Who is responsible
The Service is operated by Kyra Zeah Sapanta, an individual based in the Philippines. She is the data controller for the purposes of the Philippine Data Privacy Act of 2012 (RA 10173) and, where it applies, the EU GDPR. Contact for any privacy question or request: support@flashbudget.app.
Postal address: XPERIENTIAL SPOT, Sitio Centro, Purok Palata, Basdiot, Moalboal, Cebu 6032, Philippines.
What we collect
Flash Budget is a personal finance app. When you create an account we collect your e-mail address, display name, username and (optionally) a profile photo. The app stores the financial records you enter yourself: accounts, transactions, categories, budgets, savings goals, debts and related settings. If you attach a photo to a transaction — a receipt, for example — the file is stored too. We do not connect to your bank and never ask for banking credentials.
How data is stored and used
Data is stored in Supabase (PostgreSQL and Supabase Storage for attachments), hosted in the ap-south-1 region (Mumbai, India). If you are located in the EEA, this means your data is transferred outside the EEA. All traffic is encrypted in transit (HTTPS). Access is restricted per user by row-level security: only you can read your records. We do not sell your data and do not use it for advertising.
Third parties
The app contains no analytics, no advertising and no trackers. Fonts are served from our own domain — no requests are made to Google Fonts or any other CDN from your browser. Your browser communicates only with flashbudget.app and Supabase.
- Supabase — database, authentication and storage of all your records.
- Contabo — the server that runs the web application.
- Expo — delivery of push notifications in the mobile app (device token only).
- Telegram — only if you connect our bot yourself. We then store your chat id and deliver the same notifications you get in the app to that chat. Disconnecting in Settings → Notifications removes the link.
- Google— only if you choose «Continue with Google» to sign in.
- ExchangeRate-API and CoinGecko — sources of exchange rates. These are requested by our server on a schedule; no personal data is sent to them, and your device never contacts them.
Local storage on your device
Theme, language, account order and the PIN code are stored on your device only and never sent to the server. We do not use cookies for tracking; the only cookies are the ones required to keep you signed in.
E-mails
We always send service e-mails you cannot opt out of while you have an account: password recovery and security notices. Promotional e-mails are sent only if you switch them on — the setting is off by default and can be changed at any time in Settings → Personal data & privacy. Withdrawing consent does not affect messages already sent.
Your rights
You can access, correct, export and delete your data. Access and correction are available directly in the app; export is available as CSV; deletion removes everything (see below). Under RA 10173 you may also complain to the Philippine National Privacy Commission; under the GDPR, to your local supervisory authority.
Retention and age
Data is kept until you delete your account (see below). The service is not intended for children under 16.
Account deletion
You can delete your account and all associated data at any time directly in the app: Settings → Delete account. Deletion is immediate and irreversible — the profile, accounts, transactions, goals, attachments and notifications are removed. You can also request deletion by e-mail: support@flashbudget.app.
Questions about this document? Write to support@flashbudget.app — we answer every message.