Legal

Privacy Policy

Last updated: 2026-08-29

Untoo ("we", "us") is a couples finance app operated by Fernand Petit, Cochabamba, Bolivia, the data controller for the personal data described here. You can reach us at contact@untoo.app. This policy explains what we store, why, and who processes it. The short version: your money notes belong to you two: we store what you log so you can share it with your partner, and nothing is sold or used for ads.

Who can use Untoo

Untoo is for adults. You must be at least 18 years old (or the age of majority in your country, if that is higher) to create an account. We do not knowingly collect data from minors; if you believe someone under 18 has an account, contact us and we will delete it.

What we store

  • Account data: email address, display name, and sign-in identifiers (email/password, Apple, or Google).
  • Shared couple data: the expenses, income, goals, contributions, settlements, categories, and notes you and your partner log. Both partners in a couple see all of it; that is the product.
  • Preferences: language, currency, notification choices.

AI capture

When you use AI capture (typing or speaking an entry), we send just that one entry's text to OpenAI, our AI processor, to read the amount, category, and note, never your history, your other notes, or your account details. Voice is transcribed on your device; only the resulting text is sent. If you snap a photo of a receipt, that photo is sent to OpenAI the same way, to read the total, merchant, and date. It is used only to fill that one entry and is not stored by us afterward. Manual entry never involves AI and is always available.

Voice capture uses your device's built-in speech recognition to turn speech into text, and only that text is sent to us. Depending on your device, operating system, and language, that recognition may run entirely on the device or may be processed by your platform provider (Apple or Google) under their own privacy policy; this is the same system dictation your keyboard uses. We never receive or store the audio itself.

Service providers (processors)

  • Supabase: database, authentication, and hosting for your data.
  • OpenAI: parses the single entry (text or receipt photo) you submit via AI capture.
  • PostHog: product analytics. We record usage events (e.g. "an expense was logged") with no amounts, note text, names, or emails.
  • Sentry: crash reports. Reports are scrubbed of note text, amounts, and personal identifiers.
  • You control both of these: Settings → Privacy → “Analytics & crash reports” in the app. In the EEA, the UK and Switzerland they start off and send nothing at all unless you turn them on. Everywhere else they start on and turning the switch off stops them entirely. Either way, nothing is collected or sent while the switch is off.
  • Superwall: runs our subscription paywall and records which plan you chose. It receives your account identifier and basic device/app information, never your financial entries.
  • Expo: delivers push notifications (recap reminders and partner activity) to your device. Notification text never includes amounts.
  • Resend: delivers the feedback you send from inside the app to our support inbox. When you submit feedback, your message, display name, and email address are included so we can reply.
  • Apple / Google: payment processing for subscriptions; we never see your card details. They also provide the device speech recognition described above.
  • Cloudflare: hosts this website and routes mail sent to our support address.

Why we are allowed to process it (legal bases)

Where the GDPR applies, we rely on:

  • Performance of a contract: account data and your shared couple data. Without these the app cannot work.
  • Legitimate interests: keeping the service secure and reliable, and handling support requests you send us.
  • Consent: optional extras you turn on. In the EEA, the UK and Switzerland this includes product analytics and crash reporting, which stay off until you switch them on. It also covers push notifications everywhere. You can withdraw consent at any time in Settings or your device settings, and withdrawing it stops the processing from that moment.
  • Legitimate interests (outside the EEA, UK and Switzerland only): product analytics and crash reporting, which start on and which you can switch off at any time in Settings.
  • Legal obligation: retaining subscription and tax records where the law requires it.

Where your data is stored, and where it goes

We are based in Bolivia and our providers are largely in the United States, so if you are in the EEA, the UK or Switzerland your data leaves your country when you use Untoo. Specifically:

  • Your account and couple data (entries, goals, categories, names) is stored by Supabase in the United States.
  • Analytics and crash reports, when you have turned them on, go to PostHog and Sentry in the United States.
  • We ourselves are in Bolivia, which the European Commission has not found to provide an adequate level of protection.

These transfers are covered by the European Commission’s Standard Contractual Clauses with each provider, and by our data processing agreements with them. You can ask us for details of the safeguards at contact@untoo.app.

How long we keep it

  • Account and couple data: kept while your account is open. Deleting your account erases it as described below.
  • Shared history after one partner leaves: retained for the remaining partner, because it is their financial record too, until they delete it themselves.
  • Uncoupled or two-sided deletion: purged after the 30-day grace period.
  • Analytics and crash reports: retained by PostHog and Sentry for up to 12 months, then deleted.
  • Support email: kept up to 24 months so we can follow up on an ongoing issue.
  • Subscription and payment records: kept as long as tax and accounting law requires (typically 7 years); these come from Apple and Google, not from your entries.

What we never do

  • No selling of personal data, no advertising, no data brokers.
  • No bank account access: everything in Untoo is what you chose to type.

Deleting your data

You can delete your account in Settings, or by request; see how to delete your account and data. If you are the only member of your space, everything is erased immediately. If a partner remains, the shared history stays with them (frozen, read-only), because it is their financial record too, and they can export or delete it. Uncoupling and two-sided deletion follow a 30-day grace period.

Your rights

Depending on where you live (e.g. GDPR, CCPA), you may have rights to access, correct, export, or erase your data.

Getting a copy of your data is always free, on every plan. Settings → Privacy → “Download your data” gives you a spreadsheet of everything you logged or were part of (your expenses, income and settle-ups), with no subscription required. (Untoo Premium also offers an export of your couple’s complete shared ledger; that one is a product feature, not your access right.)

Deleting your account is also in Settings. For anything else (correction, objection, or a question about any of this), contact us at contact@untoo.app.