Privacy notice

1. Who we are

zapp finance ("the Service") is a private household finance application operated by ItsZapp ("we", "us"). The Service is currently in a closed beta for invited household members. Data controller contact: contact@itszapp.com.

2. What we collect

We collect only what you enter and what is needed to run the Service: account data (username, display name, hashed password); financial planning data you enter (income entries, expenses, budgets, savings goals, debts, payments, salary calculation inputs and results, account balances, notes); and technical data limited to session records (a random token, creation and expiry times) and a minimal audit log of account-level events (for example "settings changed"), which never stores amounts or financial payloads.

3. What we do not collect

No analytics, no tracking pixels, no advertising identifiers, no third-party scripts, no profiling, and no sale or sharing of personal data with third parties. The Service does not connect to your bank.

4. Where data is stored

Data is stored in a MariaDB database hosted on European infrastructure (Hetzner Online GmbH, Germany) under the operator's account, and is not transferred outside the EU/EEA. Passwords are stored as salted scrypt hashes and are never readable by us. Transport is encrypted (HTTPS) when accessed through the public deployment.

5. Legal bases and retention

Processing is based on performance of the service you request (Art. 6(1)(b) GDPR) and our legitimate interest in keeping the Service secure (Art. 6(1)(f)). Data is retained while your account exists. Deleted accounts and their data are removed from the live database within 14 days; database backups roll off within 30 days thereafter.

6. Your rights

Under the GDPR you may request access, rectification, erasure, restriction, portability, or object to processing. Send any request, including formal data-deletion requests, to contact@itszapp.com. We respond within 30 days. You may also lodge a complaint with your local supervisory authority (in the Netherlands: Autoriteit Persoonsgegevens; in Sweden: IMY).

7. Changes

We will post changes to this notice here with an updated effective date. Material changes during the beta are additionally announced in the application.