Last updated: 29 October 2026
Effective: 29 April 2026
This Privacy Policy explains what personal data Budgero collects, how it's used and shared, and the rights you have under applicable privacy laws — primarily the EU/UK General Data Protection Regulation (GDPR / UK GDPR) and the California Consumer Privacy Act / California Privacy Rights Act (CCPA / CPRA).
It's written in plain English. Where a section matters legally — like lawful bases or your rights — the legal terms are preserved so you can compare it against the regulations. If anything is unclear, email privacy@budgero.app.
Budgero is the “data controller” for the personal data processed through the service for the purposes of GDPR.
Privacy contact: privacy@budgero.app
General contact: hello@budgero.app
At Budgero's current scale (small user base, no special-category data, no large-scale monitoring), GDPR Art. 27's exemption from the EU-representative requirement applies — processing is occasional, not large-scale, and not high-risk. If the project grows past that threshold, an EU representative will be appointed and this policy updated. The same applies to a UK representative under UK GDPR Art. 27.
What zero-knowledge does not cover. To make shared workspaces and real-time sync work, Budgero stores a small amount of collaboration metadata on the server in plaintext: the display name you give to a workspace, the email addresses of people you've invited to it, membership roles, and sync version numbers. Push-notification payloads themselves are encrypted; only the account and workspace identifiers needed to route them are stored in plaintext. This metadata never includes any of the financial content listed above — your transactions, balances, and categories remain unreadable by Budgero.
Budgero Cloud records how the product is used so it can be improved and fixed: which features get used, where people get stuck, and what breaks. This is on by default, on the basis of legitimate interest (§4), and you can switch it off at any time (see below). Self-hosted Budgero sends no analytics or telemetry of any kind.
What is recorded:
Never collected: names of transactions, accounts, categories or payees, amounts, balances, dates, notes, the text of AI conversations or anything else you type into your budget, error message text, session recordings, automatic click capture (autocapture), heatmaps or surveys.
Switch it off: Settings → Security & Privacy in the app. The choice is saved to your account, applies on all your devices, and also stops the server-side events. Budgero works exactly the same with analytics switched off.
On the Budgero website, page views and clicks on buttons such as “Start free trial” are counted to understand how people find the product. Two tools are used, and neither stores anything on your device:
Self-hosted Budgero servers ask budgero.app whether a newer version exists, at most every 12 hours, sending only their version, build number and the word “selfhost”. We keep daily counts per version. To estimate how many installs are active, we also count distinct senders per week: the request’s IP address is hashed with a random key that exists only for the current week, and when the week ends only the weekly total is kept and the key and hashes are deleted. IP addresses are not stored. Server operators can turn the check off with UPDATE_CHECK_DISABLED=true.
Not collected: financial-account credentials (Budgero never receives your bank logins; optional bank-sync access keys are stored encrypted inside your budget), location data beyond IP-based country, contacts, photos, microphone, or any of the special categories of personal data listed in GDPR Art. 9.
For users in the EU/UK, Budgero identifies a lawful basis for each processing purpose under GDPR Art. 6:
| Purpose | Categories of data | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Provide the Budgero service (account creation, login, sync, vault storage) | Account data, encrypted vault data | Performance of a contract — Art. 6(1)(b) |
| Take payment and manage your subscription | Billing & subscription data | Performance of a contract — Art. 6(1)(b) |
| Send service emails (welcome, feedback check-ins, security, billing receipts) | Email + send/open/bounce metadata | Performance of a contract — Art. 6(1)(b); legitimate interest in keeping you informed about your account — Art. 6(1)(f) |
| Comply with tax, accounting, and other statutory obligations | Billing & subscription data | Legal obligation — Art. 6(1)(c) |
| Detect, investigate, and prevent abuse, fraud, and security incidents | Server logs, IP, account data | Legitimate interest in protecting the service and its users — Art. 6(1)(f) |
| Product analytics — understanding which features get used, where people get stuck, and what breaks | Pseudonymous analytics events and error reports from the app and the server (§3.5) | Legitimate interest in improving the product and fixing errors — Art. 6(1)(f). Events are limited to fixed values, contain no financial data or message text, and are kept for 6 months. On by default; you can object at any time in Settings → Security & Privacy or by email (see §10). |
| Website analytics — understanding how people find Budgero and which pages lead to sign-ups | Website statistics (§3.6) | Legitimate interest in understanding how people find Budgero — Art. 6(1)(f). Nothing is stored on your device, and PostHog stays off when your browser sends Global Privacy Control or Do Not Track. |
Where Budgero relies on legitimate interest, the balance between that interest and your rights has been considered. If you'd like to talk through the reasoning for any specific case, email privacy@budgero.app.
| Category | Retention |
|---|---|
| Account data (email, account ID, preferences) | For the life of your account, plus up to 30 days after deletion to allow for recovery and to flush backups |
| Encrypted vault data | For the life of your account; deleted within 30 days of account deletion (Budgero cannot read it at any point). Earlier encrypted copies of a workspace are kept for up to 7 days so a sync problem can be undone. |
| Billing records (orders, invoices) | Retained as required by applicable tax and accounting law (typically 5–10 years); after that, deleted |
| Service-email send/open/bounce metadata | Up to 90 days in the email provider, then deleted |
| Analytics events and error reports (app, server and website) | Up to 6 months in the analytics provider |
| Product-analytics person profiles | Up to 12 months of inactivity, then deleted |
| Server / security logs | Up to 30 days for routine operations; up to 1 year for entries flagged as security-relevant |
When you delete your account, the data above is deleted or anonymized on the schedules listed, except where Budgero is legally required to retain it (e.g. tax records).
Personal data is never sold or rented. Limited personal data is shared with the service providers listed below, who act on Budgero's instructions under written contracts (Data Processing Agreements where the provider offers them). Each provider's standard contractual terms are reviewed before they are added.
| Provider | Role | Personal data shared | Region |
|---|---|---|---|
| Clerk | Authentication and account management | Email, password (hashed), account ID | EU residency configured |
| PostHog Cloud EU | Product analytics | Pseudonymous events and error reports (§3.5, §3.6), IP address at request time, account ID | EU |
| LemonSqueezy | Payments and subscription billing | Email, billing address, plan, payment-instrument data | US (with SCCs) |
| Resend | Transactional email delivery | Email address, message content of service emails | EU / US (with SCCs) |
| Hosting provider | Application hosting and server logs | All data above transits or is logged here at the network level | EU |
Budgero may also disclose personal data to:
Some of the providers in §6 process personal data outside the European Economic Area — primarily in the United States.
For provider transfers outside the EEA (e.g. LemonSqueezy, Resend US region), Budgero relies on the provider’s European Commission Standard Contractual Clauses (SCCs, 2021 version) and equivalent UK addenda where applicable. Vault data remains end-to-end encrypted across all providers and is unreadable by anyone other than you.
Budgero uses no analytics, advertising or other non-essential cookies, and no third-party advertising scripts. Analytics store nothing on your device, so there is no cookie banner: only storage that is strictly necessary for the service is used, and under the ePrivacy rules that needs no consent. What is stored:
Important caveat: zero-knowledge means your vault cannot be recovered if you forget your password. Store it somewhere safe — a password manager is the standard answer.
Wherever you live, you can:
To exercise any of these, email privacy@budgero.app . Requests will be answered as fast as possible, and within 30 days as required by GDPR (extendable by up to 60 days for complex requests, with notice).
You can also lodge a complaint with a supervisory authority:
If you're a California resident, this section gives you additional disclosures required by the California Consumer Privacy Act, as amended.
Categories of personal information collected, mapped to the CCPA categories: identifiers (email, account ID, IP), commercial information (subscription plan), internet/network activity (analytics events, server logs), inferences (none). These are collected for the business purposes described in §4.
Sources: directly from you, from your device, and from service providers.
Disclosure for a business purpose: only to the service providers in §6.
Sale or sharing of personal information: Personal information is not sold or shared as those terms are defined in the CCPA. Budgero does not engage in cross-context behavioural advertising and runs no advertising tags or trackers. Analytics data is used only to improve Budgero, through its service provider PostHog.
Because nothing is sold or shared, no “Do Not Sell or Share My Personal Information” link is provided. You can still exercise the rights to know, correct, delete, and limit the use of sensitive PI by contacting privacy@budgero.app.
Sensitive personal information is not used or disclosed for purposes other than those identified in CPRA §7027(m).
You will not be discriminated against for exercising your rights.
Budgero is not directed to and may not be used by individuals under the age of 16, or under the local digital-consent age where it is higher. Personal data is not knowingly collected from children. If you believe a child has provided personal data, email privacy@budgero.app and it will be deleted.
This policy may be updated as the service or the law changes. The “Last updated” date at the top of this page will reflect the latest revision. For material changes affecting how personal data is used, you'll be notified by email before the change takes effect.