Privacy policy
Last updated 10 November 2026
Who is responsible
The controller is [HOLDER NAME], contact [CONTACT EMAIL]. See the Legal notice.
What we keep and why
| Data | Purpose | Legal basis | How long |
|---|---|---|---|
| Email, passkeys and sessions | Your account and signing in | Contract (art. 6.1.b GDPR) | Until you delete your account, or 30 days without activity |
| Movements, categories, budgets, goals and preferences | The service itself | Contract (art. 6.1.b GDPR) | Same as above |
| Technical logs with your IP address, kept by our host | Security | Legitimate interest (art. 6.1.f GDPR) | About 1 hour |
| Our own error records, without personal data | Fixing bugs | Legitimate interest (art. 6.1.f GDPR) | 14 days |
| Anonymous visit and speed counts on public pages | Knowing, in aggregate, how many people visit and how fast pages load | Legitimate interest (art. 6.1.f GDPR) | As set by the provider |
The amounts you type are not real money, but they still describe your habits, so we treat them as personal data.
We do not sell your data, we do not show ads and we do not build profiles about you.
Who processes the data for us
- Vercel Inc.: hosting, server functions in the EU and anonymous, cookieless visit and speed statistics on public pages.
- Turso (ChiselStrike Inc.): database, in an EU region.
- Resend Inc.: sending sign-in codes and account emails.
Some of these companies are based in the United States. Transfers are covered by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses.
Inactivity and deletion
If you do not use your account for 30 days, we delete it with all its data. We send you a reminder on day 25 and on day 29. Accounts that never confirm their email are deleted after 72 hours.
When you delete your account, everything is erased at once. Our database provider keeps backups for 1 day, so deleted data disappears from backups within 1 day.
Your rights
- Access and portability: Settings › Privacy › Download all my data.
- Erasure: Settings › Privacy › Delete my account. It is immediate.
- Rectification, objection and restriction: write to [CONTACT EMAIL].
You can also complain to the Spanish Data Protection Agency (AEPD, aepd.es).
Age
Suvaro is for people aged 18 or over. You confirm your age when you create an account.
Changes
If this policy changes, we will update the date at the top and, for important changes, tell you inside the app.