Privacy policy
Sumaly is an app for running your household finances as a family. This page explains, without beating around the bush, what data it stores, who it is shared with and how to delete it.
Contact: soporte@sumaly.app
1. What data we collect
Account data
- Your email address and the display name you choose.
- Your preferred language and currency.
- If you sign in with Google or Apple, we receive your email and your name from them. We do not receive or store your password for those accounts.
Financial data you enter
- Expenses and income: amount, date, merchant, category, account and notes.
- Budgets, savings goals and the accounts you define (cash, card, checking…).
- Photos of receipts, if you choose to attach them.
This data is what the app exists to handle. It is not sold, not rented and not used for advertising.
Technical data
- A device identifier so we can send you push notifications, if you turn them on.
- Minimal technical logs of server errors, with no content from your expenses.
2. What we do not collect
- We do not collect your location.
- We do not access your contacts, your calendar or the rest of your photos.
- We do not store or transmit audio recordings.
- We do not connect to your bank and we do not ask for banking credentials.
- There is no advertising, no trackers and no profiling. The app does not share data with any ad network.
3. What is processed on your phone
Two things that might look invasive and are not:
- The photo of the receipt never leaves your phone to be read. Text recognition happens on the device. Only the extracted text —amounts, merchant name, date— travels to our server to classify the expense. The image is stored only if you choose to attach it as a receipt.
- The audio of your voice is neither stored nor sent to us. The transcription is done by your phone's operating system. Only the resulting text reaches our server.
4. How data is shared within your family
Sumaly is built to be used as a family, so this matters: the members of your family see the family's expenses, income, budgets and receipts, including the ones you entered. Whoever administers the family can also approve or reject join requests and remove members.
One family's data is not visible to any other family.
5. Providers involved
Sumaly relies on these services. None of them use the data for advertising or to train models with it.
| Provider | What for | What it receives |
|---|---|---|
| Supabase | Database, authentication and receipt storage | All of your account and financial data. Servers in [REGION]. |
| Anthropic | Classifying a dictated expense or the text of a receipt | Text only: the transcript or the text extracted from the receipt, plus the list of your categories. Never the image or the audio. |
| Google Firebase | Push notifications | Your device identifier and the content of the notification. |
| Resend | Sending the monthly report by email, if you turn it on | Your email address and the month's report. |
| Google / Apple | Sign-in, if you choose that route | They handle authentication; they return your email and name to us. |
| Cloudflare R2 | Storing the receipt photos you choose to attach | The image file. It is accessed only through signed, temporary links. |
| App Store / Google Play | Charging for the subscription | They process the payment and store your card details. We neither receive nor see them. |
6. Security
- The local copy of your data on the phone is encrypted with SQLCipher, and the key lives in the system keychain.
- All traffic with our servers goes over HTTPS.
- The database has row-level access rules: the server rejects any query that tries to read data from a family you do not belong to.
- Receipts are stored in a private bucket; they are accessed through signed, temporary links.
No system is infallible. If we detect a breach that affects your data, we will let you know by email.
7. How long data is kept and how to delete it
Your data is kept for as long as your account is open.
You can delete your account from inside the app, in My profile → Delete account. That deletes your profile, your expenses, your income, your receipts and your report subscription. If you are the last person in your family, the family is deleted too, along with all of its content. The operation cannot be undone.
8. Your rights
You can access your data, correct it, export it and delete it. Access and correction are done from the app; export is done from the Reports screen, which generates an Excel or PDF file with the month's detail. For any other request, write to our contact email.
9. Minors
Sumaly is not directed at children under 13 and we do not knowingly collect data from people of that age. An adult in the family may add a minor as a member under their responsibility.
10. About the public beta
This version is distributed as a public beta for a limited time, through TestFlight on iPhone and Google Play on Android. During the beta there may be bugs, and we cannot guarantee that no data will be lost. Do not use Sumaly as your only record of important financial information during this period.
11. Changes to this policy
If we change anything material, we update the date in the header and give notice inside the app. Continuing to use Sumaly after a change means you accept it.
12. Subscriptions
If you take out a paid plan, the purchase is made on the App Store or Google Play. They process the charge and store your payment method details; we only receive confirmation that your subscription is active. The plan's conditions, automatic renewal and refunds are covered in the terms and conditions.
13. Contact
Write to us at soporte@sumaly.app.