Privacy policy

Who is responsible

The controller for the processing described here is Andrey Fedyukov, Mecumstraße 52, 40225 Düsseldorf, Germany.

For any question about your data, write to [email protected]. You can also lodge a complaint with a data protection supervisory authority in the EU country where you live.

What we store

Account data, when you create one: your email address, the identifiers of the sign-in method you used (Apple or Google, when you sign in that way), and the technical timestamps of your sessions.

The book itself: transactions, accounts, categories, recurring transactions, planned payments, budgets, currency settings and the notes you write. If you share a book, the membership of that group and its invite codes.

When you buy Topf Plus: that the purchase was made and how long it is valid for, the anonymous identifier the purchase service assigns to your installation and, if you have an account, the link between the two. Not your card and not your Apple ID — Apple keeps those and shows us neither.

Voice inputs, when you use an account: for each calendar month, how many successful voice inputs were counted toward your account, so that the limit that applies can be enforced — a monthly limit in the free version and, with Plus, a cap that protects against abuse. What is stored is the calendar month, that count and the time it last changed; what you said and the drafts made from it are not stored. In a shared book, voice inputs by members without their own Plus are counted toward the account of the group’s owner.

That is the whole list of what is stored with an account. There is no advertising identifier, no device fingerprint and no third-party tracking in the app; the usage statistics described below are not linked to your account.

Using the app without an account

Topf can be used without signing up. In that mode the book stays on your device only, nothing is uploaded, and we hold no data about you. There are two exceptions, both described below: voice input, which needs a network, and buying Topf Plus, which goes through Apple and the purchase service. The book itself is not part of either.

Why we may process it, and on what basis

To provide the product you asked for: keeping your book, synchronizing it between your devices and restoring it on a new one. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

To sign you in: sending the sign-in code to your email address. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

To know whether you have Plus: checking the purchase with the purchase service and keeping its current state on our server. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

To apply the monthly limit on voice inputs: counting voice inputs per calendar month, because the free version includes a limited number of them. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

To understand how the app is used and to improve it: usage statistics. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

To keep the service working and to stop abuse of the voice endpoint. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Where the data is

A full copy of your book is on your device, in a local database, and it works there without a network.

When you have an account, the same data is stored in a PostgreSQL database hosted by Supabase in Frankfurt, Germany (AWS eu-central-1), and reaches your devices through the PowerSync synchronization service. Access is restricted per user by row-level security: an account can read its own book and, if it belongs to a shared one, that book.

Voice input

When you use voice input, your phrase is normally recognized by the speech recognition of your device, and only the resulting text is sent to our server, together with the context needed to make sense of it: your interface language, today’s date, your time zone, your main currency and the names of your active accounts and categories.

That text is passed to OpenAI, which turns it into drafts of transactions. The drafts come back to your device and are shown to you; nothing is written to your book until you confirm it.

When the recognition of the device is unavailable, the recording itself is sent instead and transcribed by the same provider. In both cases the audio and the text pass through our function in memory and are not stored by us — not in the database, not in a file, not in a log. When you use an account, a successful input only raises the monthly count described above by one.

OpenAI processes this data on our instructions as a processor. Its API is used with the setting that keeps submitted data out of model training; for abuse monitoring, the provider may retain the request and its response for up to 30 days, or longer where required by law or reasonably necessary to protect its services or third parties from harm. Do not dictate anything you would not want a processor to see.

Email

Sign-in codes are sent through Amazon Simple Email Service (AWS, Frankfurt, Germany). The service receives your email address in order to deliver the message. We do not send marketing email and there is no mailing list.

Exchange rates

Daily exchange rates come from the public service api.frankfurter.dev. The request is made by our server once a day for everybody, not by your device — so using multiple currencies tells that service nothing about you.

Purchases

Topf Plus is bought through Apple’s App Store, with or without an account. The payment itself, your card and your Apple ID stay with Apple; we never see them. RevenueCat (RevenueCat, Inc., USA) receives the App Store receipt, an anonymous identifier of your installation and, if you have an account, its identifier, and tells the app and our server whether Plus is active and until when. RevenueCat processes this data on our instructions as a processor; the transfer to the USA rests on the EU standard contractual clauses.

Usage statistics

To understand where people get lost and what to improve, the app sends usage statistics to PostHog (PostHog Inc., USA; the data is stored in the EU, in Frankfurt): how the app is used — which screens are opened and which actions are taken in it. Each event carries the app version, the operating system and its version, the language, the time zone and a random identifier of the installation.

Never sent: amounts, notes, names of accounts and categories, what you said, your email address or the identifier of your account. Your IP address is discarded and not used to determine your location. The statistics are not linked to your account; after the app is reinstalled, the identifier of the installation is a new one. Sending can be switched off in the app: Settings → Privacy → Usage statistics.

Legal basis: our legitimate interest in improving the app (Art. 6(1)(f) GDPR). PostHog processes this data on our instructions as a processor; the transfer to the USA rests on the EU standard contractual clauses. Events are available for analysis for one year; older ones no longer appear in reports, though PostHog may keep them in its archive. Because the statistics are not linked to you, we cannot single out or delete the events of one installation.

This website

The site is hosted on Cloudflare Pages. It has no forms, no cookies, no analytics and no embedded third-party content. Only the home page reads the languages set in your browser, to open in one of them, and nothing about that is stored. Cloudflare processes the technical data any web server sees — your IP address, the requested address, the user agent — to deliver the page and to protect the service.

Who else sees the data

Only the processors named above, each for the one job it does:

• Supabase — hosting of the database and the authentication service;
• PowerSync — synchronization between the database and your devices;
• OpenAI — turning a spoken phrase into drafts;
• Amazon Web Services — email delivery, and the infrastructure the database runs on;
• RevenueCat — processing of in-app purchases and the state of your Plus entitlement;
• PostHog — usage statistics of the app;
• Cloudflare — hosting of this website and the domain.

We ensure that third parties to whom we transfer user data provide the same or an equivalent level of protection as described in this privacy policy and required by the privacy requirements applicable to our app.

Your data is not sold, not rented, not shared with advertisers and not used to train anybody’s models.

How long we keep it

For as long as your account exists. Deleting the account deletes the book on the server; a copy that has already been synchronized to your own devices is removed when you sign out or remove the app.

A transaction you delete in the app disappears at once from the book and from every total, and the deletion can be undone right after. On the server it stays stored, marked as deleted, until you delete your account.

Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest.

Deletion is built into the app: Settings → Account → Delete account removes your data on the server and, when you signed in with Apple, revokes that grant as well. For anything else, write to [email protected].

Children

Topf is not directed at children and is not intended for use by anyone under 16.

Changes

When this policy changes, the date at the top changes with it. A change that materially affects how your data is handled will be announced in the app before it takes effect.