Privacy Policy — Loki Budget

Effective date: 2026-07-28 Last updated: 2026-11-08

1. Who we are

Loki Budget is operated by UnstablePixel SRL (the "Controller").

Company name: UnstablePixel SRL
Registered address: Str. Victor Babeș nr. 2, Oradea, Bihor, Romania
Privacy contact: privacy@unstablepixel.com

For any question about your personal data or to exercise the rights described in Section 8, write to the privacy contact above. We answer within 30 days (one 60-day extension may apply for genuinely complex requests).

2. What this policy covers

The Loki Budget mobile app (iOS and Android), the web onboarding + payment surfaces at budget.loki.unstablepixel.com, and the supporting backend API that those clients talk to.

It does not cover:

AI providers you connect to your account (Claude, ChatGPT, others). When you connect one, data you choose to share with it is processed by that provider under their own privacy policy. We disclose the data at your explicit request, recorded by the consent screen you confirm during connection. See Section 7.

3. Data we collect

Category	Examples	Lawful basis	How we get it
Account identity	Firebase user id, email, display name	Contract (Art. 6(1)(b)) — needed to provide the service	From Firebase, when you sign in with Google or Apple
Onboarding profile	Preferred currency, monthly income estimate (optional), setup choices	Contract	You enter it during onboarding
Accounts	Each account's name (alias), type, the bank's name (optional) and its IBAN (optional), shown masked in the app	Contract	You add them in the app, or your assistant adds them when you share a statement
Cards on an account	The last four digits and/or the wallet's name for a card, so a payment can be matched to the account that paid. Only the last four digits are ever stored	Contract	You or your assistant add them
Transaction data	Amount (integer minor units), date, description, category, notes, and the bank's own reference for imported lines	Contract	You log it in the app, import a CSV, or your assistant imports a bank statement you share with it
Receipts	A receipt you attach to a transaction: the shop, the date, the card's last four digits, and its items (name, quantity as printed, price, category)	Contract	You or your assistant add them, one receipt at a time
Category + budget data	Category names, monthly budget allocations, roll-over rules	Contract	You create them in the app
Savings goals	Goal name, target amount, target date, contributions	Contract	You create them in the app
Derived insights	Monthly summaries, category totals, goal progress	Contract	Computed from your transaction data
Subscription data	Your subscription status, billing cadence and current period end; for web purchases the Stripe customer id, for App Store purchases the store product and transaction reference	Contract — needed to grant paid features	Sent to this app by our subscription service, after a payment through Stripe (web) or the App Store (confirmed through RevenueCat)
Setup analytics	Anonymous counts of which onboarding questions were shown, answered or skipped, and whether you reached the result, the paywall and the connect step. No user id, no device id, no IP address, never your answers	Legitimate interest (Art. 6(1)(f)): to see which setup question people give up on, so we can fix it. The data can't be tied to you, and you can turn it off in Settings	Sent from the app to our server, which passes the counts to New Relic (EU) without your IP address
AI-connector consents	Your user id, the connected AI's client id, the scopes granted, the timestamp	Consent (Art. 6(1)(a))	Recorded by the OAuth consent screen when you connect an AI
Tool audit log	Your user id, MCP tool called, a SHA-256 hash of the arguments (never the arguments themselves), latency, calling client, and — when the call failed — the error message the AI was shown, which can quote back a value it sent us	Legitimate interest (Art. 6(1)(f)) — security, abuse prevention, debugging	Server-side per request
AI activity log	Your user id, which AI acted, and a short display line for each write it made on your behalf (e.g. "Logged Groceries · 12.50 EUR")	Contract — it is the in-app record of what touched your data	Server-side, when a connected AI writes
Crash diagnostics	Stack traces, device model, OS version, app version	Legitimate interest — keep the app working	Firebase Crashlytics, when an error occurs
Backend telemetry	Request traces, error rates, response times, server logs	Legitimate interest	Server-side, no user-content payload, sent to New Relic (EU)

We do not collect:

Full card numbers, card security codes, or credentials for your bank. Loki Budget does not connect to your bank. You enter transactions yourself, import a CSV you exported, or share a statement with your assistant. An account's IBAN is stored only if you add it, so statements can find the right account. If we ever add bank aggregation, it will be an explicit opt-in with a separate consent.
Behavioural tracking for advertising. The app has no ad SDKs.
Your location.
Your contacts, calendar, photos, microphone, or camera.

Note on sensitivity. Financial transaction data is sensitive and handled with care, but under GDPR it is not special-category data under Article 9. We treat it with the same rigour we treat any personal data (encryption, scope-tight access, minimal retention) but we do not claim Article 9 protections we cannot honour.

Note on receipts. Receipt items show what you bought. They are stored only when you itemise a receipt, used only to split that payment across categories, and never analysed or profiled by us. If you connect an assistant, it can read them like the rest of your Budget data.

4. Why we collect each category

In short: to run the service you signed up for, to keep it working, and to satisfy a few specific obligations.

Account, onboarding, transaction, budget, goal, subscription data — needed to deliver the app's core function. Without them, there is no product.
AI-connector consents — recorded so that when you authorise Claude or ChatGPT to read your transactions, that authorisation is documented and revocable.
Tool audit log — to detect abuse and to debug AI-tool failures. We store a hash of the arguments, not the arguments themselves. A failed call also keeps the error message the AI was shown, because that message is the whole point of a debugging record.
AI activity log — so the Activity screen can show you what a connected AI did on your behalf, including what it tried and failed to do. It exists to be read by you.
Crash diagnostics + backend telemetry — to know when the app is broken so we can fix it. We don't profile you with this data.

We use these processors to run the service. Each acts on our documented instructions; each is bound by a Data Processing Agreement.

Processor	What they do	Where data is processed	Transfer mechanism
Microsoft Azure	Hosting, Postgres database, Key Vault, Blob storage	EU region (West Europe / North Europe)	Intra-EU — no transfer mechanism needed
Google Firebase	Authentication, Crashlytics	EU where supported; Crashlytics has fixed regions	EU–US Data Privacy Framework + Standard Contractual Clauses
Stripe	Card payment processing for web purchases	US (Stripe holds card data; we never see card numbers)	EU–US DPF + SCCs
RevenueCat	Confirms App Store purchases and their renewals, keyed by your Loki user id	US	EU–US DPF + SCCs
New Relic	Backend telemetry and logs; the anonymous setup counts (off in Settings)	EU region	Intra-EU — no transfer mechanism needed
The AI provider you connect	Whatever you ask it to do with your data	The provider's regions	Disclosure happens at your explicit request via OAuth consent

Apple's App Store sells in-app subscriptions as the seller, under Apple's own terms and privacy policy; Apple is not a processor of ours. We receive only what we need to grant access (the product, the status, the renewal date), never your payment details.

We do not sell personal data. We do not share it with advertisers.

6. How long we keep it

Account, transaction, budget and goal data — for as long as your account is active.
Subscription record: your subscription status, billing cadence and current period end, plus the Stripe customer and subscription ids for a web purchase, or the App Store reference for one made on your phone. This one is kept after you delete your Loki Budget data. It is the record of a commercial relationship that may still be live, so it is how we know that a payment you are still making entitles you, and it is part of our billing trail. Retained under Art. 6(1)(b), because the contract is still running, and, for the billing trail, Art. 6(1)(c). It is kept for as long as the Loki sign-in it belongs to, and it is removed when your whole Loki account is removed (Section 8): we cancel the subscription first, then delete the record together with the sign-in.
Tool audit log — 90 days from each entry, then deleted.
AI activity log — 30 days from each entry, and at most the 1000 most recent entries per account, then deleted.
Crash diagnostics — Firebase Crashlytics default retention (currently 90 days for crashes, 30 days for non-fatal events).
Backup snapshots of the Postgres database — 7 days rolling.

When you delete your Loki Budget data (Section 8), every category above is removed from our systems within 30 days, with two exceptions:

Your account identity: the Firebase user id, email and display name you sign in with (the first row of Section 3). That sign-in is shared across every Loki app, so deleting it from inside Loki Budget would lock you out of the other apps' data and of your subscription.
Your subscription record, for the reason given in its bullet above: the commercial relationship can outlive the data, and dropping our copy of it would leave you paying for a plan this app no longer knows about. Deleting your Loki Budget data does not cancel your subscription.

Both stay until you delete your whole Loki account: Delete my Loki account, the last option under Settings → Account → Delete my Budget data, or the same option at loki.unstablepixel.com/account (Section 8). You can also ask us at the privacy address in Section 1, and we handle that within the same 30 days. Be aware of the knock-on: because the subscription record is keyed to that shared sign-in, signing back in to Loki Budget with the same account restores your paid access. Your transactions, accounts, budgets and goals do not come back; the subscription does. The audit-log entries are deleted along with your Loki Budget data; we do not retain a "tombstoned" trail of past activity. Every AI connector you authorised goes with it too: deleting your data withdraws each connection and deletes its consent record (Section 3, "AI-connector consents"), so no AI can reach the account afterwards, and signing back in does not reconnect one — you would have to connect it again.

7. AI connectors (Claude, ChatGPT, others)

This is unusual enough to deserve its own section.

Loki Budget doesn't send your data to any AI company. Neither the app nor our servers use an AI provider. Your data reaches an AI only if you connect your own assistant, and that is up to you: you can change or disconnect it any time.

The app lets you connect an AI assistant — Claude, ChatGPT, or any other client that supports the Model Context Protocol — to your account. Once connected, that AI can call a defined set of tools against your data (read your transactions, log a new one, adjust a budget, etc.) only within the scopes you explicitly granted at the OAuth consent screen.

What this means in plain terms:

The AI provider becomes a recipient of whatever data you ask it to see. Your conversation with the AI is governed by their privacy policy, not ours.
You can revoke a connector at any time from Settings. We honor the revocation immediately — the next tool call from that AI returns unauthorised.
We log each tool call (Section 3, "Tool audit log") for security: a hash of the arguments, not the content — plus, when the call failed, the error message the AI was shown.

If you do not connect any AI, no AI provider receives any of your data.

8. Your rights

Under the GDPR you have eight rights over your personal data. The app implements concrete mechanisms for the ones that need them:

Right	How to exercise it
Be informed	This document
Access (a copy of your data)	Settings → Download my data — returns a JSON bundle of everything we hold
Rectification	Edit the underlying data in the app (transactions, budgets, goals, profile)
Erasure — your Budget data	Settings → Account → Delete my Budget data — removes your Loki Budget data within 30 days and signs you out; your shared Loki sign-in and your subscription record stay, and your subscription is not cancelled (Section 6)
Erasure — your whole Loki account	Settings → Account → Delete my Budget data → Delete my Loki account, or the same option on your account page at `loki.unstablepixel.com/account` — deletes your data in every Loki app, any assistant you connected, your subscription record and your sign-in, and cancels a subscription you bought on the web. A subscription billed by the App Store or Google Play only you can cancel, in the store, so cancel it there first: the app names it before anything is deleted. It cannot be undone. You can also ask us at the privacy address in Section 1
Restrict processing	Disconnect AI connectors, disable optional features
Portability	The export endpoint returns a structured machine-readable JSON
Object	Settings → Anonymous setup counts turns the setup counts off; disconnect AI connectors; email the privacy contact for anything else
Avoid automated decision-making	Not applicable — we make no automated decisions with legal or significant effect

If you believe we have mishandled your data, you have the right to lodge a complaint with your local supervisory authority. In Romania this is the ANSPDCP (https://www.dataprotection.ro/).

9. International data transfers

Our infrastructure is in the EU. The cross-border transfers that happen are documented in Section 5. Each one has a valid Article 46 transfer mechanism (EU–US Data Privacy Framework certification + Standard Contractual Clauses) where the processor is outside the EU.

Connecting an AI provider is a transfer that happens at your explicit instruction under Article 49(1)(a) — we disclose it clearly via the OAuth consent screen and you can refuse.

10. Children

Loki Budget is not directed to anyone under 16. We do not knowingly collect personal data from children. If you become aware that a child has provided personal data through the service, contact the privacy address in Section 1 and we will delete it.

11. Security

We follow GDPR Article 32 — appropriate technical and organisational measures. In specific terms:

TLS 1.2 or higher in transit, everywhere.
AES-256 encryption at rest on the database (Azure default).
Secrets in Azure Key Vault, never in source control or configuration files.
The backend's authorisation server scopes every API call to the user it was issued to; one user cannot see another user's data by construction.
Money is stored as integer minor units (cents) — never floats — so rounding cannot silently corrupt a balance.

No system is breach-proof. If a personal-data breach occurs we will notify the supervisory authority within 72 hours and, where the risk to you is high, notify you directly.

12. Cookies (web surfaces)

The web onboarding and payment pages use only strictly necessary cookies before consent — the session cookie that keeps you signed in, the CSRF token, and the consent record itself. We do not run advertising trackers. If we ever introduce optional analytics on the web surface, you will see a separate opt-in banner before any analytics cookie loads.

13. Changes to this policy

We may update this policy when the service changes or the law requires. The "Last updated" date at the top is the canonical version marker: when it changes, this document has changed, and the copy published at this address is always the current one.

There is no in-app step that asks you to re-acknowledge a new version. When a change is material (a new category of data, a new recipient, a longer retention period, or anything that narrows your rights) we announce it in the app's What's new, on the next launch after you update. Where a change needs your consent, we ask for it before it applies to you, on the screen that switches that feature on, the way connecting an AI asks at its consent screen (Section 7).

14. Contact

For privacy questions, data subject requests, or anything in this document that doesn't read clearly to you, write to:

privacy@unstablepixel.com UnstablePixel SRL — Str. Victor Babeș nr. 2, Oradea, Bihor, Romania