Privacy Policy

Budash is operated by TCM Group("we", "us"). This policy explains what data the Budash mobile app and website collect, why, and the choices you have. Contact us at support@budash.app.

Data we collect

• Account: email address, name and profile photo, via Firebase Authentication (email/password or Google Sign-In).
• Your commitments: the subscriptions, bills, amounts, currencies, due dates and spaces (workspaces) you enter or import.
• Invoice scans: images or files you choose to upload so their details can be extracted.
• Gmail (optional): if you connect Gmail, we read billing-related emails only to suggest subscriptions for you to review. We never import anything without your confirmation, never send email, and you can disconnect at any time.
• Your AI provider key (optional): if you add your own OpenAI, Anthropic or Google key, we store it encrypted and use it only to run the AI features you request.
• Preferences: notification settings, language, currency and a device push token.
• Purchases: subscription status from Google Play / the App Store (via RevenueCat) or our web payment provider. We never receive your full card details.
• Diagnostics: crash reports and usage analytics (Firebase Crashlytics and Google Analytics for Firebase), including device model, OS version and app events.

How we use it

• To provide the service: track commitments, forecasts, reports and reminders.
• To send the payment reminders you enable (email and push).
• To manage your plan and purchases.
• To fix crashes and improve the app.

We do not sell your data and do not use it for advertising.

Who processes it

• Google Firebase (authentication, crash reporting, analytics, push notifications)
• Neon (database, EU – Frankfurt) and Hetzner (servers, EU – Germany)
• RevenueCat and Google Play / Apple (in-app subscriptions)
• Our web payment provider (website subscriptions)
• Our email delivery provider (reminder and account emails)
• The AI provider whose key you supply, only when you use AI features
• Google (Gmail API), only if you connect Gmail

Google user data

Budash's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to show you subscription suggestions, is not transferred to others except as needed to provide that feature, and is not used for advertising.

Security and retention

Data is encrypted in transit (HTTPS) and sensitive secrets (AI keys, Gmail tokens) are encrypted at rest. We keep your data while your account exists. When you delete your account it is removed from our database immediately; backups roll off within 30 days.

Your rights and choices

• Delete your account in the app (Settings → Delete Account) or on our account deletion page.
• Disconnect Gmail or remove your AI key in Settings at any time.
• Turn off email or push reminders in Settings.
• Request access to or correction of your data by emailing us. Depending on where you live (e.g. the EU/UK under GDPR), you may also complain to your data protection authority.

Children

Budash is not directed at children under 13 (or the minimum age in your country) and we do not knowingly collect their data.

Changes

We will update this page when this policy changes and, for material changes, notify you in the app or by email.