Privacy policy

Effective from 31/10/2026

This translation is for information only. If there are differences, the Slovene text prevails.

This page explains what data we process, why, for how long, and what rights you have under the General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).

1. Controller

Provider: UniCode, programske rešitve in programiranje, Sebastian Novak s.p. (hereinafter UniCode s.p.)
Registered office: Štihova ulica 13, 1000 Ljubljana
Registration number: 9021817000
Tax number: 64110273
Email: info@unicode.si

We have not appointed a data protection officer, as we are not required to under Article 37 GDPR. For any questions, write to the email address above.

2. What data we process and why

Data

Purpose

Legal basis (GDPR)

Data: Name, email, hashed password, settings, date and version of accepted terms

Purpose: Creating and managing your account, proof of accepting the terms

Legal basis (GDPR): Performance of a contract, Article 6(1)(b)

Data: Financial data you enter or import: accounts, transactions, categories, loans, cards, investments, plans, money lent, names of people you have entered

Purpose: Display, calculations and forecasts in the app

Legal basis (GDPR): Performance of a contract, Article 6(1)(b)

Data: Group data: members, shared expenses, income you share, settlements

Purpose: Sharing expenses with people you invite

Legal basis (GDPR): Performance of a contract, Article 6(1)(b)

Data: Email address of the invited person

Purpose: Sending the group invitation

Legal basis (GDPR): Legitimate interest of the invited and inviting persons in using the group, Article 6(1)(f)

Data: IP address and browser details for the session, list of signed-in devices

Purpose: Account security, reviewing and revoking sessions, preventing abuse

Legal basis (GDPR): Legitimate interest in the security of the service, Article 6(1)(f)

Data: Only if you turn on AI: encrypted API key and the data you send to the AI provider

Purpose: Assistant, entry in words, monthly summary, recurring entry suggestions

Legal basis (GDPR): Your consent, Article 6(1)(a)

Data: Files you upload: receipts, warranties and other documents, and the receipt text when it is read

Purpose: Storing documents with transactions, basic OCR on our server

Legal basis (GDPR): Performance of a contract, Article 6(1)(b)

Data: Only if you turn it on: the encrypted two-step sign-in secret and hashed recovery codes

Purpose: Extra protection for sign-in

Legal basis (GDPR): Performance of a contract, Article 6(1)(b)

Data: Only if you turn them on: your device's push notification address

Purpose: Due date notifications

Legal basis (GDPR): Performance of a contract, Article 6(1)(b)

Data: Business plan only: subscription details and your Stripe customer ID, company and issued invoice data

Purpose: Concluding and running the subscription, accounting obligations

Legal basis (GDPR): Performance of a contract, Article 6(1)(b), and legal obligation, Article 6(1)(c)

Data: Only if you consent: an online identifier, public pages visited, device, approximate location

Purpose: Measuring visits to public pages with Google Analytics; never inside the app

Legal basis (GDPR): Your consent, Article 6(1)(a)

Data: Only if you create one: an MCP token or connection

Purpose: Reading data in a tool you choose

Legal basis (GDPR): Performance of a contract, Article 6(1)(b)

We do not sell your data or use it for advertising or to train AI models. We have no access to your bank. An Excel file is processed in memory during import and is not stored; only the imported entries remain.

We do not collect special categories of personal data under Article 9 GDPR. Do not enter them in notes.

3. Do you have to provide data

Your name, email and password are needed to conclude the contract; without them an account cannot be created. Everything else you enter by choice. AI and MCP are optional, and the app works fully without them.

4. Who receives data

Hosting and database: own server in Slovenia.
Sending email: Neoserv (Slovenia) or Resend, Inc. (USA) (processor).
Members of your group see your name, email and the data you share in the group. They do not see your other data.
AI provider, Anthropic PBC (USA), only if you turn on AI, see section 5.
Stripe, only if you buy the Business plan: it processes the payment under its own rules, and we do not receive card details.
Your browser's provider (e.g. Google, Apple or Mozilla), only if you turn on notifications: it delivers an encrypted notification with no amounts.
Google Ireland Limited and Google LLC (Google Analytics, Google Tag Manager), only if you consent to analytics (processor).
Public authorities, where the law requires it.

Account data is stored in Slovenia. It leaves the EU only when AI is on, when email is sent through Resend, and for analytics if you consent. For Resend the transfer relies on the EU-US Data Privacy Framework and standard contractual clauses, and for Google on the mechanisms in its data processing terms.

For automatic prices, our server sends Yahoo Finance and Frankfurter only security tickers and currencies, with no data about you. Images on the home page are fetched by the server from Unsplash, and your browser receives them from us.

5. AI assistant and transfer to the USA

AI is off by default. Once you connect your API key, you turn on each feature separately and can see in settings what would be sent. When you use a feature that is on, the data needed for the answer is sent through our server to Anthropic PBC in the USA, under your account with that provider:

assistant: your question and the financial data needed to answer it (e.g. transactions, balances, loans, investments, groups),
entry in words: your text and the list of accounts and categories,
monthly summary: calculated amounts and category names,
recurring entry suggestions: names and notes of repeating expenses, amounts and dates,
reading a receipt: the receipt photo or PDF and your list of categories.

Because the data leaves the EU, the USA may offer a lower level of data protection than the EU. The transfer is based on your explicit consent under Article 49(1)(a) GDPR and your contract with the provider. You conclude that contract yourself, so the following also apply: its terms and retention rules. The provider states that it does not use API data to train models and generally deletes it within 30 days, except in the cases set out in its rules.

You can withdraw consent at any time in settings by removing the key. Withdrawal does not affect the lawfulness of earlier processing. We store the encrypted key until you remove it, and the written monthly summary in cache for up to 7 days or until your data changes. Conversations are not stored with us.

6. How long we keep data

Data

Retention period

Data: Account, financial data and uploaded files

Retention period: For as long as you have an account. Deletion in settings removes them from the live database immediately.

Data: Cookie choice (random identifier, no IP address)

Retention period: 2 years, as proof of consent.

Data: Analytics data at Google

Retention period: Up to 14 months.

Data: Payment and issued invoice data

Retention period: As long as tax and accounting rules require.

Data: Backups

Retention period: Up to 30 days, then deleted. Deleted data remains in backups during this time but is not used.

Data: Sessions (IP, browser)

Retention period: Up to 30 days from last use; revoked sessions a further 7 days.

Data: Rate limiting (IP in cache)

Retention period: Up to 1 hour.

Data: Group invitations

Retention period: Until the invitation expires, plus 30 days.

Data: MCP tokens

Retention period: Until expiry or revocation, plus 30 days.

Data: Technical application logs

Retention period: They contain no IP addresses. They are overwritten by size, expected within a few weeks.

If you exercise a right under the GDPR, we may keep the data concerned until the procedure ends (Article 21 of ZVOP-2). We keep data longer only where the law requires it.

7. Your rights

Access and portability (Articles 15 and 20): in settings you can export all your data as JSON.
Rectification (Article 16): you edit your data in the app; let us know by email if you want to change your email address.
Delete (Article 17): you delete your account in settings.
Restriction of processing (Article 18) and objection to processing based on legitimate interest (Article 21): write to us.
Withdrawal of consent (Article 7(3)): you can turn AI off in settings at any time, with no effect on other features.

We reply to requests without undue delay and within one month at the latest. Exercising your rights is free.

Complaint to the supervisory authority: Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, phone +386 1 230 97 30, www.ip-rs.si.

8. Automated decision-making

The app automatically analyses your data to show you calculations, forecasts and alerts, for example about price rises or unusual spending. Only you see this and it has no legal or similarly significant effects, so it is not decision-making under Article 22 GDPR. AI suggestions are only an aid; you decide on every entry.

9. Security

The connection is encrypted with TLS, passwords are hashed with Argon2id, API keys are encrypted with AES-256-GCM, and tokens are stored in the database only as hashes. If a security breach put your rights at risk, we would notify the Information Commissioner and you, as required by Articles 33 and 34 GDPR.

10. Minors

The service is intended for people aged at least 18 years. If you learn that a younger person has created an account, write to us and we will delete it.

11. Changes

We notify you of material changes in the app or by email before they take effect. The effective date is at the top of the page. Cookies are described on a separate page.