Last updated: date Who we are: GangliaX Labs LLC, a Wyoming limited liability company, 30 N Gould St Ste R, Sheridan, WY 82801, the maker of the Budget app ("we"). Contact: privacy@gangliaxlabs.com.
The short version
- Your budget stays on your phone, encrypted. We don't have an account for you and we can't see your budget.
- Nothing about your money is uploaded unless you choose to back it up, or to share an ajo or budget with people you invite. Both are encrypted so we can't read them.
- Bank alert texts are read on your phone and never leave it.
- We don't sell your data and we don't show ads.
- Anonymous usage stats are only shared if you choose to share them. Crash reports are on so we can fix problems, and you can turn them off.
What stays on your phone
Everything you enter: income, budget lines, plans, transactions, goals, bills, savings groups, and receipts or statements you share into the app. It is stored in an encrypted database on your phone. Receipts and statements are read on your phone; they are not uploaded.
Bank alerts (SMS, Android)
If you turn on Bank alerts and allow SMS access, the app reads the debit and credit texts your bank sends you, on your phone, and lists each transaction for you to confirm. Nothing is recorded until you confirm it.
- Only texts from bank and wallet senders (a list in the app, plus any sender you add) are read past the sender's name. Texts from people and other senders are never read.
- The app keeps only what it read from a bank text (amount, in or out, date, account ending, payee and the line it suggests), never the text itself.
- Nothing from your texts leaves your phone. To suggest senders you might add, the app looks at sender names only.
- Turning Bank alerts off stops reading at once and removes alerts waiting for confirmation. You can also remove SMS access in your phone's settings.
Reporting an alert that was read wrongly. If you choose to report one, you see exactly what will be sent before you send it: the layout of the text with every digit and every name or word replaced (for example Amt:NGN#,###.## DR Desc:POS XXXXXXX), the bank, which details were wrong and the app version. It is sent from your own email app, so we receive your email address with it. Legal basis: your consent, each time.
Voice input
When you tap the mic, your phone's own speech service turns what you say into text (on Android, Google's speech service; on iPhone, Apple's). Depending on your phone it may work offline or send the audio to Google or Apple under their privacy terms. The app receives only the text, never records or keeps audio, and reads the text on your phone. Voice is optional: you can always type.
Backups
If you turn on backup, the app makes an encrypted copy of your budget and saves it to a file you choose, for example in your Google Drive or iCloud Drive. It is encrypted on your phone with a password you set. We never receive the file or the password, and we can't open it or reset the password.
Anonymous usage stats
Before setup, the app asks whether you want to share anonymous usage stats; nothing is chosen for you. If you share them, the app sends which screens and features are used (for example "a goal was created"), when, your budget's base currency (instead of your location), your phone's system, maker and model, and the app version. They never include amounts, balances, names, merchants, descriptions, receipts, statements or other things you typed. A random identifier lets us count how many installs use a feature; it is deleted when you stop sharing. You can change your choice any time in Settings › Your data and privacy.
Who receives them: PostHog, in its EU cloud, as our processor. Location lookup is turned off and IP addresses are discarded. How long PostHog keeps events, from your plan's settings. Legal basis: your consent.
Crash reports
When the app crashes, it sends technical details of the crash so we can fix it: what went wrong in the app's code, the app and system versions, the phone model and its state at the time (such as free memory), and a random installation identifier. Error messages are removed first, because they can contain things you typed. Crash reports never include your budget.
Who receives them: Firebase Crashlytics (Google), as our processor. Retention: Crashlytics keeps crash data for 90 days per current Firebase documentation; verify. Legal basis: our legitimate interest in keeping the app working and not losing your data. They are on by default, and you can turn them off any time in Settings › Your data and privacy, which stops them at once.
Feature settings we download
The app downloads a small settings file that turns features on or off. Downloading it sends no information about you or your budget beyond what any internet request reveals (such as your IP address to the server). Host and retention.
Ajo boards and shared budgets (sync)
If you share an ajo or a budget, the people you invite see the same board or budget on their phones. To do that, each change is locked on your phone with the group's own key and sent to our sync service on Cloudflare, which passes it to the other phones.
- End-to-end encrypted: the key travels only inside the invite link, after the
#, which is never sent to a server. We can't read what we store: member names, amounts, payments and lines are all inside the locked data. - What our service does see: a random group id, a code made from the key by a one-way function (so only invited phones can add changes), the size and time of each change, and, as with any internet request, your IP address, which Cloudflare uses for security and rate limits and we don't keep.
- Who can see your group: anyone who has the invite link. Share it only with the people you mean to, and don't post it publicly.
- Deleting: when the organiser deletes an ajo or the owner deletes a shared budget, its data is removed from our service. Someone who leaves keeps their own copy on their phone.
- Who runs it: Cloudflare, as our processor. Legal basis: providing the sharing you asked for.
Ask Budget (Plus)
Ask Budget is a chat about your money. With Plus, and only after you agree on the screen that explains it, each message goes to our service with a summary of your budget so the AI can answer. Without Plus, offline or if you say no, your phone answers simple questions itself.
- What is sent: your message and the last few messages of the conversation; a summary of your budget with amounts rounded (to the nearest ₦1,000 above ₦10,000, else ₦100), your lines as categories and numbers ("line:3, food"), your income, bills, goals, debts and savings as totals, and the past six months' totals; figures your phone works out when the AI asks for them (also rounded, without names); today's date; and your app store's random identifier for your install (to check that you have Plus).
- What is never sent: the names of shops, people (payees, ajo members, shared-budget members) or your lines and goals, account numbers, banks, transaction notes, receipts, bank texts, exact dates, where you are, your name, email or phone number. Your phone puts the names back into the answer.
- What is kept: the conversation stays on your phone (and in your backup if it's on). We don't store or log messages, summaries or answers. To apply your monthly AI allowance, we keep how much you've used this month under a code that changes every month, so one month can't be linked to the next. Anthropic deletes what it receives within 30 days at most and doesn't use it to train its models. Update when zero data retention is granted: Anthropic doesn't store it at all.
- Who reads it: our service on Cloudflare, and Anthropic, whose AI model (Claude) writes the answer. Both are our processors.
- Your choice: you can see exactly what was shared on every answer, turn the AI off in Settings › Your data and privacy, and clear the chat at any time. Legal basis: your consent, given in the app, which you can withdraw at any time.
Reading in the cloud (Plus)
If you have Plus and your phone can't read a receipt or statement, you can choose to have it read in the cloud. It never happens on its own: you see exactly what will be sent first.
- What is sent: the document only. Account, card and phone numbers and email addresses are covered on your phone before it leaves. For a receipt, the image; for a statement, its text, or for a scanned statement, images of its pages. Names on the document, such as the other party's, are sent, because they're part of what is read. With it go your budget's base currency, the bank when known, and your app store's random identifier for your install (to check that you have Plus). Nothing else from your budget is sent.
- Who reads it: our reading service, run on Cloudflare, which sends it to Anthropic, whose AI model (Claude) reads it and returns the details to your phone. Both are our processors.
- What is kept: we don't store the document or the details read from it. We keep a count of your cloud reads for the month, under a one-way code rather than your identifier, to apply the monthly limit. Anthropic deletes what it receives within 30 days at most and doesn't use it to train its models. Update when zero data retention is granted: Anthropic doesn't store it at all.
- Legal basis: providing the Plus feature you asked for, each time you ask.
Linked banks (Plus, US and Canada)
If you link a bank, you sign in to it on Plaid's own screen. Plaid, our processor, holds the connection to your bank; we and the app never see your bank username, password or security answers. Plaid's end-user privacy policy is linked before you link a bank.
- What passes through us: your accounts' names, types and last four digits, their balances, and your transactions (date, amount, description and category), on their way from Plaid to your phone. We don't store them or log them.
- What we keep: one record per linked bank: an identifier, a one-way hash of a secret made on your phone, Plaid's access token encrypted with our key, the bank's identifier and when it was linked and last synced. Plaid is given only a one-way code of your app store identifier, never the identifier.
- What your phone sends: the linked bank's identifier, its secret and where the last sync stopped, with your budget's currency. Never your budget, lines or other transactions.
- Nothing is logged on its own: every transaction waits for you to check it.
- Disconnecting removes the link at Plaid and our record; transactions you already confirmed stay in your budget. A linked bank that hasn't synced for 45 days, or whose owner has been without Plus for 14 days, is removed the same way.
- Legal basis: providing the Plus feature you asked for.
Notifications
Reminders (bills, payday, pace, month-end, statements) are created on your phone. No server is involved.
Payments
Plus subscriptions are bought through Google Play or the App Store, which handle payment; we never see your card or bank details. RevenueCat, our processor, keeps track of whether you have Plus: it receives the store's purchase records (which plan, when, and whether it renews), a random identifier for your install, your phone's system and the app version, and your IP address when the app contacts it. It isn't linked to your name or your budget. Legal basis: providing the subscription you bought.
Your choices and rights
- See and download your data: Settings › Your data and privacy › Download my data gives you everything as a CSV file.
- Delete your data: Settings › Your data and privacy › Delete all my data removes everything from your phone and deletes your backup file. Deleting an ajo or shared budget you created also removes it from our sync service. Uninstalling the app also removes the data on your phone.
- Usage stats: stop sharing any time; what was waiting to be sent and the random identifier are deleted.
- Crash reports: turn them off any time; this is how you object to them.
- Because we don't hold your budget, requests to access or delete it are handled in the app. For questions about usage stats or crash reports, contact privacy@gangliaxlabs.com. Because they aren't linked to you, we usually can't find your records in them; we'll explain this if you ask.
Children
Budget is not directed at children under 13 / the age required in your country.
Changes
We'll update this policy when the app changes how it handles data, and show the date above.