Privacy policy

Account and subscription

You need an account to use Baluna. You sign in with Google or Apple. When you create an account we process:

• your e-mail address (with Sign in with Apple this can be Apple's private relay address),
• your first and last name from your Google or Apple profile,
• your account identifier with the sign-in provider.

The first month is free. To keep using the app, you buy a subscription in the App Store or Google Play after signing in. Payment is handled by the store on your store account. Baluna never sees payment details, it only learns about the trial period and whether the subscription is active.

We keep account data until the account is deleted. Your expenses, chats with the assistant, receipt photos and API keys do not reach Baluna's server. The only exception is a report you send yourself, described below.

Data on your phone

Expenses, incomes, budgets, savings, fixed expenses, shopping lists, categories, tags, receipt photos and settings are stored in the app's local database on your phone. With a shared database the phone keeps a working copy of the household's data, and receipt photos stay on the phone that took them.

• A tile's chat is deleted once you close the tile. Only approved entries remain.
• Receipt photos are deleted automatically after the time you choose in settings.
• API keys are stored in the system's secure storage (Keychain on iOS, Keystore on Android).
• The crash log stays on your phone. You share it only if you decide to.

What leaves your phone

AI provider

The assistant runs on your own API key for OpenAI, Anthropic, OpenRouter or Ollama Cloud. A chat sends the chosen provider the conversation, the expenses you ask about (amounts, categories, notes), receipt photos if you attach them, and your saved preferences, which are part of the model instructions and go with every message. The connection goes directly from your phone to the provider. Baluna has no proxy server and does not see this data. The data reaches the provider under your agreement with them. Before you first use a provider, the app shows what will be sent and asks for consent. You can delete the key at any time.

Voice chat (optional, off by default)

If you turn on voice chat, the microphone audio, the conversation transcript, short results of tasks done in Baluna and the context needed for a reply are sent to OpenAI. Before the first voice chat the app asks for separate consent. OpenAI charges the voice chat to your key.

Shared database (optional, off by default)

If you create or join a shared database, the household's data (expenses, incomes, budgets, savings, fixed expenses, shopping lists, categories, tags, receipt data without photos and shared settings) and the member account (name, e-mail address, password in Firebase Authentication) go to a Firebase project that one person in the household creates and controls. Google stores the data under that person's agreement with Google, in the location chosen when the database was created. Baluna has no access to it and does not see it. The data is not end-to-end encrypted, so Google can technically read it. You can sign out, leave the household or delete your account in the app at any time: Settings > Database. The last person can delete all household data, and the whole project is deleted in the Firebase console.

Shared database notifications (optional)

In shared database mode the phone stores its push notification token and app language in the household's Firebase project, so other members can notify it about changes. The notification is generic (e.g. "New changes: 3"), with no amounts, names or people. It is sent by the phone of the person who made the changes through the Expo Push service (Expo, 650 Industries) and delivered by Apple (APNs) and Google (Firebase Cloud Messaging in Baluna's project, with no budget data). You can turn notifications off in Settings > Database. Signing out, leaving the household and switching to the local database remove this phone's token.

Household chat (optional)

Household chat messages are stored in your household's Firebase project, not with us. Only household members can see them. The app deletes messages older than 90 days when the chat is opened. The notification about a new message contains neither its text nor the author's name.

Exchange rates

When you save an expense or income in a currency other than your default and there is no rate for it yet, the app fetches the mid rate from api.nbp.pl (the National Bank of Poland). This happens when such an entry is saved and when views that convert amounts open: the budget balance, the expense list and the budget screen. The request contains only the currency code, e.g. EUR, with no amounts, categories or any identifier. NBP sees just your phone's IP address, as with any connection. If you keep everything in one currency, no such request is ever sent. You can also enter a rate by hand in settings, then the app does not fetch it from the network.

Reports

If you send a bug report or a suggestion from the "Report a bug or an idea" screen, we pass on exactly what you type (title, description, optionally an e-mail address and a screenshot you pick yourself) plus the app version, OS and device model. Reports go to the app's author and are kept until the matter is resolved. The app does not attach your expenses or your conversations with the assistant. We only see them if they are visible on a screenshot you attach.

What we do not do

We use no analytics or advertising tools, do not profile you, and do not sell or share data with third parties.

Your rights and data deletion

You delete the data on your phone, API keys included, in the app: Settings > Data > Clear all data. You delete your shared database account in the app: Settings > Database > Delete account. To have your Baluna account and account data or a sent report deleted, message me on LinkedIn.

Contact

Controller: Paweł Twardziak. Contact: LinkedIn.