Legal

Privacy Policy

Last updated: 2026-10-20

Untoo ("we", "us") is a couples finance app operated by Fernand Petit, Cochabamba, Bolivia, the data controller for the personal data described here. You can reach us at contact@untoo.app. This policy explains what we store, why, and who processes it. The short version: your money notes belong to you two: we store what you log so you can share it with your partner, and nothing is sold or used for ads.

Who can use Untoo

Untoo is for adults. You must be at least 18 years old (or the age of majority in your country, if that is higher) to create an account. We do not knowingly collect data from minors; if you believe someone under 18 has an account, contact us and we will delete it.

What we store

  • Account data: email address, display name, and sign-in identifiers (email/password, Apple, or Google).
  • Shared couple data: the expenses, income, goals, contributions, settlements, categories, and notes you and your partner log. Both partners in a couple see all of it; that is the product.
  • Photos you choose to keep: a receipt photo you keep on an expense, and a photo you add to a goal. They are stored privately with your couple data. Only you and your partner can open them, through links that expire after a few minutes, and they are never public.
  • Preferences: language, currency, notification choices.

AI capture

When you use AI capture (typing or speaking an entry), we send just that one entry's text to OpenAI, our AI processor, to read the amount, category, and note, never your history, your other notes, or your account details. Voice is transcribed on your device; only the resulting text is sent. If you snap a photo of a receipt, that photo is sent to OpenAI the same way, to read the total, merchant, and date. OpenAI uses it only to fill that one entry. If you keep the photo on the expense (the switch on the confirm card, which you can turn off), we store it with your couple data, where only you and your partner can see it. If you don't, we don't keep it. Manual entry never involves AI and is always available.

Voice capture uses your device's built-in speech recognition to turn speech into text, and only that text is sent to us. Depending on your device, operating system, and language, that recognition may run entirely on the device or may be processed by your platform provider (Apple or Google) under their own privacy policy; this is the same system dictation your keyboard uses. We never receive or store the audio itself.

Service providers (processors)

  • Supabase: database, authentication, file storage (the receipt and goal photos you keep), and hosting for your data.
  • OpenAI: parses the single entry (text or receipt photo) you submit via AI capture.
  • PostHog: product analytics. We record usage events (e.g. "an expense was logged") with no amounts, note text, names, or emails.
  • Sentry: crash reports. Reports are scrubbed of note text, amounts, and personal identifiers.
  • You control both of these: Settings → Privacy → “Analytics & crash reports” in the app. In the EEA, the UK and Switzerland they start off and send nothing at all unless you turn them on. Everywhere else they start on and turning the switch off stops them entirely. Either way, nothing is collected or sent while the switch is off.
  • Superwall: runs our subscription paywall and records which plan you chose. It receives your account identifier and basic device/app information, never your financial entries.
  • Expo: delivers push notifications (recap reminders and partner activity) to your device. Notification text never includes amounts.
  • Resend: delivers the feedback you send from inside the app to our support inbox. When you submit feedback, your message, display name, and email address are included so we can reply.
  • Apple / Google: payment processing for subscriptions; we never see your card details. They also provide the device speech recognition described above.
  • Cloudflare: hosts this website and routes mail sent to our support address.

Why we are allowed to process it (legal bases)

Where the GDPR applies, we rely on:

  • Performance of a contract: account data and your shared couple data. Without these the app cannot work.
  • Legitimate interests: keeping the service secure and reliable, and handling support requests you send us.
  • Consent: optional extras you turn on. In the EEA, the UK and Switzerland this includes product analytics and crash reporting, which stay off until you switch them on. It also covers push notifications everywhere. You can withdraw consent at any time in Settings or your device settings, and withdrawing it stops the processing from that moment.
  • Legitimate interests (outside the EEA, UK and Switzerland only): product analytics and crash reporting, which start on and which you can switch off at any time in Settings.
  • Legal obligation: retaining subscription and tax records where the law requires it.

Where your data is stored, and where it goes

We are based in Bolivia and our providers are largely in the United States, so if you are in the EEA, the UK or Switzerland your data leaves your country when you use Untoo. Specifically:

  • Your account and couple data (entries, goals, categories, names, and the photos you keep) is stored by Supabase in the United States.
  • Analytics and crash reports, when you have turned them on, go to PostHog and Sentry in the United States.
  • We ourselves are in Bolivia, which the European Commission has not found to provide an adequate level of protection.

These transfers are covered by the European Commission’s Standard Contractual Clauses with each provider, and by our data processing agreements with them. You can ask us for details of the safeguards at contact@untoo.app.

How long we keep it

  • Account and couple data: kept while your account is open. Deleting your account erases it as described below.
  • Shared history after one partner leaves: retained for the remaining partner, because it is their financial record too, until they delete it themselves. This is the case whether the other partner left the space or deleted their account.
  • Deleting your shared space: erased as soon as both of you confirm. If one of you asks and the other neither confirms nor keeps it, it is erased after 30 days.
  • Receipt photos: kept as long as the expense they belong to. Removing the photo, or deleting the expense, deletes it from our storage within 48 hours.
  • Analytics and crash reports: retained by PostHog and Sentry for up to 12 months, then deleted.
  • Support email: kept up to 24 months so we can follow up on an ongoing issue.
  • Subscription and payment records: kept as long as tax and accounting law requires (typically 7 years); these come from Apple and Google, not from your entries.

What we never do

  • No selling of personal data, no advertising, no data brokers.
  • No bank account access: everything in Untoo is what you chose to type.

Leaving a space is not deleting your data

Either of you can leave your shared space at any time (Settings → Account → Leave this space). You start again in a new, empty space of your own. Leaving does not erase anything: the shared history stays with your partner, because it is their financial record too, and that includes your name on the entries you logged or paid and on a note that you left. To erase your own data, delete your account; that also removes your name from the shared history your partner keeps.

Deleting your data

You can delete your account in Settings, or by request; see how to delete your account and data. If you are the only member of your space, everything is erased immediately. If a partner remains, the shared history stays with them (frozen, read-only, without your name), because it is their financial record too, and they can export or delete it. Deleting a shared space needs you both; see “How long we keep it” above.

Your rights

Depending on where you live (e.g. GDPR, CCPA), you may have rights to access, correct, export, or erase your data.

Getting a copy of your data is always free, on every plan. Settings → Privacy → “Download your data” gives you a spreadsheet of everything you logged or were part of (your expenses, income and settle-ups), with no subscription required. (Untoo Premium also offers an export of your couple’s complete shared ledger; that one is a product feature, not your access right.)

The spreadsheet marks which expenses have a receipt photo. The photos themselves stay in the app, where you can open each one; ask us at contact@untoo.app and we will send you a copy of all of them.

Deleting your account is also in Settings. For anything else (correction, objection, or a question about any of this), contact us at contact@untoo.app.