Privacy notice

Trackly · last updated: 6 October 2026 · DRAFT – to be reviewed

In short: your financial data stays on your device only. There are no accounts, we use no advertising or tracking tools, and we neither receive nor see your expenses.

1. Who the data controller is

[Full name or company name], [address], email app.spese.del.mese@gmail.com (hereinafter "we" or "us").

2. What data the app processes and where it is stored

• Data you enter (expenses, income, accounts, savings pots, due dates, notes, names of the people you split expenses with): stored in the browser's or the app's storage on your device (localStorage). It is not sent to us or to any third party.
• PIN: if you set one, your data is encrypted on the device with AES-256 (key derived from the PIN with PBKDF2). The PIN is not stored and cannot be recovered by anyone, not even by us.
• Backups and exports (JSON, CSV, PDF): these are files you create yourself and save or share wherever you choose.
• Receipt photos: the text is read on the device; the photo is not sent to anyone.
• Automatic payments (optional, phone app only): if you turn this on, on Android the app reads notifications from Google Wallet and Samsung Wallet only, to extract the amount, merchant and card name; on iPhone it receives them from the Shortcuts automation that you create yourself. This data becomes an expense saved on your device like any other: it is not sent to us or to any third party. You can turn the feature off in Settings › Automatic payments and revoke notification access in your phone's settings.

3. Connections to external services

• Opening the app: no requests to third-party servers (no external fonts, analytics or advertising).
• Receipt reading: only the first time you use the "Receipt" feature, the app downloads the text-recognition program (Tesseract.js) from the public jsDelivr service (cdn.jsdelivr.net). As with any website, jsDelivr receives your device's IP address in order to deliver the files; it does not receive your photos or your data.
• Website: if you use the app from the website, the hosting provider [e.g. Netlify / Cloudflare] logs technical access data (IP address, date and time, browser) for security purposes, for a limited period.
• Stores and payments (Pro plan): if you buy Pro, payment is handled by the Apple App Store, Google Play, Microsoft Store or Stripe under their respective privacy notices. We only receive confirmation of the purchase (an anonymous identifier and the subscription status), never your card details.

4. Why, and on what legal basis

The data is used to make the app work for you (performance of the service you requested, Art. 6(1)(b) GDPR). Technical access data is used to keep the website secure (legitimate interest, Art. 6(1)(f)). We do not carry out profiling or marketing.

4a. Smart features (AI)

Suggested category, alerts, tips and "Ask your expenses" run on your device: the calculations use your expenses but nothing is sent. You can turn them off in Settings › Artificial intelligence. If you use the online assistant in the future, we will first ask for your explicit consent (Art. 6.1.a GDPR): only a summary (totals by category and month, without descriptions, accounts or personal data) will be sent to our server, used to generate the answer and not stored. You can withdraw consent at any time in Settings. Answers are generated by an artificial intelligence and may contain mistakes.

5. How long

Your data stays on your device until you delete it: from Settings (clear/delete data), by clearing the site data in your browser or by uninstalling the app. Please note: without a backup, deleted data cannot be recovered.

6. Your rights

You have the rights set out in Articles 15–22 of the GDPR (access, rectification, erasure, restriction, portability, objection). Since the data is only on your device, you can exercise them directly in the app: view, edit, export (JSON/CSV) and delete it. For any questions, write to app.spese.del.mese@gmail.com. You can also lodge a complaint with the Garante per la protezione dei dati personali, the Italian data protection authority (garanteprivacy.it).

7. Children

The app is not intended for children under 14 and does not knowingly collect their data.

8. Changes

If this notice changes, the new version will be published on this page with the date of the update.