Privacy Policy

Last updated: October 5, 2026

The short version

Off Finance works on your phone without an account, and what you enter stays there. Apart from a check for app updates, nothing leaves your phone unless you choose it: creating an account to sync or share, or turning on analytics. We don't sell your data or use it for ads.

Who's responsible

Leonardo Guimarães Urci, the developer of Off Finance, is responsible for your data (the "controller", as Brazil's data protection law, the LGPD, calls it). Questions or requests about your data: support@off-finance.com.

What we collect and why

The app, no account
- What: nothing. What you enter stays in a database on your phone. The update check sends nothing about you. Like any server, our hosting provider (Railway) keeps a standard request log with your IP address for 7 days; we only look at it to fix problems or stop abuse.
- Why: to tell you about updates.
- Basis for the request log: our legitimate interest in security and fixing problems.
Account and Sync (only if you create one)
- What: email, name, avatar, app language, password (hashed) or Google sign-in, the vaults you sync, and whether your subscription is active. No IP address or device details are saved with your account.
- Why: to run sync, shared vaults, sign-in, payments, and account emails.
- Basis: your consent and our contract with you. Billing records: legal obligation.
Analytics in the app (off unless you turn it on)
- What: how you use the app, basic device details, a rough location, and random IDs. Never your amounts, names, notes, or email. Details below.
- Why: to see which features people use and where they get stuck.
- Basis: your consent.
This website
- What: the page, where you came from, your browser, device, screen, language, and time zone, how fast it loaded, and which Ask your AI option you pick, if you use it. No cookies. PostHog combines your IP address and browser details into a one-day anonymous code so a visit counts once, then drops the IP. It isn't stored or used to find your location.
- Why: to know how many people visit, what they read, and whether they ask an AI about the app.
- Basis: our legitimate interest.
The waitlist
- What: your email and how you heard about us (both required), the page's language, which platforms you'd use, and when you joined and confirmed.
- Why: to tell you when the app launches and give you the offer below.
- Basis: your consent.

Besides us, only the companies listed further down handle your data. They run parts of the service for us. Apart from them and the people in a vault you share, nobody gets your data unless the law requires it.

Accounts and shared vaults

You only need an account to sync or to join a shared vault. People you invite don't have to buy a plan.
Payments go through Google Play. RevenueCat tracks whether your subscription is active, by account ID. We never see your card.
Everyone in a shared vault sees all of it, plus your name, your avatar, who added or edited each transaction, and the owner's email.
To invite someone, you give us their email and we send the invite. If someone leaves or is removed, the copy on their phone stays with them.

Analytics in the app

It's off until you turn it on, with the checkbox during setup or "Share analytics" in Settings > Privacy. Leaving it off changes nothing in the app. The choice is per device: signing in or out doesn't change it, and a new device asks again.
Sent: what you do, like opening the app, signing in, using quick add, creating a budget, or buying a plan; the app version; your device model, system, screen size, language, region, and time zone; the country and city PostHog works out from your IP address (the IP isn't stored); the ad campaign, if you installed from one of our ads; a random ID and a session ID, neither linked to your account or email.
Never sent: amounts, names, notes, what you called your categories, budgets, vaults, or payment methods, your email, or anything from your account.
Turning it off stops new events right away. Anything already recorded may go out in one last send, the rest is cleared, and the random ID resets.
Deleting it: tap "Delete analytics data" in Settings > Privacy. It opens an email to support with your IDs, old ones included. Send it and we delete everything sent under them. Uninstalling or clearing the app's data loses those IDs, so send it first. Analytics aren't tied to your account, so deleting the account doesn't delete them.

The website and the waitlist

PostHog counts visits for us, including which parts of the home page you reach and the Ask your AI options you pick, and stores nothing on your device. If you came from an ad, its click ID is masked before anything is sent.
Cloudflare hosts the site and sees your IP address to serve the pages. Your browser remembers your theme and language.
Waitlist codes go out through Resend, and entries sit on our server at Railway. Deleting your account deletes your entry. To leave the list, write to support@off-finance.com.
Waitlist offer: confirm your email on the waitlist and create an account with it by the end of January 31, 2027 (Brasília time) to get 12 months of Sync, counted from when the account's email is verified. New accounts only (an email that already has an account can't join), one per email, and it can't be transferred or swapped for money. Afterward the account goes back to the free plan, with no charge, and keeps a note that it came from the waitlist.

Who else handles your data

Railway: our server and database (accounts, synced data, the waitlist) and its request log.
Cloudflare: delivers this website and protects our server, and sees your IP address to do that. Also stores our encrypted daily backups.
Google Play and RevenueCat: payments and whether your subscription is active.
Google: "Continue with Google".
Resend: account emails and waitlist codes.
PostHog: app analytics, if you turn them on, and website visit counts.

Railway, Resend, Google, and RevenueCat handle your data in the United States. PostHog keeps it in the European Union, which Brazil recognizes as protecting data as well as the LGPD does. Cloudflare works from data centers around the world. A second encrypted backup sits on the developer's own storage in Brazil. We take reasonable care of all of it, but no system is 100% secure.

How long we keep it

On your phone: until you delete it or uninstall.
Your account: while it exists. Billing records: as long as the law requires.
Request log: 7 days, at Railway.
App analytics: up to a year at PostHog, or sooner if you ask us to delete it.
Website visits: up to a year at PostHog, with nothing that identifies you.
The waitlist: until it ends after January 31, 2027. Then entries that never became an account are deleted, and the rest lose their answers.

Deleting your data

On your phone: delete it in the app, clear the app's data, or uninstall.
Your account: email support@off-finance.com from your account's address. We delete it within 30 days, and backup copies within 90. We keep only what the law requires, like billing records. This doesn't cancel your Google Play subscription.
Analytics: see "Deleting it" above.
Step by step: Deleting Your Account.

App permissions

The app asks for no permissions and can't reach your contacts, location, camera, or microphone. Android grants a few at install, for internet access, billing, and syncing in the background.

Age

Off Finance is for ages 13 and up. If you're under 18, you need a parent's or guardian's OK to create an account, buy a plan, or turn on analytics. The app doesn't check your age. If a child under 13 gave us information, tell us and we'll delete it.

Your rights

Under the LGPD, you can ask us to:

confirm we have your data and show it to you
fix it if it's wrong, incomplete, or out of date
anonymize, block, or delete what's unnecessary, excessive, or unlawful
hand it over so you can take it elsewhere
delete what we hold because you consented
tell you who we share it with

You can withdraw consent at any time. Saying no only costs you that feature: no analytics changes nothing, and no account means no sync. For analytics, turn off "Share analytics". For anything else, write to support@off-finance.com. You can also complain to Brazil's data protection authority, the ANPD. Outside Brazil, laws like the GDPR or the CCPA may give you similar rights, and the same address works.

Changes to this policy

When it changes, so does the date at the top. For important changes, the app also shows "Review the updated terms" in Settings, never a pop-up.