Privacy policy

What Budgiva records, why, where, and how you take back control of it.

Last updated: 26 September 2026

This translation is provided for information only. In the event of any discrepancy, the French version prevails.

1. Who is responsible for your data

Budgiva is published by a private individual, on a non-professional and non-profit basis. In accordance with Article 6 III 2 of the French law on confidence in the digital economy (loi pour la confiance dans l’économie numérique), the publisher’s identification details are held by the hosting provider, which is bound by professional secrecy in respect of them.

For any question about your data, or to exercise your rights, write to contact@budgiva.com. Every request receives a reply within one month, in accordance with the GDPR.

Hosting providers

• Cloudflare, Inc. — 101 Townsend Street, San Francisco, CA 94107, United States. Hosts the interface files.
• Supabase Pte. Ltd. — 65 Chulia Street, #38-02/03, OCBC Centre, Singapore 049513. Hosts the database, in its European region (see point 4).

2. What data is recorded

Almost all the data below comes from you; the last three rows of the table are set by the application. None of it is inferred from your behaviour, bought, or collected elsewhere.

What is never recorded

• No banking data. Budgiva connects to no bank and never asks for bank login details. There is nothing to link.
• No payment details, and no card number.
• No projection results. Projections, gaps and the dates when goals will be reached are recalculated each time they are displayed, from your figures. They are not stored anywhere.
• No location data, and no advertising profile.

Some recorded items do not come from what you enter: the record of reminders sent to you (point 6), the AI agent’s usage counter, the plan recorded on your account, and the technical record of a display crash. None of them contains a figure from your budget or a label you have written.

3. On what legal basis

• Performance of the contract (Article 6(1)(b) of the GDPR) for everything needed for the service to work: your account and your financial data. Without them, the application simply cannot calculate anything.
• Legitimate interest (Article 6(1)(f)) for the security of the service: preventing unauthorised access and abuse.
• Legitimate interest again (Article 6(1)(f)) for the monthly reminder. A budget that is no longer updated stops being useful without warning, and this e-mail is the only thing that tells you so. It sells nothing and promotes nothing. You can object to it at any time, without giving a reason and without writing to us: point 6 explains how.
• Legitimate interest again (Article 6(1)(f)) for the proper functioning of the service: knowing that a display failure has occurred. Without this record, a broken application stays broken until someone thinks of writing to us. It contains no amount, no label and not the content of the failure, and no decision about you is taken on the basis of it.

4. Where your data is hosted

Your data is stored with Supabase, in the eu-west-1 (Ireland) region — that is, within the European Union.

Only one thing leaves the European Economic Area, and only if you use it: what you write in the AI agent — or what you dictate to it, your recording then being sent as it is — is transmitted to OpenAI, in the United States, together with the amounts for your current month, your capital, your goal, your balance checks, the language you have chosen and, if you have entered it, your first name. Nothing else that the application records leaves Europe: neither your saved scenarios, nor the amount of your one-off expenses, nor the labels you have written on your income and expense lines. The details are in point 5.

One caveat, and it applies to every e-mail in the world: a message that you send us — a reply to a reminder, a request to contact@budgiva.com — travels the way e-mail travels, and arrives in an ordinary mailbox that is not hosted in Europe. This is not data that the application processes; it is a letter that you post. We say so because the previous sentence, without this caveat, would read more broadly than it is meant.

The application uses four providers, and no others:

5. The AI agent

The AI agent screen is the only one in the application that calls on an external service. As soon as you send a message there, two things go to OpenAI: the text you have just written, with the few previous exchanges of the same conversation, and a numerical summary of your current month.

The lines awaiting your confirmation are part of these previous exchanges: when the agent has suggested lines and you reply — ‘no, groceries are 450’ — they go back with your message, in the form in which it wrote them, so that it knows which one you mean. Their labels are the ones it produced, and they cannot be edited on screen: no label written by you can appear there. Nothing has been saved yet at that point.

Since 20 September 2026, the agent also answers questions about the months ahead — ‘how much will I have put aside in December?’, ‘and what if I cancel this subscription?’. Those amounts are not sent to it: the application calculates them on your device, from your figures, and the model never receives a projection. It receives only the question as it understood it — a month, an amount you stated yourself, a category. On the other hand, the reply it shows you contains these calculated amounts, and that reply is part of the previous exchanges: if you continue the conversation, it goes back with your next message. In other words, a future amount can leave your device, but only after it has been shown to you, and only if you continue the exchange.

This summary accompanies every message, not only requests for a reading. This is a direct consequence of the way the agent works: a single instruction covers every case, and it is the model that recognises whether you are describing an expense, correcting one, or asking a question about your month. It therefore needs the figures at the moment it reads your sentence. As long as you have not saved any line, there is no summary and nothing of the kind is sent.

This summary is calculated on your device and contains: the month concerned, the currency, the total of your income and of your expenses that come back every month, the difference between the two, and the amount of each category with its share as a percentage. Categories are referred to in it by the application’s fixed names — ‘Housing’, ‘Groceries and food’, ‘Salary’ — never by what you have written yourself on your lines.

Since 20 September 2026, it also contains your available capital and the date on which you recorded it, your goal — its name, the target amount and the target month — and your balance checks: the month and amount of the latest one, and how many you have recorded. Each of them is included only if you have entered it.

These three were excluded until then. They are included so that the agent can answer ‘how much have I put aside?’ and record the capital you dictate to it, instead of refusing the most natural questions for a budgeting application. The name of your goal is the only text you write yourself that is sent in this summary, and it is sent for a specific reason: an answer that said ‘your goal’ without naming it would be of no use. The labels of your income and expense lines, however, are still not sent.

When you describe your situation in a few sentences so that it can be turned into budget lines, you review and confirm each line before anything is saved. The agent can also correct or delete an existing line — ‘my rent has gone up to 850’, ‘I no longer have a gym subscription’. It then designates a category, never a line: it sees none of your labels, and it is your device that finds the lines concerned and presents them to you. Here too, nothing is changed or deleted before you confirm.

The language of your account is sent. This is new since 22 September 2026, and it is what allows the agent to reply in the language you have chosen rather than in the language of your message. It is neither an amount nor a text from you: it is one of the three values ‘French’, ‘English’ or ‘Spanish’, the same as the selector in your Settings. It is sent with every message, even if you have never touched this setting — French is then the value sent.

Your first name is sent, if you have entered it. This is new since 15 September 2026, and it is the only data sent that identifies you: it is used so that the agent can greet you and reply to you by your first name. It is sent only if you have written it — the ‘Your first name’ field in Settings is optional, and leaving it empty, or clearing it, is enough for nothing more to be sent. The agent’s welcome, for its part, greets you from your device: that greeting does not depend on anything being sent.

If you dictate, your voice is sent too. This is new since 15 September 2026. Pressing the microphone records what you say and sends that recording to OpenAI, which transcribes it and returns the text. That text is placed in the input field, where you read it over and correct it; nothing goes to the agent until you have pressed send. The recording is used only to write down what you said — it is neither understood, nor interpreted, nor compared with anything.

This recording is not kept anywhere: not in the database, not in our files, not in our logs. It does not outlive the request that carries it. The microphone only opens when you press it, your browser first asks for your permission, and the recording stops by itself after one minute. We say this because a voice says more than a text: it carries the words, and it also carries the means of recognising the person speaking them.

What is never sent, whatever the use:

• your e-mail address, or your account identifier;
• the labels you have entered on your lines — this is the only place where the name of a person, an employer or a healthcare professional may appear;
• your saved scenarios and their names, the amount of your one-off expenses, and any month other than the current month — including the months ahead, which the agent never obtains other than by having first displayed them to you (see above). The summary does, however, send the number of one-off expenses recorded, without any amount: this is what allows the agent to tell you that its reading does not count them;
• anything at all if you do not open this screen.

In other words: amounts, categories, the language of your account, and your first name if you have entered it — never your labels, and never your history. Please note, however — what you type yourself in the field is sent as it is: do not write any name or health information there.

The conversation is recorded neither by us nor in your account — neither the question, nor the summary sent, nor the answer. It stays in your browser, in session storage: it survives a page reload, so that you do not lose your thread when coming back from another screen, and it disappears when you close the tab, when you sign out and when you delete your account. It only leaves your browser with each new message, in the form of the few previous exchanges described above. Only the lines you explicitly confirm are saved, exactly as if you had entered them by hand.

Your exchanges are not used to train OpenAI’s models: this is the default setting of their application programming interface, and we have not enabled any sharing. OpenAI does, however, keep requests for up to 30 days for abuse detection, and then deletes them. This processing takes place in the United States, governed by the European Commission’s standard contractual clauses, the framework provided by the GDPR for this case. We do not promise a date for switching to processing in Europe: what is written here describes what is, not what will be.

The agent never gives financial advice, nor any investment recommendation. It turns your sentences into budget lines, and describes your own figures — it never tells you what you should do with them. It compares your expenses with no average, and cites no figure that does not come from what you have entered: every amount it states is calculated by the application, then checked before being shown to you.

6. The monthly reminder

If you leave it on, Budgiva sends you an e-mail to let you know that your tracking is getting out of date. It is the only message the application sends of its own accord — all the others respond to an action on your part. It therefore deserves to be described in full.

What triggers it

An automated task checks every hour which accounts to notify. It only selects yours if all of these conditions are met: the reminder is on in your Settings, your account is more than thirty days old, you have at least one budget line, and your latest balance check — failing that your capital, failing that the creation of the account — is more than twenty-five days old. It is sent at 8 am your time, according to the time zone recorded in your profile, and not at 8 am server time.

Its frequency is the one you have chosen: at most one a month, or one a quarter. And it stops by itself: after two reminders that have had no effect, the second one tells you it will be the last, and then nothing more is sent. It will resume of its own accord the day you come back to your budget, without you having to ask for it again.

One exception: if you are a subscriber, it does not stop by itself. Monthly tracking is part of what you pay for, and leaving you without news until renewal would not serve you well. To apply this single rule, the task reads whether your subscription is active — nothing else about your subscription. Subscriber or not, ‘Never’, in your Settings, stops it at any time.

What it contains

No amounts, anywhere — not in the subject, not in the body, not in the preview your mail program shows beside it. The message carries only a length of time: ‘your last balance check was 125 days ago’. Added to this are your first name if you have entered it, a link to the application, and a link to stop the reminders. None of your figures appear in it, and an automated test checks at every release that no ‘€’ has slipped in.

This is not a matter of discreet wording. An e-mail passes through servers we do not control and appears on a locked screen: putting a capital amount in it would expose, without a session or a password, what the whole rest of the application protects behind both.

What Resend receives

The reminder is delivered by Resend, like account e-mails, in the eu-west-1 (Ireland) region. It therefore receives your address and the content of the message — that is, here, a length of time and your first name. Open tracking and click tracking are disabled: we know neither whether you opened it nor whether you clicked. Point 9 describes the only trace that the image in our e-mails can leave, and why it does not identify you.

What we keep

One sending record per reminder: the month concerned, whether or not it was sent, the length of time the message stated, and the identifier the carrier gave back to us. No amount. This record is what prevents us from writing to you twice in the same month, and what allows a sending interrupted by an outage to be resumed rather than lost. It disappears with your account.

If you reply to it

The reminder accepts replies: they arrive at contact@budgiva.com, the same address that point 1 gives for exercising your rights — a single door, rather than a second one to keep an eye on. The route goes through Cloudflare Email Routing, which routes incoming mail for budgiva.com to an ordinary mailbox. What you write in that reply therefore reaches us in full, like any e-mail: only put in it what you would be willing to send by e-mail. Nothing obliges you to reply — stopping the reminders requires no message.

How to stop it

Three ways, all immediate, with no delay and no reason to give:

• From the Settings screen, with a switch — that is also where the frequency is chosen.
• From the link at the bottom of the message, which works without signing in: it carries a signature that is valid only for your account.
• From your mail program’s button, if it displays one: our reminders carry the standard headers that trigger it.

Turning off reminders affects nothing else: neither your account nor your data. You will continue to receive the e-mails you request yourself — an address confirmation, a password reset.

7. How long it is kept

• For as long as your account exists. Your data remains available to you, with no time limit, for as long as you use the service.
• Immediate erasure at your request. ‘Clear my financial data’ permanently deletes capital, income, expenses, events, balance checks, goal and saved scenarios, while keeping your account.
• Reminder sending records (point 6) remain for as long as your account exists and disappear with it. ‘Clear my financial data’ does not touch them: they contain no figures, and erasing them would reopen the door to a duplicate.
• Technical crash records (point 2) remain for as long as your account exists and disappear with it. ‘Clear my financial data’ does not touch them: they contain none of your figures, and erasing them would delete the record of a fault we have not yet fixed.
• Deleting the account. It deletes your account and all of your data, in a single irreversible operation. No copy is kept.

8. Who can see your data

Nobody but you. Every table in the database is protected by strict row-level isolation: technically, a query made with another person’s account returns none of your rows. This protection is verified by automated tests run against the real database.

One exception, and it is not a transfer. The publisher, who is responsible for this data, can read the technical crash log (point 2) in order to fix the application — it is in fact the only data on this page that you cannot view yourself in the application. It shows a date, a screen, a type of error, a version and a position in the code: never an amount, never a label, never the content of the failure. If we write to you following a crash, we will tell you where we got it from.

Your data is neither sold nor rented out, and is never used to train an artificial intelligence model — neither ours, as we have none, nor those of our providers.

It is passed on to nobody. Two providers see part of it in order to do their job, and point 4 names them: Resend, which delivers our e-mails and therefore receives your address and the content of the monthly reminder — a length of time and your first name, never an amount (point 6); and OpenAI, if you use the AI agent, which receives what you write there and the amounts for your current month (point 5). Nobody else, in any capacity.

9. Cookies and local storage

Budgiva places no advertising or audience measurement cookies. There is therefore no consent banner to display.

The application uses only your browser’s storage to:

• keep your session open between two visits — which keeps, in this browser, your e-mail address, your account identifier and the tokens that prove you are signed in — and remember the single-use code that links this browser to the confirmation or reset link we e-mail you;
• remember your light or dark theme preference;
• remember the language of your account, so that the application opens directly in that language on your next visit and, once you are signed out, the sign-in page is shown in that language; like the theme, it stays on the device after you sign out, and even after your account is deleted: it is only a display preference;
• remember the plan whose button you clicked on our home page, until it joins your account the next time the application is opened in this browser; it is then forgotten there;
• keep the AI agent conversation for as long as the tab is open, so that a reload or a visit to another screen does not make you lose your thread (point 5) — and, in the same place, the notice of a monthly line turned into a one-off whose ending could not be saved, so that we can offer to do it again;
• note, for as long as the tab is open, the time at which a page was reloaded because one of the site’s files could not be loaded — most often after an update — so as not to reload it in a loop;
• keep a copy of the site’s public files — the application page, its scripts, style sheets and font, this policy, the terms of use and the ‘About’ page — so that the site opens even without a connection. They are the same files for everyone: none of your data and none of your figures go into them;
• since 26 September 2026, remember, when a balance check is more recent than your capital and you choose ‘Keep my capital’, that balance check and its amount, so that you are not asked the same question every time you open the application. This choice is erased when you sign out, when you delete your account and when you clear your financial data.

Another use appeared here until 4 September 2026: we remembered which of our three welcome phrases you had been shown, so that it would not change before your eyes. The random draw has been removed, the phrase is now the same for everyone, and that storage entry no longer exists. We point this out rather than erasing it silently: that day, this point came to describe less than it used to, never more.

Conversely, three uses in the list above — the language, the chosen plan and the reload after an update — existed before they were written here: they were only added on 26 September 2026. Of the three, only the chosen plan leaves your device: it is copied to your account and erased from the browser. The offline copy, in place since 1 September 2026, and the single-use sign-in code, in place since the service opened, are in the same situation: they have only been described here since 26 September 2026.

This information stays on your device, with four exceptions: the session tokens, which your browser presents to Supabase, which handles your sign-in (point 4), to prove it is really you and to renew your session; the single-use code, which it presents only once, when you open the link received by e-mail; the chosen plan, copied to your account; and the latest exchanges with the agent, which are sent again with each message (point 5). Clearing your browser data erases it, without affecting your account.

The font is served from our own domain: no request is sent to a third-party service during your visit.

The images in our e-mails

Account e-mails — address confirmation, forgotten password — contain a single image: our logo, served from budgiva.com. It needs to be said clearly, because it is a mechanism that is rarely talked about: when your mail program displays this image, it requests it from our hosting provider, which logs the request. We therefore learn that an e-mail has been opened.

What this mechanism does not do, and this is the difference that matters. Our logo is the same file for everyone: its address contains no identifier, so it cannot link the opening to anyone. That is precisely what distinguishes a brand image from a tracking pixel — an invisible image of one pixel by one, whose address carries a code specific to each recipient. We use none. Open tracking and click tracking are disabled at our carrier, which means that the links in our e-mails take you where they say they go, without passing through a counting address.

If even this bothers you, blocking images in your mail program — most do so by default — is enough to remove this trace: our e-mails remain perfectly readable without their logo.

10. Your rights

The GDPR gives you the following rights, which you can exercise at any time.

• Access and rectification — your data is visible and editable directly in the application, without any intermediary.
• Erasure — from Settings, immediately, without having to ask for it.
• Access — your data is visible and editable directly in the application, without any intermediary. Two technical records are exceptions and are not displayed there: the record of reminders sent (point 6) and that of crashes (point 2). Write to us at the address in point 1 to obtain a copy.
• Portability — write to us at the address given in point 1 to obtain a copy of your data in a machine-readable format.
• Objection and restriction of processing.
• Complaint — you can lodge a complaint with the CNIL, the French data protection authority, if you consider that your rights are not being respected.

11. Security

• All communications are encrypted in transit (HTTPS mandatory).
• Passwords are never stored in plain text, nor accessible to anyone.
• Isolation between accounts is enforced by the database itself, not by the application code — a programming error therefore cannot expose another account’s data.

No system is infallible. In the event of a data breach likely to result in a risk to your rights, you will be informed as soon as possible, in accordance with Article 34 of the GDPR.

12. Changes

This policy may change as the service evolves. The date of the last update appears at the top of this page. Any substantial change will be notified to you by e-mail or in the application before it takes effect.

What has been announced, and when

September 2026 — recording display crashes. Described in point 2 since 4 September, it recorded nothing at the time: the code refused to record. A notice is displayed in the application, on the landing screen, and recording begins on 12 September 2026. The notice and the code read the same date, so the application cannot record while it is still announcing the date as upcoming. This notice disappears by itself on that date; the description that follows remains in your Settings.

What is recorded from then on: the place in the code where the display got stuck, the screen concerned, the technical name of the error and the version of the application. Neither the error message, nor its details, nor the page address — so none of your amounts and none of your labels. Point 2 gives the details, point 7 how long it is kept, and point 10 how to request its erasure.