Privacy Policy

Last Updated: November 14, 2026

At Budget Sense, we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and safeguard your information when you use our application or website (the "Service").

1. Data Controller

Budget Sense is an independently developed and operated service. For the purposes of the EU General Data Protection Regulation (GDPR) and applicable data protection laws, the Data Controller responsible for your personal data is Dimitar Todorov, developer and operator of Budget Sense, based in Sofia, Bulgaria.

You can contact the Data Controller at: team@budgetsense.app

2. Information We Collect

Account Information: When you create an account, we collect your display name and email address. If you set a password, it is securely hashed and is not stored in plain text. A Budget Sense password is optional when you register with Google.
Google Sign-In (Optional): If you choose Google Sign-In, we receive your email address, email verification status, name, profile picture URL if available, and a unique Google account identifier. Google may also provide your Google Workspace domain. We use these details to create or link your account, authenticate you, populate your profile, and confirm sensitive actions such as account deletion. We store the Google identifier with your account and may store the name and picture URL in your profile. Verification details may be held temporarily while the sign-in flow is completed. We never receive your Google password. We request offline access to receive a longer-lived refresh token, which we use to request revocation after the account-deletion grace period without requiring you to sign in again. We store that refresh token and the latest short-lived access token in encrypted form, along with the access token expiry. These credentials are used for revocation, not for background access to other Google services or to keep your Budget Sense session signed in. They are retained until replaced or removed with the linked identity during account deletion. Google may expire or revoke the credentials; we try the refresh token first and use the access token as a fallback if Google reports the refresh token invalid. If Google reports the available tokens expired or already revoked, account deletion can proceed. This does not guarantee removal of the connection displayed in your Google Account settings, where you can also remove it yourself. A later sign-in may require consent again. If revocation cannot complete because of other technical errors, account deletion remains pending and is retried; the account data and credentials are retained until deletion can complete. We do not request access to Gmail messages, Google Drive files, or contacts. We do not send your budgeting or financial entries to Google as part of this sign-in flow.
User-Input Financial Data: We store the numerical entries, categories, transaction names, budget parameters, and other information you manually enter into the Service in order to provide budgeting, reporting, and tracking features.
Location Data (Optional): When adding a transaction, you may choose to attach GPS coordinates (precise location) to that transaction. Location data is collected only when you choose to use this feature and grant the required location permission on your device. Disabling location permission prevents future collection of location data but does not remove coordinates already attached to existing transactions. If you wish to remove previously stored location data, you can contact us at team@budgetsense.app.
Technical & Application Data: We may automatically collect limited technical information when you use the Service, such as IP addresses, request timestamps, error information, and application logs. This information is used to maintain the security, reliability, and performance of the Service and to diagnose technical problems.
Aggregated Usage Statistics: We collect anonymous, aggregated statistics about how the Service is used, such as the number of registrations, sign-ins, or interactions with certain features. These statistics are not linked to individual users, accounts, sessions, IP addresses, or other identifiers and are used to understand overall usage and improve the Service.

3. How We Use Your Data

To create and maintain your account and provide the core features of Budget Sense.
To store and process the financial and budgeting information you choose to enter into the Service.
To attach geographical information to transactions when you choose to use the optional location feature.
To authenticate your identity during login and help prevent unauthorized access.
To maintain the security, reliability, and performance of the Service and diagnose technical problems.
To analyze anonymous, aggregated usage statistics and improve the functionality and usability of the Service.
To send service-related emails and respond to support requests or communicate important updates.
No Data Sales: We do not sell, rent, or trade your personal, location, or financial data to third parties or advertisers.

4. Legal Basis for Processing

Under the GDPR, we process personal data only where there is an appropriate legal basis for doing so. Depending on the purpose, we rely on the following legal bases:

Performance of a Contract: We process your account information and the information you enter into Budget Sense as necessary to create and maintain your account and provide the features of the Service that you request. This includes Google profile and identity details when you choose Google Sign-In to register, link, or access your account.
Legitimate Interests: We process limited technical and application data where necessary for our legitimate interests in protecting the Service, preventing abuse, maintaining security and reliability, diagnosing technical problems, and improving the Service. We do so only where those interests are not overridden by your rights and freedoms.
Consent: We process precise location data only when you choose to attach it to a transaction and grant location permission through your browser or device. You can disable this permission through your browser or device settings to prevent future collection. To withdraw your consent to the processing of previously stored location data and have those coordinates deleted without deleting your transactions or account, contact us at team@budgetsense.app. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

5. Service Providers & Data Recipients

Budget Sense is self-hosted and does not use a third-party hosting provider to store its main application database. We use a limited number of third-party services where necessary to operate and secure the Service.

Cloudflare: We use Cloudflare for network security, performance, and protection against malicious traffic. Cloudflare may process technical information such as IP addresses and request information when you access Budget Sense.
Resend: We use Resend to deliver service-related emails, including account and authentication messages. Resend processes information necessary to deliver these messages, including the recipient's email address, the content of the email, and email delivery information.
Google: If you choose Google Sign-In, Google authenticates your Google account and shares the profile and identity details described above. Google may process technical information, such as your IP address, browser information, and authentication activity, under its own Privacy Policy. You can manage or revoke the connection through your Google Account settings. Revoking Google access does not itself delete your Budget Sense account or information already stored by us; use account deletion or contact us to request deletion.

These service providers process personal data only as necessary to provide the services we use to operate Budget Sense. We do not sell personal data to these providers.

6. International Data Transfers

Budget Sense is operated and primarily stores its application data in Bulgaria. However, some third-party service providers used to operate the Service, including Cloudflare, Resend, and Google, may process limited personal data outside the European Economic Area (EEA), including in the United States.

Where personal data is transferred outside the EEA, appropriate safeguards are used in accordance with applicable data protection law. Depending on the provider and transfer, these safeguards may include the EU-U.S. Data Privacy Framework and Standard Contractual Clauses approved by the European Commission.

Further information about the safeguards applicable to these providers is available in Cloudflare's Data Processing Addendum and Resend's Data Processing Addendum. Google's own processing and international transfer practices are described in its Privacy Policy.

7. Data Storage & Security

Password & Data Security: User passwords are securely hashed using industry-standard password hashing algorithms. We use HTTPS to encrypt data transmitted between your device and our servers and implement technical and organizational security measures designed to protect stored information against unauthorized access.
No Direct Bank Access: Budget Sense does not connect to, access, or synchronize with bank accounts, credit cards, or other financial institutions. We do not require or request online banking credentials, passwords, PINs, full credit or debit card numbers, or other authentication credentials in order to use the Service. You should not enter such sensitive information into transaction names, notes, or other user-input fields.
Cookies & Local Storage: We use strictly necessary session tokens and local storage solely for authentication, security, and language preferences. We do not use tracking or advertising cookies.
Backups: We maintain periodic database backups for service recovery and disaster recovery purposes. Backups are retained for up to 30 days and are not used for normal operation of the Service.

8. Data Retention

We retain your account details and user-entered data for as long as your account remains active. If you delete your account, your personal data and financial entries are removed from the active database. This includes the linked Google account identifier and Google profile details stored by Budget Sense. Deletion takes effect after the applicable account-deletion grace period. For Google-linked accounts, technical errors during revocation can delay deletion beyond that period while we retry, as described above. Backup retention is described below. Deleting your Budget Sense account does not delete your Google account.

Server Logs: Technical server logs used for security, diagnostics, and service reliability are generally retained for up to 14 days.
Application Logs: Application logs used for troubleshooting, security, and service reliability are generally retained for up to 90 days.
Database Backups: Backup copies may contain personal data that has subsequently been deleted from the active database. Backups are retained for up to 30 days, after which they are automatically deleted or overwritten. Backup data is retained only for recovery and disaster recovery purposes and is not used for normal operation of the Service.
Aggregated Statistics: Anonymous aggregated usage statistics that cannot be linked to an individual user, account, session, IP address, or other identifier may be retained for statistical and service improvement purposes.

9. Your Rights Under GDPR

Depending on the circumstances and the applicable legal basis, you may have the following rights regarding your personal data:

Access: The right to request information about the personal data we hold about you and obtain a copy of that data.
Rectification: The right to request correction of inaccurate or incomplete personal data.
Erasure (Right to be Forgotten): The right to request deletion of your personal data in applicable circumstances. You can delete your Budget Sense account through the application or contact us for assistance. Data is removed from active systems, although residual copies may remain temporarily in backups for up to 30 days.
Restriction: The right to request restriction of processing in certain circumstances.
Data Portability: The right, where applicable, to obtain personal data you have provided to us in a structured, commonly used, machine-readable format.
Objection: Where processing is based on legitimate interests, you may have the right to object to that processing.
Withdrawal of Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

To exercise any of these rights, contact us at team@budgetsense.app.

10. Changes to This Policy

We may update this Privacy Policy periodically. Any updates will be posted on this page with a revised "Last Updated" date. Where changes materially affect how we process your personal data, we will provide appropriate notice through the Service or by email.

11. Contact & Complaints

If you have questions about this Privacy Policy or wish to exercise your data protection rights, you can reach us at:
team@budgetsense.app

You also have the right to lodge a complaint with the Bulgarian supervisory authority:
Commission for Personal Data Protection (CPDP) in Sofia, Bulgaria.

Take control of your financial future.

Meet Milo

Welcome Back

You're offline