Privacy policy

Who we are

Skarb is a personal project built and operated by Oleksii Volkov, an individual developer based in Ukraine. He is the data controller for the personal data described in this policy. Skarb is not a company product and has no employees.

This policy covers the Skarb app on every Apple device it runs on, such as iPhone, iPad and Apple Silicon Macs, and the website skarb-budget.com.

For anything in this policy, write to support@skarb-budget.com. We answer in English or Ukrainian.

What we collect

Skarb stores only what the app needs to work. Nothing is collected in the background that you did not enter or allow.

What you enter. Transactions (income or expense, amount, currency and the exchange rate used, date, merchant or payer, note, category, the balance and budget they belong to, and a repeat schedule if you set one), categories, budgets, balances with an optional credit limit and the deposits, withdrawals and transfers you record on them, savings goals, workspace names and settings, the invites you create, and the files you attach to transactions. All of this is yours. We use it only to run Skarb: to show it to you and to the people you share a workspace with, to fill in a draft when you use AI-assisted entry, to send the notifications you allow, to delete it when you ask, and to fix a problem you report.

Account data. An account identifier generated by Firebase Authentication. If you continue as a guest, it is anonymous: no name or email comes with it. If you sign up or link a sign-in method, your email address (for email sign-in), or the identifier, email address and name that Apple or Google pass to us. A display name: until you change it, the name you gave when you signed up or the name Apple or Google sent, and with none of these, the part of your email address before the @. The other members of your shared workspaces see it. An avatar, which is a chosen colour, gradient or emoji, never an uploaded picture. Your profile also holds the list of files you have stored (name, size, date, and the workspace and transaction each belongs to), which only you can see, and, if an owner deletes a workspace you belong to, a short notice naming it until the app has shown it to you.

Device data. A push notification token and a random identifier for the device, if you allow notifications, stored with the language you use Skarb in so notifications arrive in it. Your switches for workspace-activity notifications, stored on your profile because the server that sends them is the one that reads them. Stored on the device only: the appearance setting, reminder and budget-alert switches, the App Lock setting, a cache of exchange rates, and small records the app keeps for itself, such as which budget alerts have already fired, the workspace you last opened and whether you have finished the intro.

Activity history. Changes in a workspace (a transaction added, a budget edited, a member joined) are recorded in that workspace's activity feed, with who made them, the name of what changed and when.

Technical data. Like any internet service, the servers we rely on record technical details of each request: your IP address, device type and the time. Firebase Authentication records when your account was created and when you last signed in, and keeps the IP addresses of sign-ins for a few weeks, for security. Firebase Hosting keeps standard web-server logs for the website and for invite links, and our server functions log your account identifier, counts and error types, never names, emails or file paths. We do not combine these logs with your money data.

Support messages. If you write to us, we keep the email thread so we can answer you and follow up.

What we do not collect. No advertising identifier, no location, no contacts, no bank or card credentials (Skarb does not connect to your bank), no audio (voice entry is recognised on your device, and only the recognised text is used), and no analytics or crash reports sent by the app.

Where it is stored

Your money data and your profile are stored in Google Cloud Firestore, in Google's eur3 multi-region in the European Union. The files you attach to transactions are stored in Cloud Storage for Firebase, in Google's us-east1 region in the United States (see International transfers below). We run no servers of our own: Skarb's few server functions, which send activity notifications and delete accounts and workspaces, run on Google Cloud in the European Union. Google processes this data on our behalf under its data processing terms, summarised in Privacy and Security in Firebase.

The copy on your device is Firestore's offline cache. It is what lets the app work without a connection, and it syncs when the connection returns. There is no separate database on the device. Besides the cache, the app keeps the small records listed under Device data, the reminders and alerts it has scheduled, its sign-in sessions, and the system's network cache, which can hold your AI-assisted entry requests. Signing out leaves the cached copy on the device; deleting your account clears it from the device you delete it on, the next time the app opens.

Exchange rates come from Frankfurter, a public rate service. A rate request contains only currency codes and dates, no account or device identifier, and the result is cached on your device. Frankfurter says it does not log IP addresses or requests.

Data in transit is encrypted with TLS, and Google encrypts it at rest by default. Firebase security rules control access to the database: a signed-in person can read only the workspaces they are a member of, and within them only the sections their access covers. Attached files are protected differently: each has a long random address that only someone who can see its transaction learns, and anyone signed in who keeps that address, such as someone who saw the file before they left the workspace, can still open the file until it is deleted. As the administrator of the Firebase project, the developer can see the database, the stored files and the list of accounts, and looks at them only to fix a problem you report. No service can promise perfect security, and we do not. Your part is the device: keep a passcode on it, turn on App Lock in Skarb if other people pick up your phone, and share invite links only with the people you mean to.

Signing in

Sign-in is handled by Firebase Authentication, a Google service. You can start without an account: tap Continue as guest and you get a random account identifier, nothing is asked of you, and you can track money straight away. You can also sign in with Apple, Google or email from the start. For a guest, linking a sign-in method is what lets you use a second device, get the account back and share a workspace.

You can sign in with, or later link:

• Email and password. We store the address. The password is held by Firebase Authentication in hashed form and we never see it.
• Sign in with Apple. Apple passes us a stable identifier, an email address and, on the very first sign-in only, your name. If you choose Hide My Email, the address we receive is Apple's private relay address, not your real one. Apple explains what it shares on its Sign in with Apple page.
• Google. Google passes us your Google account identifier, email address, name and a link to your profile picture, which Skarb does not use, under Google's privacy policy.

Linking does not give us access to your Apple ID, your Google account, your mail or your contacts. You can unlink Apple or Google on Profile & Account, as long as one way to sign in remains.

We email you only for account actions you start, such as verifying your address or resetting your password; those messages are sent by Firebase Authentication. There is no newsletter and no marketing email. Skarb's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

AI-assisted entry

When you scan a receipt or type a sentence such as "coffee 3.20 yesterday", that image or that text is sent to OpenAI, which returns a filled-in draft transaction. This happens only when you use one of those entry methods, never in the background, and never for transactions you enter by hand.

What is sent. The receipt photo as a JPEG, or your typed, pasted or dictated text, together with today's date, your workspace's base currency, the app language and the names of your workspace's categories so the draft can pick one. Your name, email address and account identifier are not sent. The request goes straight from your device to OpenAI, so OpenAI also sees your device's IP address, as any server you connect to does.

What happens to it. The draft comes back to your device and nothing is written to your workspace until you tap Add. Skarb uses the photo for that one request and then discards it; we do not store it unless you attach it to the transaction yourself. We do not store the sentence you typed or said either: only the fields you keep end up in the transaction. The one copy that can remain is in your device's network cache (see Where it is stored). OpenAI processes the request for us as a data processor, under its commitments for business customers. It keeps API requests for up to 30 days to detect abuse, then deletes them, and does not use them to train its models.

The draft is a suggestion. You confirm, edit or discard it, and Skarb makes no automated decisions about you.

Voice entry uses Apple's speech recognition on your device. The audio stays on the device; only the recognised text goes to OpenAI, as above. If your language has no on-device model, voice entry is unavailable rather than sent to a server.

A receipt can carry a merchant name, items and amounts, and what you type or paste, such as a bank SMS, can carry anything in it. Do not scan, type or paste anything you would not want processed by a third party.

Attachments

You can attach up to five files to a transaction: photos, scans or PDFs. They are stored in Cloud Storage for Firebase in Google's us-east1 region in the United States, recorded under your account, and count towards a 500 MB allowance per person across all your workspaces. The Storage screen in Profile lists every file you have stored, including files in workspaces you have left, and lets you delete them.

Anyone with access to the section a transaction sits in can open its attachments. Removing an attachment you added deletes the file. If another member removes your attachment, or deletes the transaction it is on, the file stays in your Storage list until you delete it, because only you can delete what you uploaded. The exception is a workspace its owner deletes: every file attached in it goes too, yours included.

What other people see

A workspace is shared only with the people its owner invites, by a code or an invite link. An invite works for seven days, can be used by more than one person until then, and can be revoked at any time. There is no public content, no directory and no way for a stranger to find you or contact you inside the app.

Anyone holding an invite code can see the workspace's name, icon, colour and currency, the owner's name, how many members it has with their initials or avatars, and the role and sections the invite offers, before joining, so share invites only with the people you mean to.

In a shared workspace, other members see the transactions, notes, attachments, budgets, balances, savings goals, reports and history in the sections their access covers, and your display name and avatar on the records you add, in the member list, and next to most changes you make in the activity feed. Balance changes and deposits to or withdrawals from a savings goal are not in the feed. Members who turn on notifications also see your name and what you changed in notifications on their devices. The workspace owner sets each member's role (editor or viewer) and which sections they can see. Ownership moves only when the member it is offered to accepts it. Membership alone shows them nothing of the money. A member cannot see your other workspaces.

If you leave a workspace, or its owner removes you, the entries and files you added stay in it, still under your name and marked as a former member's. If you delete your account, your name comes off them as well (see Deleting your account).

Other disclosures

We do not sell personal data, we do not share it with advertisers or data brokers, and there are no ads. The only companies that handle your data are the service providers named in this policy and the provider that hosts our support mailbox, each under its own terms and only to run the service.

We would disclose data outside that in two cases: if the law requires it, such as a valid request from a court or authority, in which case we disclose only what is required; or if Skarb were handed to a new operator, in which case your data would go with the service under this policy and you would be told before it happens.

Push notifications

If you allow notifications, the app registers a push token for your device with Firebase Cloud Messaging and stores it under your profile, together with a random identifier for the device and the language you use Skarb in. Our server functions read it to send you workspace-activity notifications, such as a member adding a transaction or changing a budget, or the owner deleting a workspace you share, in your language. The token identifies the device, not you by name, and it is used for nothing else.

A notification shows the workspace name and a line naming the member and what they changed, never an amount. It passes through Firebase Cloud Messaging and Apple's push notification service, under Apple's privacy policy, on its way to your device.

Budget alerts and your own reminders are scheduled on the device and need no server at all.

You choose which workspace activity you are told about in the app's Notifications settings. Turning notifications off in your device's Settings stops them. Signing out, exiting a guest session or deleting your account removes the token.

Analytics and tracking

The app contains no analytics, no crash reporting and no advertising SDK. Firebase Analytics and Crashlytics are not included. We do not track you across other apps or websites, we do not use an advertising identifier, and the app never shows an App Tracking Transparency prompt because there is nothing to ask about. If you have turned on sharing with app developers in your device's Analytics settings, Apple may give us the crash reports and usage statistics it collects; Apple collects these, not Skarb, and you can turn it off there.

We do not currently run any analytics on the website. It sets no cookies, and it remembers your light or dark choice in your browser, where that choice stays. If that changes, it will be a cookie-free tool with no cross-site tracking and no advertising network, so no consent banner, and this section will be updated.

Because neither the app nor the website tracks you, a Do Not Track or Global Privacy Control signal from your browser changes nothing: there is nothing to switch off.

How long we keep it

Your data is kept for as long as your account exists. Deleting a transaction, attachment, budget, balance, savings goal or workspace removes it from the live database at once (or as soon as your device is back online), and the offline cache on your devices follows on the next sync. Activity history is kept with the workspace it belongs to, for as long as that workspace exists: deleting a transaction, budget, category or savings goal leaves a line in the feed with the name it had, and no one can delete a line, not even the owner. An invite stays stored after it expires or is revoked, until the workspace is deleted.

Deleting your account removes everything described in the next section. Some things take longer to disappear. A device that is still signed in to the account at that moment is signed out when its session expires, within an hour of it next going online, but the copy in its offline cache stays on it until you delete Skarb from it. Sign out on your other devices first: anything one of them adds before its session expires can be stored again, and if that happens, write to us and we remove it. Cloud Storage keeps deleted files recoverable for 7 days by default, and Google then clears deleted data from its active systems within about two months and from its backups within about six months, as described in Google Cloud's data deletion documentation. Nothing deleted is ever restored to the live database.

If you never link a sign-in method and simply delete the app, the anonymous account and its data stay stored, with no automatic clean-up, and you may not be able to reach them again. Use Exit on Profile & Account before deleting the app if you want them removed.

Logs are kept for a limited time: Firebase Authentication keeps sign-in IP addresses for a few weeks, Firebase Hosting keeps visitors' IP addresses for a few months, and Google Cloud keeps our server functions' logs for 30 days.

Support emails stay in our mailbox while the matter is open and for up to 12 months after it is closed, unless you ask us to delete them sooner.

Deleting your account

1. Open Profile: tap the profile icon at the top right of the Dashboard, or choose Profile in the sidebar on iPad and Mac.
2. Tap your name at the top of Profile to open Profile & Account.
3. Tap Delete Account, then Delete Account again on the next screen, confirming with your password, Apple or Google. You need to be online.

Deletion is permanent: it cannot be undone and there is no grace period. It removes your profile, every workspace you own with its transactions, categories, budgets, balances, savings goals and history, your attachments, the push tokens of your devices and, last, your sign-in and the email address on it. If you signed in with Apple, Skarb also asks Apple to remove it from your Apple ID. If you signed in with Google, you can remove Skarb from your Google account's third-party access page.

A workspace you own and share with other people is deleted with you, for everyone in it, and the other members are told that it was deleted by its owner. If they should keep it, transfer ownership to one of them first (Workspace Settings, then Members) and wait for them to accept. In workspaces owned by someone else, the records you added stay so that the shared books still add up, but your name is removed from them and from the activity feed, the files you attached are deleted, and the entries are shown as made by a deleted account.

If you use Skarb without an account, Exit on Profile & Account deletes the anonymous account and its data the same way.

The support page answers the same question at skarb-budget.com/support#deletion.

Children

Skarb is not directed at children under 16, and we do not knowingly collect personal data from anyone under 16 without a parent's or guardian's consent. A parent or guardian who wants a child in a shared workspace invites them and is responsible for that use; otherwise, if you are under 16, please do not use Skarb. If we learn that we hold an account for a child under 16 without that consent, we delete it. Write to support@skarb-budget.com if you believe that has happened.

Your rights

Most of what privacy laws give you is already in the app. You can see the records in the workspaces and sections you have access to and correct the ones your role lets you edit, export your budgets, with their summary, as a PDF or image from the Budgets screen, change your name and avatar, unlink Apple or Google, switch notifications off, and delete your account. For anything the app does not cover, such as a full copy of your data in a machine-readable format, write to support@skarb-budget.com from the email address on your account. If your account uses Hide My Email, write from any address and quote the address shown on Profile & Account. A guest account has no email address to check, so use the app itself to see, export or delete it. We answer within 30 days.

If you are in the European Economic Area or the United Kingdom, the GDPR gives you the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your local supervisory authority. Our legal bases are: performance of the service you asked for (your account and the money data you enter), your consent (notifications, and AI-assisted entry each time you use it), and our legitimate interest in keeping the service secure.

You can withdraw consent at any time: turn notifications off in your device's Settings or in the app, and simply do not use AI-assisted entry. If you are in Switzerland, the same rights apply under the Federal Act on Data Protection. If you are in Ukraine, you have the equivalent rights under the Law of Ukraine "On Personal Data Protection".

If you live in California or another US state with a privacy law, you have the right to know what personal information we hold about you, to access, correct and delete it, and not to be treated differently for exercising those rights. We do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of. Send requests to support@skarb-budget.com from the email address on your account, which is how we verify them; an authorised agent may write on your behalf with your written permission. If we decline a request, we say why, and you can appeal by replying to that email.

International transfers

Your money data is stored in the European Union. Four things leave it: the files you attach to transactions, which are stored in the United States; the receipt photo or text you send through AI-assisted entry, with your category names, which OpenAI processes in the United States and may process in other countries; the short text of each activity notification (the workspace's name, a member's name and the name of what changed), which Firebase Cloud Messaging and Apple's push service deliver; and your account data, because Firebase Authentication runs only in the United States, so your account identifier, email address, name and sign-in details are processed there. Cloud Messaging, Apple's push service and the Apple and Google sign-in services are global services and may process your data outside the country you live in.

If you are in the European Economic Area, the United Kingdom or Switzerland, these transfers rely on Google's and OpenAI's data processing terms, which include the European Commission's standard contractual clauses, and on the EU-US Data Privacy Framework where the provider is certified under it. If you would rather keep your receipts in the EU, do not attach or scan them: the transaction record itself, with its amount, merchant and note, is stored only in Firestore, in the European Union, and in the offline cache on members' devices.

Changes to this policy

The date at the top moves whenever the text changes. A material change, such as a new third-party service or a new category of data, is announced in the app's release notes and takes effect no earlier than the release it ships with. A change that needs no app release, such as one to the website or our servers, is announced on this page before it takes effect. If Skarb stops using a service named here, this policy is updated in the same release.