Privacy & data

bynku is a small, self-hosted household budgeting app. The developer operates it as a personal / test project and is the data controller for the purposes of GDPR. Contact for privacy requests: use the email address you signed in with — the developer will reply to that account.

While bynku is preparing for launch, you can join a waiting list so we can tell you when a spot opens. If you do, we store the email address you enter, your browser language, a note of where you signed up, and the date and time you consented. We use this only to contact you about early access, never for marketing or advertising, and we never sell it.

The legal basis is your consent, given by ticking the box on the sign-up form. You can withdraw it and ask us to delete your entry at any time. We keep waiting-list entries only until launch and a short period afterwards, then delete them. Your email is not stored together with your IP address; as with any web request, your IP reaches our hosting processor as a normal part of how the internet works (see “Who processes it on our behalf” below).

• Account — your email address and (if you used Google) your Google display name and avatar URL, stored by our authentication provider.
• Profile — a display name you can edit.
• Household financial data — incomes, fixed expenses, variable estimates, allocation buckets, individual expenses (amount, date, category, optional note), and analysis summaries you generate.
• Optional inputs — receipt photos, short voice memos, and pasted bank-statement text you submit to the AI capture tools. These are sent to the AI provider only to extract the transaction, are not stored as files, and are discarded from our servers once the extraction completes.
• Operational metadata — credit usage counters (which AI actions your household ran and when), notification preferences, and push-subscription endpoints if you opt in.

We do not collect bank credentials, card numbers, government IDs, location, contacts, or advertising identifiers. There is no advertising SDK, no third-party analytics, and no cross-site tracking.

Financial data belongs to a household. Only members of that specific household can read it. This is enforced in the database with row-level security policies: every read and write is checked against your membership before it runs. Data never leaves your household and is not aggregated, shared, or exposed to members of other households.

The developer does not read household financial data from the live database as a normal operation, and does not use it as a user. Administrative database access exists only for emergency recovery (e.g. restoring a broken record you asked us to fix) and is not used to browse or export household data.

• Hosting & database — the app runs on managed cloud infrastructure (Cloudflare edge workers) with a Postgres database provided by Supabase (hosted in the EU). They process data on our behalf as sub-processors.
• Authentication — Supabase Auth handles email/password and Google sign-in. If you use Google, Google receives standard OAuth metadata.
• AI features — when you use the coach, receipt/photo parsing, voice memo, or bank-statement import, the relevant text or media is sent to a third-party AI model provider via the Lovable AI Gateway solely to compute the response. It is not used to train models by us, and we ask providers not to retain it beyond the request.
• Push notifications — if you opt in, browser push endpoints (Apple, Google, Mozilla) receive the encrypted notification payload.

All of these are processors, not independent controllers of your household data.

Several bynku features are powered by an artificial-intelligence model. To be clear and in line with the EU AI Act’s transparency principle, we label these in the app so you always know when you are looking at AI output.

The AI-powered features are:

• The coach — the chat, the overview it writes, and the proactive nudges in the coach inbox are generated by an AI model.
• Chat-based setup — the conversational onboarding that turns what you type into draft entries you confirm.
• Capture tools — reading receipts, photos, voice memos, and bank-statement text to suggest transactions and categories.

When you use these, the relevant text or media is sent to a third-party AI model provider via the Lovable AI Gateway solely to compute the response (see “Who processes it on our behalf” above). A few things to keep in mind:

• It can be wrong. AI output can be inaccurate or incomplete. Always review figures and categories before you rely on or save them.
• No human reviews each message. Responses are produced automatically, not checked by a person before you see them.
• It is educational, not regulated advice. bynku helps you understand your own numbers. It does not provide regulated financial, investment, tax, or legal advice, and it does not assess your creditworthiness or assign a credit score.
• You are in control. AI features run only when you actively use them, and you can turn them off at any time.

• Contract — storing incomes, expenses, buckets and running calculations is necessary to provide the service you asked for.
• Consent — AI features, push notifications, and receipt/photo uploads run only when you actively use them.
• Legitimate interest — minimal security logging (failed logins, rate-limit counters) to prevent abuse.

Your data stays until you delete it. When you erase your account or your household from Settings → Privacy, all associated rows are removed from the live database immediately. Encrypted backups may retain deleted rows for up to 30 days before rolling off. AI request payloads are not retained beyond the request.

Under GDPR you can, at any time:

• Access — see everything the app holds about you (visible in the app itself).
• Rectify — edit or correct entries directly in the app.
• Erase — delete your account or your entire household from Settings → Privacy. This is a hard delete, not a soft flag.
• Export — request a JSON export of your household data by email.
• Withdraw consent — turn off AI features and notifications at any time.
• Complain — you can lodge a complaint with your national data protection authority.

• All traffic uses HTTPS (TLS 1.2+).
• Passwords are hashed by Supabase Auth; the app never sees them.
• Row-level security policies scope every query to your household.
• Service-role credentials stay on the server and are never shipped to browsers.
• An allowlist restricts sign-in to invited test accounts during the beta.

No system is perfectly secure. Only enter data you are comfortable storing in a beta product.

We use one first-party storage item per browser to keep you signed in (Supabase Auth session) and a small local preference for theme and dismissed tips. No advertising cookies, no third-party analytics.

If we materially change how data is used, we will update the “Last updated” date at the top and notify signed-in users in-app before the change takes effect.