Budgette privacy.

Who is responsible.

Budgette is made by me, Simon Elhoej Steinmejer, a developer in Denmark. I'm responsible for the app and for the small amount of personal data this policy describes. Write to elhoejdotdev@gmail.com with any question about it.

The short version.

Budgette has no account and no server of my own, and it contains no analytics, advertising or tracking code. Your budget is stored on your iPhone and in your own iCloud, where I can't see it. I don't sell personal data or share it with anyone.

The one piece of personal data I can see is the name you type when you invite a partner, and I can see it only while that invite exists.

What stays on your iPhone.

Your budget, categories, expenses, recurring expenses, receipts and settings are kept in a database on your iPhone. The Home Screen widget and the Add expense shortcut use the same database.

Receipts are read on the phone with the camera and Apple's text recognition. No photo or text is sent anywhere to be read. With Keep receipt photos turned off, the photo is thrown away once its lines have been read.

Budget alerts and the daily reminder are notifications your iPhone schedules by itself. Face ID is handled by iOS, and Budgette only learns whether the check passed.

What goes to your iCloud.

When you're signed in to iCloud, Budgette copies your budget, including any receipt photos you keep, to your private iCloud database, so it comes back on a new phone. If you're not signed in, nothing leaves the phone.

Apple stores this copy under its own iCloud terms and privacy policy, and it counts toward your iCloud storage. Apple doesn't show developers what's in their users' private databases, so I have no access to it.

Budgeting with a partner.

When you share your budget, your partner's iPhone gets the whole of it through Apple's iCloud sharing: every category, expense and kept receipt photo, and the name and avatar colour each of you chose. Every expense shows who added it.

The shared budget lives in the iCloud account of the person who created it. If a partner leaves or is removed, they lose access, and what they added stays in the budget.

The invite.

So that your partner can join with a six-character code, Budgette saves an invite in the app's public iCloud database. It holds the code, the name you typed, your avatar colour, the link to your shared budget and an expiry date. Apple adds an identifier for your iCloud account that only Budgette uses. Anyone with the code can look the invite up, and I can see it in Apple's CloudKit dashboard.

The code stops working after seven days. Budgette deletes the invite when your partner joins, when you remove your partner, or when you start over. An invite that expires without being used is not deleted automatically, and it stays in the database until it is. Email me and I'll delete yours.

I use the invite only to connect you with your partner and never look at it for any other reason. Under the GDPR, the legal basis is that it's needed to give you the sharing you asked for (Article 6(1)(b)).

What Apple shares with me.

If you've turned on Share with App Developers in your iPhone's Analytics settings, Apple sends me crash reports and usage statistics for Budgette. Apple decides what they contain and passes them on in a form that doesn't identify you. Apple also shows me download and sales figures for the App Store, in totals.

Getting your data out, or deleting it.

Settings → Your budget → Export as CSV writes your expenses to a file on your phone, and you choose where it goes.

Start over, at the bottom of Settings, deletes your budget from this iPhone and from iCloud. If you created a shared budget, your partner loses it too. If you joined someone else's budget, Start over makes you leave it instead, and what you added stays in theirs.

Deleting the app removes the data on that iPhone. To remove the iCloud copy as well, delete Budgette's data under iCloud storage in the Settings app.

Your rights.

Under the GDPR you can ask me for a copy of the personal data I hold about you, and ask me to correct it, delete it, limit how I use it, or hand it over in a portable format. You can also object to how I use it. The only personal data I hold is an invite, and I'll delete yours whenever you ask. For everything on your phone and in your iCloud, the export and Start over above do the job, because I can't reach that data myself.

If you think I've handled your data wrongly, you can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, dt@datatilsynet.dk, or to the data protection authority where you live.

Children.

Budgette is a general budgeting app and isn't made for children. If you believe a child has created an invite, email me and I'll delete it.

Changes to this policy.

When I change how Budgette handles data, I'll update this page and the date at the top. If a change means more of your data leaves your phone, I'll also say so in the App Store release notes.