Privacy Policy

Last updated: 20 October 2026

1. What data we collect

• Account data: your email and, optionally, your name when you sign up (directly or with Google).
• Data you enter yourself: financial information (income, expenses, savings, goals), notes, photos and any other content you add to the app. This data is yours and only you have access to it (see section 4).
• Plan and billing data: which plan you have (Free/Pro/trial) and the status of your subscription. Online payment is not active yet (the Pro plan is activated manually); when it is, only the minimum data needed to manage it will be stored (see section 3).
• Basic technical data: the data your browser generates automatically when using the app (e.g. to keep you logged in).

2. Why we process it (legal basis)

We process your data to provide the service you signed up for (performance of a contract): storing and showing you your own data, keeping your session, and managing your plan.

3. Who we share it with

• Supabase (database, authentication, file storage and account emails, servers in the EU): hosts your data. Acts as a data processor.
• Netlify / Cloudflare Pages (website hosting): serve the app's static files.
• Cloudflare Web Analytics (visit statistics): only on the public pages (the presentation website and these legal pages), never inside the app. It counts visits in an aggregated, anonymous way (page, country, browser, where the visit comes from), with no cookies or any identifier that could track you.
• Sentry (error tracking, servers in the EU): when the app fails, it receives a technical error report (browser, page and previous steps) and your account's internal ID. Your email, search parameters and the content you save are not sent. Acts as a data processor.
• External lookup services (stock quotes, book, game and movie covers, exchange rates, public holidays, weather and plant care translations): when you use these features, our server sends them only what the lookup needs (e.g. the title or ISBN you search for, or a town name), never your email or your financial data.
• Camera (only if you use the barcode scanner): the code is read on your own device; the camera image is never sent or stored anywhere.
• Browser notification service (only if you turn on reminders in Settings → 🔔 Reminders; e.g. Google, Mozilla or Apple, depending on your browser): receives each reminder's text end-to-end encrypted, so only your device can read it. We store the device's notification address and the text of reminders scheduled for the next few days; turning them off or signing out deletes that device's address.
• Lemon Squeezy (payments, a United States company): if you buy Pro, it collects your payment and billing details (name, email, country and card) as an independent data controller, because it is the one selling you the subscription («Merchant of Record»), under its privacy policy. We only receive the subscription status, its ID, the renewal dates and your email, to activate Pro on your account. Never your card details.

We do not sell or share your data with third parties for advertising.

4. How we protect your data

• Account isolation (RLS): the database is configured so that each user can only read and change their own data, never another account's.
• Extra encryption: the passwords/credentials module ("Accounts") encrypts its content in your own browser (AES-GCM) before saving it — not even we can read it without your key.
• App lock (optional): your PIN is stored only on your device and as a hash, never as-is. Your fingerprint or face is checked by your phone's system: the app never receives it.
• Encrypted connection (HTTPS) at all times.

5. How long we keep it

For as long as your account is active. If you delete it (see section 6), all your data is erased immediately and irreversibly. The encrypted backups made every night (only used to restore the service after a failure) keep it for up to 30 days (files, up to 7) and then disappear on their own.

6. Your rights

You have the right to access, rectify, port and erase your data at any time:

• Access and portability: you can export your data from the app itself (a .json copy, or Excel/PDF with the Pro plan).
• Rectification: you can edit any data directly in the app.
• Erasure ("right to be forgotten"): from ⚙️ Settings you can delete your account and all your data immediately and irreversibly, without asking anyone. The only thing kept is an irreversible, encrypted fingerprint of your email (not the email itself), so the free trial cannot be repeated by deleting and re-creating the account (legitimate interest in preventing abuse). If you can't log in, you can also ask by email: see Delete your account.
• Objection or questions: email support@numivita.com for anything else about your data. You can also lodge a complaint with a data protection authority (in Spain, the AEPD).

7. Cookies and local storage

We only use strictly necessary storage (the browser's localStorage): your light/dark theme and language preference, your session token, and a temporary copy of unsaved changes when you go offline. We use no tracking, analytics or advertising cookies. The visit statistics on the public pages (section 3) use no cookies.

8. Children

This service is not intended for children under 16.

9. Changes to this policy

If we make relevant changes, we will update the date at the top and, where appropriate, notify you in the app. See also the Terms and Conditions.

← Back to Numivita