Privacy notice
1. Controller and contact
Controller: Tobiáš Štec, Brno, Czech Republic. MONEWI is currently his personal project; he is not operating as a company and business registration is being arranged. A full contact address and any applicable registration details will be added before public launch. Contact for privacy and rights requests: tobste58@gmail.com. A data protection officer contact will be added if appointment is required.
2. Data, purposes and legal grounds
- Account and service: email, account identifier, authentication data, profile information, settings, financial records, accounts, imports, budgets, goals, debts, portfolio and uploaded attachments according to the features you use. Processing necessary for the requested service relies on performance of a contract (GDPR Article 6(1)(b)).
- Shared features: membership, data and attachments added to a group, shares and settlements are available to authorised members to provide that feature. Community content is processed only where the relevant feature is available and used.
- Security, support and diagnostics: technical events, error categories, screen context and technical information needed to protect and repair the service; a bug report contains information you submit. The basis is our legitimate interest in a secure, functioning service (Article 6(1)(f)); you may object to this processing. These records serve a different purpose from optional product analytics.
- Contract records: the versions of the terms and privacy information and the time of acceptance/service, on the basis of our legitimate interest in evidencing the contractual relationship. Accepting the terms or acknowledging this notice is not consent to optional tracking.
- Optional product analytics: only with separate consent under Article 6(1)(a); see section 3. The choice, version and timestamp provide evidence of consent and respect for withdrawal (Articles 7(1) and 5(2)).
Only information needed for an account and the particular requested feature is required. Without it we may be unable to provide that feature. Declining analytics does not restrict service features. We do not use analytics for automated decisions producing legal or similarly significant effects.
3. Optional product analytics
If analytics is activated, a separate choice in Settings → My data → Optional usage analytics enables usage measurement to improve the interface: widget and S/M/L size popularity, page and tool use, selected labelled clicks and active use time on a visible page. Categorisation may record only permitted general identifiers for built-in categories; custom names and sensitive categories are excluded.
Events include the account identifier, random session and event identifiers, time, event type, permitted feature/widget/category identifier and, where relevant, size, device class (phone/tablet/desktop) and active time. They are personal data linked to an account, rather than anonymous visits. No analytics events are collected or queued before consent; measurement concerns signed-in users only.
Analytics events do not send amounts, balances, transaction descriptions, names, email, IBAN, custom category names, form or file contents, or screenshots. We do not put full URLs, link parameters, IP addresses, user-agent strings or device fingerprints into analytics records. We do not use session replay or advertising identifiers, or sell analytics data. We do not provide analytics to advertising networks; our own return reminders have a separate choice described below. Infrastructure providers technically receive an IP address when handling a network connection; their security logs are separate processing.
Consent is off by default, voluntary and separate from registration, the terms and any marketing. Declining has the same effect on service availability as allowing. You may withdraw at any time in the same place. Collection stops, the unsent queue is cleared and, once the server successfully processes withdrawal, it deletes your raw analytics events. Without a connection, server withdrawal must be completed when connectivity returns. Withdrawal does not affect the lawfulness of earlier processing.
The administrator report shows summaries with small groups suppressed, rather than an individual timeline. This restriction alone does not guarantee anonymity. Raw events are used for no more than 90 days; deletion must be operationally verified before activation. The current choice, timestamp and version remain while the account exists; earlier choice records remain for no more than 90 days after replacement. Extended reports and their separate retention limits are described below.
Extended analytics version 2026-11-01.2 adds only permitted transaction, import and goal workflow steps (such as start, review, completion or cancellation) to compare completion and abandonment. It records the first observed day of voluntary measurement and subsequent active days. D1/D7/D30 returns mean activity exactly 1, 7 or 30 days after that observation, rather than registration; earlier periods are not backfilled. Timing information may include usage day and hour. Extended measurement requires fresh consent; an earlier choice is not automatically carried over.
The first observed day remains account-linked only while analytics consent is valid, even after older raw events have expired. Raw events, activity days and workflow steps have a maximum operational retention of 90 days. A protected weekly administrator summary is kept for up to 12 weeks; withdrawal invalidates stored weekly summaries, which may be regenerated from the remaining permitted data.
Longer aggregate history is separately blocked pending a reidentification risk assessment and approval of irreversible release. The prepared process uses only closed UTC calendar months, bounded contributions, at least 20 contributors for each of three broad metrics, and count bands instead of exact values. It has no account identifiers or freely combinable filters. Released monthly reports are immutable and kept for 13 months. These restrictions alone do not prove anonymity. Publishing remains off until the assessment is accepted. Any future release without account lineage cannot later be split into individual contributions; this text alone does not authorise activation.
Optional return reminders
Return reminders have their own consent version 2026-11-03 in Settings → Notifications → Return reminders. They encourage renewed use of MONEWI and may constitute direct marketing. They are separate from actual financial due dates, budget warnings and group messages, and are off by default. Push delivery is a separate channel choice; browser permission or existing security notifications do not replace this consent. The first version uses only the app and permitted push, rather than engagement email.
You separately choose four automatic prompts: returning after a break, a question about today’s records, a weekly prompt about recorded categories, and checking a confirmed income window. An older consent does not enable new types. All types share a limit of 1 or 2 messages per rolling 7 days, at least 24 hours apart. A newly enabled type waits at least 24 hours. Eligibility is checked daily; messages are not necessarily sent daily.
History for an income-window proposal is processed only after your explicit request in settings. A proposal needs Výplata category records in at least 3 different completed months out of the last 6; it does not identify an employer or confirm a bank payment. You confirm the account scope, days and first month once. Missing records are then checked automatically after the window ends; an actual income record cancels the prompt. This is a limited inference about a financial habit for your chosen purpose, not credit scoring. Private category recaps use actual records only; push contains no category or account names, amounts or income window. We do not send email for this purpose. The sender contact is MONEWI · tobste58@gmail.com.
After consent we keep one last-active timestamp to assess the break, your choices (3/7/14 days, a fixed hour from 08:00–20:00, at most 1 or 2 reminders per week), an IANA time zone and your current app language. Last activity updates only while the app is actively visible, without history or reuse of security logs. Fixed timing works without analytics. Quiet hours 22:00–08:00 take priority; you can pause for 7 or 30 days or turn reminders off using one control.
Adapting the hour and tool is another separate optional choice. It requires both valid analytics consent and reminder consent. This is profiling of usage habits under GDPR Article 4(4), rather than assessing finances, creditworthiness or health. Events since that consent within the last 28 days identify a more frequent local hour; a day has at most one vote per hour. An estimate appears only with at least 5 distinct days and a winning hour on at least 3 days. Ties favour the hour nearest your fixed hour, then the earlier hour. Only when the estimate is ready may the most recently visited permitted general tool be selected. Otherwise, fixed timing and general content are used. No separate permanent hour profile is stored; you can disable adaptation. These are not decisions with legal or similarly significant effects.
The legal basis for reminders and adaptation is your respective consent under Article 6(1)(a). You can withdraw or object to direct marketing, including related profiling, at any time and free of charge; those purposes must then stop. Successful server withdrawal clears last activity, adaptation, operational delivery records and the relevant in-app notifications. Ordinary delivery records have a maximum operational retention of 90 days. Technical push delivery involves the browser/device's push intermediaries and technical delivery identifier.
Separate statutory evidence: minimal proof of marketing consent and its withdrawal, and the withdrawal confirmation, are kept for 4 years after withdrawal where applicable law requires this, or for proportionate evidence of rights. This protected evidence may survive account deletion; it contains a pseudonymous reference, purpose, version, time and state, rather than financial amounts, transaction text or usage history. Withdrawal is confirmed without promotional content, with an unchanged confirmation available to save as TXT. Delivery remains blocked until sender identity, retention and adequate provision of confirmation have been verified. Other activation requirements remain applicable.
After opt-out, minimal type/period keys may remain for up to 90 days and delivery reservations for 7 days to prevent re-enabling from bypassing limits or repeating a prompt. They contain no amounts or transaction text and are not used for further sending. Account deletion removes these operational keys. Evidence of a confirmed rule contains only necessary scope and timing, rather than transaction history or financial amounts.
Age and consent
The service is intended for ages 16 and above. Enabling analytics requires confirmation that you are at least 16; we store that confirmation, time and information version, rather than a date of birth or identity document. Consent must still be freely given and understandable for users aged 16–17. Contractual capacity is a separate issue explained in the terms.
4. Device storage
The app uses localStorage, sessionStorage and cache for authentication, sign-in redirects, requested settings and app operation. The scope depends on the features used. Continuing to use the service does not start optional measurement. Analytics events wait only in the open app's memory after consent; no persistent analytics cookie or device fingerprint is created. Clearing browser storage does not withdraw consent held with the account.
5. Recipients and transfers
Infrastructure is provided principally by Supabase (database, authentication and files, including optional analytics) and Vercel (hosting). Depending on the enabled feature, recipients include Resend (email), Cloudflare Turnstile (abuse protection), Google sign-in, market data providers, and payment or banking integrations. Optional AI categorisation may send transaction information to Anthropic only through an available, requested feature; this is separate from product analytics.
Google sign-in supplies email and a basic profile; we do not request access to contacts, Drive or Calendar. Use of Google API information is subject to the Google API Services User Data Policy, including Limited Use.
To be completed before public launch: exact recipient legal entities and roles, locations, subprocessors and applicable contractual safeguards. Transfers outside the EEA require an applicable GDPR Chapter V mechanism, such as an adequacy decision or standard contractual clauses with necessary assessments and measures. Analytics consent does not replace those safeguards. Authorities may receive data where required by law.
6. Retention, deletion and export
Account information and financial records are kept while the account is used or until deletion. Specific periods and any statutory exceptions for diagnostics, support, operational audits and backups must be completed before public launch; this draft does not confirm their complete configuration. An account deletion record may retain the original account identifier and is not automatically anonymous.
In Settings, after identity confirmation, you can request account deletion or download your own data in JSON format. Deletion removes owned records and files, including analytics and its preferences. Shared expenses and shares needed by other members may remain labelled “Deleted account”; context may still make these records identifiable. Separate statutory audits and backups require their own retention and restoration safeguards. Do not assume every backup copy is immediately erased.
7. Your rights and changes
Subject to GDPR conditions, you have rights of access, rectification, erasure, restriction and portability, to object to legitimate-interest processing and to withdraw consent. We normally address a request within one month; a justified extension is possible under the law. You may complain to an authority where you live, work or where an alleged infringement occurred, for example the Slovak data protection authority or Czech data protection authority. Contact: tobste58@gmail.com.
Changes carry a new document version. A new purpose or materially expanded optional measurement requires fresh consent before it starts. Updating privacy information alone does not mean consent to all processing.