Privacy Policy

1. Data we collect

• Account data: email address, name, password (stored only as a secure hash), language, currency, time zone and country preferences, profile photo if you upload one.
• Sign-in with Google: if you choose it, we receive your email address, name and Google account identifier.
• Financial records you enter: accounts, balances, transactions, categories, tags, contacts, budgets, reminders and notes. You enter this data yourself; we do not connect to your bank.
• Billing data: plan, billing period, subscription status and Paddle customer and subscription identifiers. Card and other payment details are collected and stored by Paddle, not by us.
• Support data: messages you send us and, if you choose to attach it, a technical diagnostics snapshot.
• Technical data: IP address, browser and device type, and error reports needed to keep the Service secure and working.
• Usage statistics, only if you accept analytics cookies: pages visited, the site you came from, clicks on links, approximate location and device type. Page addresses are sent without their query parameters, and the content of your financial records is never sent.

2. How we use it

We process data to perform our contract with you, to meet legal obligations (for example, tax records kept by our reseller), for our legitimate interest in keeping the Service secure, and — for usage statistics — on the basis of your consent to analytics cookies. We do not use your financial records for advertising and do not sell or rent personal data.

• to provide the Service: store your records, calculate balances and reports, send reminders and notifications you have enabled;
• to manage your account and subscription, and to answer support requests;
• to send service emails such as email verification, password reset and important changes to the Service or these policies;
• to keep the Service secure, prevent abuse and fix errors.

3. Who we share it with

We share data only with service providers that help us run the Service, and only as much as they need:

• Paddle.com — our reseller and Merchant of Record, which processes payments, invoices, taxes and refunds. Paddle handles payment data under its own privacy policy.
• Hosting and infrastructure providers that store and serve the Service.
• An email delivery provider for service emails.
• An error monitoring service that receives technical error reports.
• Google, if you choose to sign in with Google.
• YANDEX LLC (Yandex Metrica) and Google LLC (Google Analytics) — web analytics, only if you accept analytics cookies.

4. Cookies and local storage

Browser local storage keeps you signed in and remembers preferences such as language, theme and your cookie choice. These are needed for the Service to work and need no consent.

Analytics cookies of Yandex Metrica and Google Analytics help us understand how the site is used (which pages are visited, where visitors come from) so we can improve it. They are set only after you click "Accept" in the cookie banner; if you decline, no analytics scripts are loaded. You can change your choice at any time via "Cookie settings" at the bottom of the public pages. Session recording (Webvisor) is not used.

We do not use advertising cookies. Paddle may set its own cookies on the checkout page.

5. Retention

We keep your data while your account is active. When you delete your account, it is deactivated immediately and you can restore it within 30 days; after that the account and all its data are permanently deleted, except limited records we must keep longer to meet legal obligations. Backups roll over within 30 days.

6. Your rights

Depending on where you live, you have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent. You can export a full backup and delete your account yourself in the profile settings, or write to us at support@buddzy.help. You also have the right to complain to your local data protection authority.

7. Security

Data is transmitted over encrypted connections (HTTPS), passwords are stored as salted hashes, and access to production systems is restricted. No system is perfectly secure, but we take reasonable measures to protect your data and will notify you of a breach that affects it as required by law.

8. International transfers

Our service providers may process data in countries other than yours; for example, Google Analytics data is processed by Google LLC, including in the United States. Where required, such transfers are protected by appropriate safeguards such as standard contractual clauses.

9. Children

The Service is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

10. Changes and contact

We may update this policy; the date at the top shows the latest version, and we will notify you of material changes. Questions or requests about your data: support@buddzy.help.