Privacy policy

Who is the controller

The controller of personal data is GST Solutions s.r.o., IČO 08080763, Tkalcovská 874/3a, 602 00 Brno, Czech Republic ("we"). Contact: [email protected].

Without an account: data only on your phone

The accounts, transactions, budgets, plans and backups you create in the app are stored only on your device. We do not see them and do not send them anywhere. The one exception is dictation, when you start it yourself (below).

The app saves backups on your device; where you copy them next (iCloud Drive, Google Drive, e-mail) is up to you.

Technical data about the device

To keep the app working and to know what to fix, it sends our server an installation identifier (random, not an advertising ID), the device type, system and app version, language and anonymous usage events (e.g. launch, finishing the introduction, first transaction). The content of your finances is not part of this data.

The app downloads ČNB rates from our server; the server technically sees your IP address, which we do not store.

Legal basis: legitimate interest in running and improving the app (Art. 6(1)(f) GDPR).

Dictation and typed phrases

When you dictate a transaction or type it as a phrase, the app sends our server the recording or the text and what is needed to sort it: the names of your accounts, categories and payees, your main currency, the language and today's date. This happens only when you start the feature yourself.

The recording is transcribed on the server and is not stored. A Google model turns it into text and an Anthropic model suggests a transaction from the text; we call both through OpenRouter, Inc. We route requests only to providers that do not use the data to train models; under their terms they may keep it briefly to check for abuse.

We do not store the recording, the text or the names, and do not write them to logs. The server keeps only the number of requests per device per day, and the log holds the size, language, status and response time. You see the suggestion in the app, and the transaction exists only once you save it.

You allow the microphone on your phone and can turn it off there at any time; you can also type the phrase. When the server is not available, the phone itself processes a typed phrase. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

With an account: sync

When you create an account, we process your e-mail, possibly an identifier from Apple or Google, and your financial data, so that it is the same on all your devices.

The data is stored in a Supabase database in the EU (Frankfurt) and transferred encrypted. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Bank plan: bank connection

Fio banka, CREDITAS and MONETA business accounts connect with your own token, which you create in your internet banking. Our server uses it to load payments directly from your bank; no additional processor is involved. The token is stored on the server, only the server functions of the connection can read it (it never returns to the app), and we delete it when you remove the connection or delete your account. You can also cancel it in your bank at any time.

For other banks, payments are loaded by a licensed account information service provider (AISP); we will name it here before this connection launches, only with the consent you give directly in your bank. The consent is time-limited and you can withdraw it at any time in the app or in your bank.

Forwarded notices: if you turn this on, you get an address for that one account. E-mails your bank or mailbox sends to it are received by Cloudflare, Inc. and passed to our server, where an Anthropic model reads the text through OpenRouter, Inc. to recognize the payment. We store only the recognized payment (date, amount, counterparty, message) and, for a verification e-mail, its code, link and sender until the first payment. We neither store nor log the text of an e-mail, but it passes through these services and may contain an account number or a balance: forward only the bank's notices. Requests go only to providers that do not use the data for training. After disconnecting, the address stops working.

We store the loaded payments (date, amount, description, counterparty) with your account so they show in the app. We never see your bank login details.

Payments

You pay for subscriptions through the App Store or Google Play; only Apple or Google see your card details. Subscription status is managed by RevenueCat, Inc. (USA), which receives the purchase identifier and your user identifier.

Who receives data

Supabase, Inc. — database and sign-in (data in the EU, Frankfurt).

RevenueCat, Inc. — subscription management.

Apple and Google — app stores, sign-in with Apple / Google.

Bank connection provider — a licensed account information service provider (AISP); we will name it here before this connection launches.

OpenRouter, Inc., Google LLC and Anthropic PBC — dictation and typed phrases, only when you use them; OpenRouter and Anthropic also read forwarded bank notices.

Cloudflare, Inc. — hosting of this website and receiving forwarded bank notices.

Transfers outside the EU (USA) rely on the EU standard contractual clauses. We do not sell data or use it for advertising.

This website

The website stores a single cookie, dokoruny-lang, with the language you choose. We use no analytics or advertising cookies.

When you open a /go link (for example from an ad), we record the channel from the link, device type, language, country (determined by Cloudflare) and where you came from. We do not store your IP address.

How long

We keep account data until you delete the account. When you delete it, we delete the data from our database right away. Technical device data without an account is kept for at most 24 months. Dictation recordings and phrases are not kept at all.

Your rights

You have the right of access, rectification, erasure, restriction, portability (CSV export or a backup in the app) and to object. Write to [email protected].

You can lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz).

The app is not intended for children under 15.