BudgeTorch Privacy Policy
Contents
- Who is responsible
- What stays on your phone
- Partner sync (optional)
- Notifications
- Saved copies
- Camera
- If you contact us
- Monitoring the service
- This website
- What we don't do
- Summary: what, why, and for how long
- Who receives information
- How we protect information
- Your rights
- Your privacy choices in the United States
- Children
- Changes
- Contact
BudgeTorch is a budgeting app made by Samuel Anders ("we", "us"). This policy explains what happens to your information when you use it. The short version: your budget stays on your phone. If you share it with a partner, it travels end-to-end encrypted, so no one but your two phones (not us, not our hosting providers) can read it. We have no accounts and no way to tell who you are from what the service handles.
Who is responsible
Samuel Anders, 162 Coy Wilborn Lane, New Hope, AL 35760, USA (support@budgetorch.app), is responsible for the information described here.
What stays on your phone
Everything you enter (income, budget categories, debts, assets, vacation plans, bills, templates, and your history) is stored only on your phone. BudgeTorch has no accounts, no sign-up, and no server that keeps your budget. We never see it.
Your phone's own backup (for example, Android's backup to your Google account) may include BudgeTorch's data, under your phone's and Google's or Apple's settings and policies.
Partner sync (optional)
If you pair your phone with a partner's, the two phones exchange your budget through our sync relay, which runs on Cloudflare.
- Encrypted end to end. Data is encrypted on your phone with keys that are created on your phone and never leave your two phones. The relay holds no key that can decrypt it, so it can't read names, amounts, or anything else in your budget.
- What the relay handles: the encrypted messages, your phones' internet (IP) addresses, when they connect, roughly how much data moves (messages are padded to hide exact sizes), the two phones' public keys, and an ID for your pair of phones made from those keys.
- How long it keeps things: an encrypted message is deleted as soon as the other phone receives it, or after 30 days. A pair of phones that stops using sync for 180 days is deleted. Unpairing deletes everything the relay holds for your pair right away.
- Limits on abuse: to stop misuse, the relay counts connections and new pairs per IP address. It uses a shortened one-way hash of the address rather than the address itself (we still treat it as personal data) and keeps those counts for at most a day.
Pairing happens only in person, by scanning each other's codes.
Notifications
- Reminders (for example, "Your budget needs a decision") are created on your phone. Nothing is sent anywhere to make them.
- "Your budget was updated" notifications, when your partner makes changes while your app is closed, are sent through Expo's push service and then Google's (Android) or Apple's (iPhone) notification service. For this, your phone gives our relay a push token: an identifier your phone's notification service uses to reach the app. Your phone also tells the relay which of the app's languages it uses, so the notification appears in that language. The notification text is fixed and contains no names, amounts, or budget details. You can turn these off in Settings → Sync with partner, which deletes the token and the language from the relay; unpairing deletes them too. To track whether a notification arrived, the relay keeps the token with its delivery receipt for up to a day.
Saved copies
"Save a copy" creates a file of your data and opens your phone's share sheet. The file goes only where you choose to send it (for example, your email or a cloud drive). We recommend protecting it with a password; a protected copy is encrypted on your phone and can't be read without that password, which we never see and can't recover. A copy saved without a password is readable by anyone who has the file.
Camera
BudgeTorch uses the camera only to scan your partner's pairing code. Images are not stored or sent anywhere.
If you contact us
If you email us, we receive your email address and whatever you write. We use it only to answer you, and delete the conversation 12 months after it ends, unless the law requires us to keep it longer.
Monitoring the service
The relay records counts of events, such as "a phone connected" or "a notification couldn't be delivered", with no IDs, keys, addresses, or message contents, so we can tell whether the service is working. These counts can't be linked to you.
This website
budgetorch.app uses no cookies, analytics, scripts, or tracking. Cloudflare hosts it and, like any web host, handles your IP address to deliver the pages. We don't receive visit logs; Cloudflare shows us only totals, such as the number of visits per day.
What we don't do
No advertising, no tracking across apps or websites, no selling or sharing of your personal information (including "selling" or "sharing" as California law defines them), no profiling or automated decision-making, and no analytics about what you do in the app.
Summary: what, why, and for how long
| Information | Why | Kept |
|---|---|---|
| Encrypted sync messages, the phones' public keys, the pair ID | To sync your budget with your partner, which you asked for | Until delivered or 30 days; the pair until unpaired or 180 days unused |
| IP addresses and connection times | To connect your phone to the relay | Not stored by us; handled by Cloudflare to run its network |
| Hashed IP addresses | To stop abuse of the relay | Up to 1 day |
| Push token and app language | To send partner-change notifications in your language | Until you turn notifications off or unpair (or 180 days unused) |
| IP addresses of website visitors | To deliver budgetorch.app | Not stored by us; handled by Cloudflare |
| Your emails to us | To answer you | 12 months after the conversation ends |
Using partner sync and notifications is optional; the rest of the app works without them.
Who receives information
We use these service providers, under contracts that let them use the information only to provide their service to us:
- Cloudflare, Inc. (United States; global network) runs the relay. Your pair's data may be stored in a data center near where you paired, or elsewhere, including the United States.
- Expo (650 Industries, Inc.) (United States) passes notifications to Google and Apple.
- Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service) deliver notifications to your phone.
- Our email service provider receives emails sent to support@budgetorch.app.
Apple and Google also run the app stores you download BudgeTorch from; they handle that under their own privacy policies. Our providers are based in the United States and may also process information in other countries where they operate. We may disclose information if the law requires it, but since the relay can't read your budget, there is little we could hand over.
How we protect information
- Your budget is end-to-end encrypted in sync, and protected copies are encrypted with your password; we hold no keys that can read either.
- Only your two paired phones can use your pair's mailbox: each connection must be signed with one of their keys.
- Connections use TLS (HTTPS/secure WebSockets).
- The relay keeps no request logs, and deletes data on the schedule above.
- Access to the accounts that run the service is limited to us and protected with two-factor authentication.
Your rights
Depending on your state, you may have the right to know what personal information we hold about you, get a copy, correct it, and delete it. You can do these yourself, right away, in the app:
- See or take your data: everything is in the app; "Save a copy" exports it in a portable (JSON) format.
- Delete: Settings → Clear all data, or uninstall the app. Unpairing deletes everything the relay holds for your pair.
- Stop notifications: Settings → Sync with partner.
The relay doesn't know who you are, and we can't link what it holds to a name or email address, so we can't look up "your" data from a request; the tools above are how you see, take, or delete it. The one thing we can find is an email you sent us, by your email address: ask and we'll send you a copy or delete it. If you need help using them, or have a question about your information, email support@budgetorch.app. We'll answer within 30 days and won't charge for it.
Your privacy choices in the United States
We don't sell or share personal information, use it for targeted advertising, or profile you. Because we don't track you across apps or websites, Do Not Track and Global Privacy Control signals have nothing to switch off; we treat everyone as having opted out. If your state gives you privacy rights (for example, California, Colorado, Virginia), you can use them as described under "Your rights", and we won't treat you differently for doing so.
Children
BudgeTorch is meant for adults managing their own finances and isn't directed to children under 13. We don't knowingly collect personal information from children. We have no accounts, so we never learn anyone's name or age, and we can't look up a particular person's data. If a child has used BudgeTorch, the phone's owner can remove everything right away: unpairing (Settings → Sync with partner) deletes everything the relay holds for those phones, and uninstalling the app deletes the rest. Email support@budgetorch.app if you need help doing that.
Changes
If this policy changes, we'll update the effective date above, post the new version at this address, and for significant changes tell you in the app before they take effect.
Contact
support@budgetorch.app · 162 Coy Wilborn Lane, New Hope, AL 35760, USA