Privacy policy

Last updated: 08/11/2026.

What is stored

• Your account: your email address, and while you change it, the new address until you confirm it; a hash of your password, never the password itself; when you link Google, the Google account's identifier and email address; for two-factor authentication, your authenticator secret, encrypted, and hashes of your recovery codes; when you accepted these terms, created the account and last signed in.
• Your data: the invoices and the settings you enter.
• Sessions: for each signed-in device, its IP address and browser user agent, when it signed in and when it was last seen.
• Access requests and invitations: the email address of someone who asks for access or is invited, and when.
• Security records: counters of recent attempts, used to limit them, keyed by IP address, by account, or by a hash of an email address, never the address itself; and, when Amazon SES reports that email to an address bounced or was marked as spam, that address with the reason and the date.
• The web server's access log: the IP address, time, page and status of each request, without query strings.
• Admin actions: when an admin changes, disables or deletes an account or invites an address, who did it, to which account or address, and when. These records never hold passwords, invoices or amounts.

Why

To run your account and compute your numbers; to keep accounts secure with sessions, attempt limits, two-factor authentication and the record of admin actions; and to send the emails your account needs: confirmations, password resets and security notices. There is no advertising, no analytics and no tracking, and no data is sold or shared for marketing.

Who else handles it

The data is stored in a MongoDB database run by the operator of this service or its hosting provider. Email is sent through Amazon Simple Email Service, a service of Amazon Web Services. If you choose to sign in with Google, Google confirms your identity and tells this service your Google account identifier and email address. The pages load no scripts, fonts or images from other sites.

Cookies

Only the cookies the service needs: one that keeps you signed in, and short-lived ones while you confirm your email, sign in with Google or enter a two-factor code. No tracking cookies.

How long it is kept

• Your account, invoices and settings: until you delete your account.
• Accounts whose email is never confirmed: deleted with their data 14 days after creation.
• Sessions: end after 30 days without use, and at most 90 days after sign-in.
• A new email address waiting for confirmation: 24 hours.
• Invitations: 14 days.
• Access requests: kept until an account with that address is deleted, or until you ask for its removal.
• Links sent by email: expire after between one hour and 14 days, depending on their purpose.
• Attempt counters: at most two hours.
• Records of Amazon SES notifications: 30 days.
• The web server's access log: as long as the operator of this service sets, and then it is deleted.
• Admin actions: one year after each action, also after the account it concerns is deleted, so that it stays clear who changed or deleted which account.
• Addresses that bounced or were marked as spam: kept, so that no email is sent again to an address that refused it.

Your rights

Under Argentina's Personal Data Protection Law (Ley 25.326) you can access, correct and delete your data. In the app you can download your data with "Download everything as JSON" on the Categories page, correct your invoices and settings where you entered them, change your email address on the Account page, and delete your account and all its data on the Account page. For anything else, including the removal of an access request, contact [email protected].

The Agencia de Acceso a la Información Pública, the authority that enforces Ley 25.326, handles complaints and claims about the processing of personal data.

Security

Passwords are hashed with scrypt; session tokens, email links and recovery codes are stored only as hashes; authenticator secrets are encrypted; and the service is served over HTTPS.

Contact

Questions about this policy: [email protected].