Privacy policy

Who we are

Costnora is run by Karolis Vilimas, a private individual in Lithuania, who is the controller of your personal data. Write to karolis.mobileapp@gmail.com about anything in this policy.

What we store

When you create an account: your email address, the name you choose, the country you pick, and your password, which our sign-in provider keeps only as a secure hash.

What you add to the app:

• projects and groups: names, descriptions, currency, icon and colour, and type details such as a car's model and odometer, a home's address and rooms, a client's name or a monthly budget
• entries: amounts, dates, notes, categories, who paid and how an expense is split, and type details such as odometer readings, fuel, VAT, rooms and insurance claims
• recurring bills and your own categories
• in shared trips: the names you give participants, payments between them, and invitations you send by email

To keep the service safe we also keep short-lived technical records, such as how often an account tries to send invitations (deleted after about a day), and our hosting providers log requests to the website, including IP addresses.

We don't collect your location, contacts, photos or advertising identifiers, and there are no ads.

Why we use it

• To provide the service you signed up for: keep your data, sync it between your devices and share trips with the people you invite (performance of a contract, GDPR Article 6(1)(b)).
• To keep the app working and secure: crash reports, abuse limits and request logs (our legitimate interest in a reliable, safe service, Article 6(1)(f)).
• To decide what to improve: anonymous counts of which features are used (our legitimate interest; you can turn them off).
• To answer you when you write to us.

We don't sell your data, use it for advertising or make automated decisions about you.

Who processes it for us

• Supabase: our database and sign-in. It stores your account and everything you add (in the EU, in Frankfurt, Germany), and sends sign-in and password emails.
• Sentry: crash reports from the app's release builds and error reports from this website, stored in its EU data centre in Germany. A report holds the error, your device model (or browser), operating system and app version, and the screens or pages you used just before; we remove names, email addresses and account IDs before it's sent. Reports are kept for 30 days.
• Vercel: hosts this website and processes the requests your browser sends to it.
• Aptabase: anonymous usage statistics from the app (see below), stored in the EU.
• Frankfurter: the exchange rate the app fills in when you add a trip expense in another currency. It receives only the two currency codes and the day, and, with the request, your device's IP address; nothing about you or your entries.

Some of these companies are based in the United States. Where your data leaves the EU, the transfer is protected by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

Usage statistics

The app counts which features are used, for example that a project of a given type was created or an entry was added, so we can decide what to improve. We use Aptabase, with the data stored in the EU. These counts contain no name, email, amounts, notes or account details, and no identifier of you or your phone. Aptabase derives your country from your IP address and doesn't store the address. You can turn it off in the app's Settings → Privacy.

This website doesn't count anything about you.

Shared trips

Trips can be shared. Everyone who joins a trip sees everything in it: entries, notes, splits, payments, the participants' names, and each member's name and email address. Any member can add and edit entries.

Someone you invite sees the trip's name, its owner and the names of participants not yet linked to an account before they accept.

If you leave a trip, what you added stays in it, so the trip's totals stay right.

How long we keep it

We keep your data while your account exists. When you delete something in the app, it disappears everywhere, but we keep a deleted mark on our servers so your other devices learn about it when they sync; it's removed for good when your account is deleted.

You can delete your account yourself in the app (Settings → Security → Delete account) or ask us by email. We then delete your data as described on Delete your account: right away in the app, within one month by email. A shared trip you own goes to another member, so the others keep it.

The app also keeps a copy of your data on your phone so it works offline. Logging out or deleting your account removes it.

Your rights

Under the GDPR you can ask us to:

• give you a copy of your data (access and portability)
• correct it
• delete it, or your whole account (you can also delete your account yourself in the app)
• restrict how we use it, or object to a use based on our legitimate interest

Write to karolis.mobileapp@gmail.com from the email address of your account. We answer within one month, and it's free.

You can also complain to a data protection authority. In Lithuania that is the State Data Protection Inspectorate (vdai.lrv.lt); you can also contact the authority where you live.

Security

Your data travels over encrypted connections, and access rules on our database let only you, and the members of trips you share, read it. On your phone, the app keeps its data in the app's private storage.

Children

Costnora is meant for adults. You need to be 18 or older to create an account.

Changes to this policy

When we change this policy, we'll update the date at the top and tell you in the app before the change applies.