usage analytics, while each is on, to check Budg Pro purchases with Google Play and RevenueCat, and, if you sign in, for your account and cloud backups. Google Play billing is listed too, for Pro. It has no access to your location, contacts, camera, photos or storage.

How long we keep it

Crash reports and usage analytics are kept for the providers' standard retention periods, and are not linked to your name.

A copy of your data

To ask for a copy of your account data, email us; we reply within 30 days.

Deleting your data

On your phone: Settings → Data → Erase all data deletes everything Budg holds on this phone and starts it again from the beginning. Uninstalling Budg, or clearing its storage in your phone's settings, does the same. Backup and export files you saved elsewhere are not deleted this way. Delete them wherever you saved them.

Your account: Settings → Account → Delete account deletes your account and every cloud backup at once. You can also tick "Also erase data on this phone". Without the app, email the address below from the Google account you signed in with, and we delete it within 30 days. The steps are also at https://getbudg.pages.dev/delete-account.html. Copies can remain for a short time in the encrypted database backups and the sign-in security log Supabase keeps; they expire on their own.

Crash reports and usage records already sent carry no name, account or link to you, so they cannot be found and deleted for one person; uninstalling also removes their random ID, and a new install starts a new one. Google Play keeps your purchase history with your Google account. To have RevenueCat's record of a purchase deleted, write to the address below with the order number from your Google Play receipt.

Children

Budg is not directed at children, and does not knowingly collect personal information from children.

Changes to this policy

If this policy changes, the new version will be in the app and on the store listing, with a new date at the top.

Contact

Questions about this policy: goodwillprivatelimited+budg@gmail.com