Privacy policy

The short version

• Your account and budget: we handle your username, display name, authentication information, workspace membership, and the financial records you or other workspace members enter. Registration does not ask for an email address.
• Private information: budgeting data can be sensitive. Descriptions, receipt images, and other free text can reveal more than the structured fields request. Avoid unnecessary personal details and never put banking passwords in your budget.
• Why and with whom: we use information to provide and secure the service, synchronize changes, respond to you, and meet legal duties. Shared workspace members see shared records; infrastructure and communication providers process information needed for their services. Legal grounds depend on the purpose and applicable law.
• Other sources: workspace members can enter information about you. A currency-rate service supplies exchange-rate data.
• Storage and deletion: the app keeps offline copies. Deleting an expense hides it from ordinary views but does not erase its stored row or all synchronization history. The authenticated account-deletion page immediately deletes the account and private budgets; shared budgets remain for their other members with account attribution removed.
• No advertising features: the current Services do not sell personal information, use it for targeted advertising, or include third-party advertising or analytics tools.
• Your choices: rights depend on the law that applies. You can use the account-deletion page or contact us about access, correction, deletion, or other privacy concerns. Security measures reduce risk but cannot guarantee that information will never be accessed or disclosed without authorization.

1. Information we handle

Account and authentication information

Creating an account requires a username, display name, and password. We store your username, display name, internal account identifier, account status, preferred display currency, and creation time. The server stores a password hash, not a readable copy of your password. Authentication also involves session credentials; server session records store a hash of the session token and associated account and timing information.

You do not have to create an account to read the public website. Without the required account information, we cannot provide an authenticated account. You can update your display name and display currency in the app and change your password. For other account corrections, contact us.

Budget and workspace records

We handle workspace names and timezones, memberships and invitations, incomes, category and subcategory names, allocations, estimates, recurring and split-payment plans, expense dates, amounts and currencies, exchange rates and their provenance, descriptions, receipt images, and identifiers and timestamps recording who created or changed a record. The app calculates budget totals and available spending from these records. It does not connect to your bank or require bank-login credentials or payment-card numbers.

You decide which financial records to enter. Required fields are needed for the particular action, such as recording an expense; descriptions and receipt images are optional. Images you select are normalized on your device and uploaded as JPEGs with image metadata removed. The visible image can still contain personal information. Receipt images are stored by Budget Lightly, not sent to an AI receipt-processing service. Other authorized workspace members can add or change shared information, including information about you. Check entries for accuracy and use the available editing controls or contact us to correct a problem.

Content policy, blocking and moderation

We store the version and time of your acceptance of the user content policy. Blocking records identify the blocking and blocked accounts and the time of the block; blocking withdraws the blocker from shared budgets. Reports record the reporter, budget, reported target, reason, details and submission time, together with a retained snapshot of the reported content and context and, where applicable, a receipt image. Moderation records include the handling administrator, decision, review notes and resolution time, and any budget restriction or account suspension.

Support and technical information

If you email or write to us, including to ask about Budget Lightly, we receive your contact details, the content you send, and any attachments. This is separate from account registration. Do not send passwords, session tokens, or a complete financial history in an ordinary support email.

Connections to the Services expose network and request information to the serving infrastructure, such as IP address, requested URL, time, response status, and browser or client information. Access and error logs can record this information for operation and troubleshooting. The application also keeps synchronization identifiers, change records, pending commands, and error details needed to coordinate updates across devices. These operational records are not an advertising or cross-site browsing profile.

Sensitive information and device access

Financial records are private even when they are not a legally defined “sensitive” category. Account-access information can receive additional legal protection. We do not ask for racial or ethnic origin, religious beliefs, sexual orientation, health information, or similar special-category information as profile fields. However, a category name, note, or support message could reveal such details. Include only information needed for your budget and that you are entitled to provide about others. Additional lawful conditions, including specific consent where required, are necessary for processing legally protected sensitive information; this policy alone does not provide that consent.

The current Android app requests internet access. It does not request location, contacts, camera, microphone, or notification access, and Budget Lightly does not currently send push notifications. You can inspect the permissions available for an installed app in your device settings. Copying an invitation or a pending-change recovery file places that information on your clipboard at your request.

Exchange-rate providers return currency metadata and rates. Those responses do not supply a personal profile about you.

2. How we use information

• Provide the service: create and authenticate accounts, manage sessions and preferences, maintain workspaces, calculate budgets and currency conversions, record expenses, and synchronize your changes.
• Communicate with you: answer inquiries, support requests, and privacy requests and provide necessary service or security information.
• Maintain and protect Budget Lightly: diagnose errors, resolve conflicting updates, prevent duplicate commands and unauthorized access, investigate misuse, and make service improvements based on reported problems. The current app has no separate analytics or crash-reporting SDK.
• Enforce content rules: check current policy acceptance before publishing, enforce blocks and shared-budget access limits, review reports and retained evidence, and record and apply moderation decisions. This processing supports the user content policy, rather than advertising or paid content promotion.
• Meet legal responsibilities: respond to valid legal requirements and, where necessary and lawful, establish, exercise, or defend legal claims.

We do not use your budget to determine creditworthiness, insurance, employment, or eligibility for essential services. The Services do not currently make solely automated decisions with legal or similarly significant effects. We do not run a survey, contest, or event-registration program through the app.

Before using information for a materially different purpose, we will provide the information required by applicable law and obtain specific consent when that law requires it. An update to this notice is not itself consent.

3. Legal grounds

Which legal rules apply depends on the operator's activities, your location, and the processing involved—not just whether the website is accessible in a country. Different laws use different legal grounds.

Where the EU or UK GDPR applies: necessary account, budgeting, workspace, and synchronization processing supports performance of the service you request, or steps you ask us to take before providing it. Necessary service-security, misuse-prevention, troubleshooting, and legal-defense processing can be based on our legitimate interests in a reliable, secure service and protecting legal rights, only where those interests are not overridden by your rights. Compliance with a binding legal duty is based on that duty. Optional processing for which consent is required depends on a separate, informed choice. We do not rely on a routine “vital interests” or public-authority purpose for this budgeting app.

Where Canadian privacy law applies: consent must be meaningful and appropriate to the information and purpose. It may be express or implied where the law permits; sensitive, unexpected, or materially risky processing calls for express consent. You can withdraw consent subject to applicable legal or contractual limits and reasonable notice. We will explain relevant consequences. Narrow statutory exceptions, such as a valid court order or a qualifying safeguarded business transfer, are not permission for unrelated use of your budget.

Where Taiwan's Personal Data Protection Act applies: collection and processing must have a permitted ground, such as a contractual relationship with the required safeguards or valid consent, and use must stay within the necessary scope of the stated purpose unless a legal exception applies. The data categories, purposes, recipients, retention criteria, choices, and consequences of not providing information are explained in this notice.

Where Swiss data-protection law applies: processing is subject to its requirements of legality, good faith, proportionality, transparency, purpose limitation, and security. Swiss law is not simply the EU legal-basis list. Applicable consent and other justification requirements must be met in the circumstances.

4. Sharing and service providers

Workspace members. Authorized members can view and edit shared budget and expense records, including person-assigned categories and saved history, and can see receipt images where visible in the app. Assigning a category groups it under a member; it does not make the category private. Members can also see each other's usernames and display names. Anyone who possesses a valid invitation link can preview the workspace name and choose to join with this shared access, even if the link was forwarded to them. Links expire and can be used once to add a member. Treat links as private; revoking a link prevents its future use but does not remove members who have already joined. Access remains subject to the app's blocking and moderation safeguards. We cannot retrieve copies another member has already made.

Report review. Retained report evidence, including receipt snapshots, is available through administrator-only review controls, not a public image link or an ordinary member report queue. Matthew Scholefield is the current responsible moderator. Reports are not anonymous to the administrator: the reporter's account identifier is retained with the report.

Infrastructure and communications. Our application servers, database, and managed backups and logs are hosted by InterServer in the United States. InterServer processes information as needed to provide hosting and related infrastructure services. Support email at budget-lightly@vidivize.com is received and sent through Zoho Mail, which processes message addresses, content, attachments and delivery information. A provider processing information on our behalf must be subject to the restrictions and contractual protections required by applicable law. This does not mean every provider acts only as our processor for all of its own operational information.

Currency rates. The backend currently uses Frankfurter at api.frankfurter.dev to request currency metadata and currency-pair/date rates over HTTPS. These requests do not include your username, account or budget identifiers, expense descriptions, receipt images, or expense amounts. The provider and its serving infrastructure can still receive the server's network/request information. This notice does not promise a particular retention period for that provider.

Web rendering resources. The web app loads Flutter rendering-engine and fallback-font files from Google's www.gstatic.com and fonts.gstatic.com over HTTPS. These requests expose network and browser request information to Google, but do not send your budget text, financial amounts, receipt bytes, or Budget Lightly authentication credentials. They provide rendering resources, not an app analytics or advertising feature. Provider-held request information is subject to the provider's retention practices, not account deletion.

Support automation. Voxellum, the operator's AI support service, is still being developed and is not currently deployed for Budget Lightly. Before enabling it or sending support correspondence to an AI provider, we will update the applicable provider, processing and retention disclosures and satisfy any required notice or consent conditions. Receipt uploads do not enable AI support processing.

Legal and safety needs. We may disclose information where required by a valid legal process or law, or where necessary and legally permitted to address misuse, protect rights, or respond to a serious threat to safety. We assess the legal basis and scope of the particular request; this is not routine monitoring for emergencies or financial abuse.

Business changes. If a merger, acquisition, financing, or sale of all or part of the business is proposed or completed, necessary information may be disclosed to advisers or transaction participants, subject to applicable confidentiality, purpose, safeguarding, return/deletion, and notice requirements. This is a possible business event, not an existing sale of personal information.

We do not disclose information to third parties for their own direct marketing or for cross-context behavioral advertising.

5. Cookies and local storage

The web app, account-deletion page and restricted administrator dashboard use an app-host authentication cookie so that the backend can recognize your session. Public-site account and administrator pages send authenticated requests to the app host; the cookie remains scoped to the app host. Production authentication cookies are configured as Secure, HttpOnly, and SameSite=Lax. The web app also uses browser local storage for account/sign-out markers and a persistent browser database for cached financial records, pending changes, and synchronization state.

Native clients use a local per-account SQLite database for offline data and a separate secure-storage mechanism for bearer credentials. Secure credential storage does not mean the whole financial database is encrypted. Storage makes it possible to show your budget offline and send pending changes when connectivity returns.

The public website does not use tracking pixels, web beacons, advertising cookies, analytics tracking, or browser credential storage. Signing in on the deletion page or restricted administrator dashboard uses the app host's session cookie for account deletion or authorized administration. Receipt evidence reviewed on the administrator dashboard is fetched with authentication and temporarily displayed as a browser object URL, which is released when that image view closes. Infrastructure can still produce the request logs described in section 1. There is no separate Cookie Notice.

Your browser can refuse or delete cookies and clear site storage. Refusing the session cookie can prevent web sign-in; clearing browser or app data can remove offline records and unsent changes. Clearing local storage does not delete server records. Review pending changes before clearing a device, and see retention and deletion limits.

6. International processing

Our application servers and database are hosted in the United States by InterServer. Information can also be accessed from Taiwan to operate and support Budget Lightly.

Using the Services can involve processing outside your country, where protections may differ. Infrastructure and email providers can process information in other countries under their applicable arrangements; U.S. application hosting does not mean every provider-held copy stays in the United States. This notice does not claim a particular adequacy decision, certification, or signed international-transfer agreement for Budget Lightly.

Where EEA, UK, Swiss, or other applicable law restricts a transfer, the relevant legal requirements and a valid transfer mechanism or exception must be satisfied; your use of the app is not a substitute for them. You can contact us for information about recipients, processing locations, and any safeguards applicable to your information, including how to obtain a copy where the law provides that right.

7. Retention and deletion limits

Retention depends on the record's purpose, the service you continue to use, shared-workspace needs, and specific legal or security requirements. There is not one deletion period for every copy.

• Account deletion: after successful password confirmation on the account-deletion page, the account/profile, password credentials, sessions, memberships, associated invitations, and user FX quotes are deleted immediately. There is no additional waiting or recovery period.
• Private budgets: budgets without another member are permanently deleted in the same operation, including their expenses, plans, and synchronization history.
• Shared budgets: shared financial records remain for the other members until they delete the budget, except that the departing account's authored expenses and their receipt images are deleted, authored recurring descriptions are cleared, and authored split-payment plans are stopped and scrubbed. Account attribution and personal-category associations are removed or scrubbed. Other shared text can still contain information entered by members. Historical shared changes are cleared; scrubbed collaborator command receipts remain while the budget exists to prevent duplicate replay.
• Deleted expenses and synchronization history: outside complete budget deletion, expense deletion marks a stored row as deleted. Change payloads and command receipts can retain earlier financial and free-text content to support synchronization and prevent duplicate operations. The current system has no automatic pruning schedule for these records. Deleting an expense is not complete erasure.
• Receipt images: removing an image or deleting its expense deletes the active image bytes and scrubs attachment metadata from synchronization history. Unattached uploads become ineligible after seven days and are cleaned up when another image upload runs; this is not a scheduled seven-day erasure guarantee. Independently captured moderation evidence, backups, and device/export copies have separate retention limits.
• Sessions, invitations, and rate records: sessions have a 400-day validity period, which active clients can renew. Invitations have a seven-day validity period. Account deletion removes the account's sessions, associated invitations, and user FX quotes immediately. Other revocation or expiry prevents further use as applicable but does not prove that every log has been erased.
• Support and privacy correspondence: protected support-case copies stored on our application host expire automatically 30 days after the operator marks the case closed. Open cases remain available while being handled. Email-mailbox and paper correspondence are separate copies; the host cleanup does not delete them and they currently have no automated expiry. You can request deletion; applicable legal duties and limits still govern what we may retain.
• Content-safety records: reports, captured content/context and receipt images, and moderation decisions are retained separately for review and enforcement. They survive editing or deleting the reported content, budget, or account; resolving a report does not erase its evidence. The current system has no automatic expiry for these records, so they may remain indefinitely. You can request review or deletion through the contact channels below; we assess any lawful retention need rather than treating enforcement as a blanket exemption. Removing a block does not restore previous budget membership.
• Operational logs: new application and public-site container logs rotate at a 10 MB threshold with at most three files per container. Earlier stopped containers and the shared front proxy use the same threshold with at most five files per container; the front proxy has no per-request access log enabled. These are size limits, not a guaranteed number of days. Application access logs omit client addresses, requested paths and query strings; error diagnostics can still contain request information. Logs support troubleshooting and security and are not part of account erasure.
• Backups and recovery: a verified database snapshot is created daily. Automatic hourly cleanup removes host-controlled snapshots and registered operator backup copies older than 14 days; the managed snapshot set also has a limit of 14 files. Cleanup can lag the time limit by the hourly job interval and stops if the host or job is unavailable. Historical snapshots are not edited by account deletion. A separate protected record keeps only a recovery-coverage identifier and erased account identifiers, not usernames or financial content; it is retained to refuse recovery that would bring erased accounts back into service. Snapshots predating recovery protection, or without the matching current protection record, are not eligible for restoration. Independently retained provider or member copies are outside these host cleanup guarantees.
• Device copies and exports: offline databases, pending changes, clipboard exports, downloaded archives, and copies made by you or workspace members are not remotely erased. They remain until their holders remove them. Eligible explicit logout clears local database rows when there are no pending changes or you choose to discard them; session expiry alone does not do so.
• Deletion without closing your account: while online, open the budget in the app, open Settings, choose “Delete budget,” type the budget's name exactly and confirm “Delete budget.” This permanently deletes its active budget records, including expenses, receipt images, plans and synchronization history, for all members while keeping your account; it also discards this device's unsynced changes for that budget. Ordinary expense deletion is not complete financial-record erasure. For a broader or selective deletion request, email budget-lightly@vidivize.com with your username, the records concerned and the requested outcome; do not send your password. We verify requests and explain applicable retention limits. Backups, moderation evidence, independent copies and provider-held information are not erased by the budget-delete action.

Automated account deletion addresses active account records, private budgets, and the departing identity in shared budgets. It does not erase separately retained content-safety reports and evidence, operational logs, historical backups, previous correspondence, or provider-held information, and cannot remotely erase independent copies held by other people or on devices outside our control. Host-controlled backups expire separately and recovery protection prevents their erased accounts from returning to service. If a particular legal obligation or claim requires retention, we will explain the limitation where permitted. Fraud prevention, troubleshooting, investigations, or enforcing terms are not blanket reasons to retain an entire account indefinitely.

For a broader privacy request concerning records outside the automated flow, use the contact channels below. Provider-held information has its own applicable terms and retention limits.

8. Security

The application uses password hashing, hashed server-side session tokens, workspace access checks, session revocation, and request-origin protections. Its production web-session configuration uses secure, HttpOnly cookies; native credentials use the platform's secure-storage facility. These measures do not mean that every stored financial copy is encrypted or that the service has a security certification.

Production API requests use certificate-validated HTTPS from your device to our public server. HTTPS terminates at our Caddy front proxy; traffic then uses HTTP over a private same-host container network to the application proxy and HTTP over container loopback to the backend. Those internal hops are not TLS-encrypted, and this is not end-to-end encryption. Production clients reject plaintext API destinations and do not automatically follow API redirects. Private network exposure controls do not eliminate access by privileged host or network workloads.

Matthew Scholefield is the only person with administrative access on our side. Service providers process information within their roles, and authorized workspace members retain access to their shared records; sole administration does not mean those necessary disclosures do not occur.

No internet transmission or storage system is completely secure. Unauthorized access, theft, loss, alteration, and disclosure remain possible. Use a unique password, protect devices that contain offline budgets, use the HTTPS service, and keep invitation links and recovery exports private. Tell us promptly if you suspect unauthorized access. This guidance does not transfer our legal responsibilities to you or limit your statutory rights.

9. Children and younger users

Budget Lightly is a general-audience budgeting app aimed at adults, not an adults-only service or a service directed to children. We do not market to children or sell children's data. The app does not ask for a birth date, verify age, or operate a parental-authorization process.

Legal protections and consent requirements for minors vary by location; the U.S. rules for children under 13 are not a universal age rule. General-audience availability does not remove any requirement to obtain parental consent before collecting a child's information. If you believe a child has provided information in circumstances that require protection or parental consent, email budget-lightly@vidivize.com. We will investigate and take the action required by applicable law, which can include restricting an account, stopping collection, and arranging deletion. A parent or guardian can use the same channel to raise a concern.

10. Privacy rights and consent choices

Depending on the applicable law and circumstances, you may have rights to:

• Find out whether we process your information, receive information about that processing, and access or obtain a copy of your information.
• Correct or supplement inaccurate or incomplete information.
• Request deletion, restriction, or cessation of collection, processing, or use.
• Receive eligible information in a portable format or object to specified processing.
• Withdraw consent where processing relies on consent.
• Receive information and safeguards concerning qualifying automated decisions, including relevant factors and human review where the law provides for them.

These rights are not identical everywhere or absolute. EU/UK and Swiss rights have statutory conditions and exceptions. Canadian federal law provides access, correction, and complaint rights, but not every right in this list; provincial law can add protections. Taiwan's law provides inquiry/review, copies, supplementation/correction, cessation, and erasure rights where it applies. U.S. state rights also depend on the law's scope.

Contact us to withdraw consent or exercise a right. Withdrawal concerns future consent-based processing and does not make prior lawful processing unlawful. It does not stop processing supported by another valid ground. If withdrawal or a necessary deletion prevents us from providing a requested feature, we will explain that consequence; it does not justify withholding unrelated services.

Budget Lightly does not make the significant solely automated decisions described above. Budget arithmetic does not make credit or eligibility decisions. You do not need to identify a particular statute to ask us for help, although assistance beyond legal requirements is not a promise that every statutory right applies worldwide.

11. Complaints and regulators

Please tell us about a privacy concern by email or post. Include your username if relevant, what happened, and the outcome you seek. We will assess the concern and explain our response under the law that applies.

If UK data-protection law applies, we will acknowledge a qualifying data-protection complaint within the applicable statutory 30-day period, investigate and respond without undue delay, keep you informed of progress, and explain the outcome. This is not a universal 30-day deadline for every privacy request.

You can also use the complaint or other remedies available under applicable law. Contacting us does not remove your right to approach a competent regulator:

• EEA: the relevant supervisory authority, including where you live or work or where an alleged infringement occurred. The EDPB authority directory provides current contacts.
• UK: the Information Commissioner's Office complaint service; helpline 0303 123 1113.
• Switzerland: the Federal Data Protection and Information Commissioner.
• Canada: the Office of the Privacy Commissioner of Canada or the relevant provincial commissioner, depending on the activity and law.
• Taiwan and elsewhere: the authority competent for your situation, where the applicable law provides that route.

12. Browser privacy signals

The current Services do not implement a separate technical response to browser Do Not Track (DNT) signals. They do not track your activity across unrelated websites for advertising.

Global Privacy Control (GPC) is different from DNT and can be a legally recognized opt-out preference signal. The current Services do not have a dedicated GPC handler; they also do not sell information, share it for cross-context behavioral advertising, or use it for targeted advertising. That absence of processing applies whether or not a signal is enabled. If practices change, required signal handling and other choices must be in place before the affected processing begins, and this notice will be updated. Nothing here limits a legally required opt-out.

13. U.S. state disclosures and rights

State privacy laws differ in their scope, exemptions, thresholds, and effective dates. A small user base is not a universal exemption, and living in a state does not by itself establish that every provision of its law applies to this operator.

Categories handled by the Services

The following uses common state-law category names to explain the processing described in this policy. It does not mean that we request every example included in a statutory definition. Information you volunteer in notes, workspace records, correspondence, or email attachments can fall into additional categories even when no dedicated field asks for it.

A. Identifiers

Usernames, display names, internal account and session identifiers, and network/request identifiers; also contact details you send in correspondence. Phone numbers and postal addresses are not registration fields.

B. Customer-record information

Name/contact information and budgeting and financial records. We do not ask for all the education, employment, or other information that can appear in the California statutory definition.

C. Protected characteristics

Not requested as structured fields. Age, gender, race, national origin, marital status, or similar details could be volunteered in text; we do not use them to build demographic profiles.

D. Commercial information

Expense and transaction records, amounts, dates, currencies, categories, recurring plans, and related financial entries. Recording an expense is not payment processing or a connection to a financial account.

E. Biometric information

No fingerprint, voiceprint, facial-recognition, or other biometric-identification feature.

F. Internet or network activity

Operational request/error information and application change/synchronization records, not cross-site browsing or search histories collected for advertising.

G. Geolocation

No device-location permission or location-tracking feature. A workspace timezone is a setting you choose, not a GPS reading. Network addresses can incidentally suggest an approximate location.

H. Audio, visual, or other sensory information

Receipt images you submit for processing and images you choose to send in support correspondence. There is no audio/video or call-recording feature.

I. Professional or employment information

No dedicated employment or applicant fields. Work-related details can occur in financial entries or correspondence you provide.

J. Education information

No student-record or education feature. Any such detail voluntarily included in a message or note is handled as part of that content.

K. Inferences

Budget totals calculated from your entries; no personal-characteristic or advertising profiles or significant eligibility decisions.

L. Sensitive personal information

Account-access credentials and any protected sensitive details included in submitted content can fall within legal definitions. Passwords are hashed on the server. Financial amounts alone are not the same as an account number combined with an access credential. We do not request banking credentials or use sensitive information to infer personal characteristics.

Section 1 explains the sources, section 2 the purposes, section 4 the recipients, and section 7 the retention criteria and deletion limits. Providers receive information necessary for their role; workspace disclosure concerns shared records and member identities, not other members' passwords. Service delivery or necessary troubleshooting is not permission to sell records or use them in public demonstrations.

These categories describe how the Services handle information when used, not a claim that every category has been collected throughout the preceding 12 months. As of this policy's last-updated date, the app has not been publicly released and has no production-user history. Where applicable law entitles you to an account of collection, business-purpose disclosures, sales, or statutory sharing, you can request it using the channels below. Ordinary provider processing and workspace sharing are distinct from “sharing” for cross-context behavioral advertising. We do not sell personal information or engage in that advertising-related sharing.

Rights, requests, and appeals

Where a state law applies, you may have rights to confirm processing, know and access information, correct inaccuracies, request deletion, receive a portable copy, and opt out of sale, targeted advertising, or profiling that produces legal or similarly significant effects. Not every state grants every listed right. We will not unlawfully discriminate against you for exercising a privacy right.

Additional rights can include information about processed categories in Minnesota; recipient categories in California, Delaware, and Maryland; specific recipients in Minnesota and Oregon; and parties to whom information was sold in Connecticut. Connecticut and Minnesota provide additional rights to understand, question, and correct qualifying profiling. California provides a right to limit certain sensitive-information uses and disclosures; Florida provides certain rights to opt out of sensitive-data and voice/facial-recognition collection. Each is subject to the relevant law's scope and conditions. Listing these rights does not imply we sell data, collect biometrics, or perform significant profiling.

We use account-access information for authentication and security, and financial content for the service you request—not to infer protected characteristics. Any required sensitive-data consent or limitation must be handled under the applicable law; ordinary service use is not a substitute for required consent.

To appeal a denied request where an appeal right applies, email us with “Privacy appeal,” identify your original request, and explain why you disagree. We will review it and give a written decision and reasons within the applicable legal period. If the appeal is denied, we will provide any legally required information about contacting your state attorney general or other competent authority. See section 15 for verification and authorized-agent requests.

California “Shine the Light.” We do not currently disclose personal information to third parties for their own direct marketing. Where California Civil Code §1798.83 applies, California residents can make a free written request once a year about qualifying disclosures in the preceding calendar year, including information categories and recipient names and addresses. Use the email or postal channel below.

14. Policy updates

The current policy is available at this page, linked from the public website footer. We will update its date when it changes. For material changes, we will provide a prominent website or app notice, or direct notice where appropriate and feasible, as required by applicable law. Because accounts use usernames rather than email addresses, do not assume every revision will arrive by email.

Before introducing a materially different use, we will check that the notice matches the actual processing and provide any required information and choices. Describing an optional feature does not give us blanket permission to process information for it without your choice or any legally required consent.

15. Contact and privacy requests

For questions, complaints, access or review, correction, deletion, consent withdrawal, or applicable appeals, contact:

Use the authenticated account-deletion page to delete your account without downloading the app or waiting for manual approval. Email and post remain available for questions and other privacy requests.

1. Identify your Budget Lightly username, describe your request, and give a way to respond. Indicate your country or state if relevant to a particular right. Do not send your password, session token, or complete financial records.
2. We may need to verify that the request relates to you, using existing information and only proportionate additional information where necessary. An email address alone does not prove ownership of a username-based account. Verification information is used to handle and secure the request, not for unrelated purposes.
3. An authorized agent should identify you and provide evidence of authority. We may ask for written or signed permission and confirmation of identity where the law permits. We can decline an unverified or unauthorized request and will explain the reason where required.
4. We will assess the request and respond within the applicable legal time limits, explaining any lawful extension, denial, fee, or retention limitation. We will not disclose another person's information or authentication secrets in an access response. Where a right does not apply, you can still ask for help; we will explain what is available.

You can edit supported profile, budget, and expense fields in the app. The account-deletion page closes the account, deletes private budgets, and removes the departing identity from shared budgets immediately after password confirmation. Deleting an expense, logging out, or uninstalling the app is not account deletion. For access, correction, or deletion requests involving logs, correspondence, provider-held information, or other copies outside that automated operation, contact us and identify the information concerned. The limits in section 7 still apply.