Legal
Privacy notice
Valnivo is a personal financial planning tool. It shows where your money goes each month and where it could take you over the years. This notice explains, as required by the EU General Data Protection Regulation (GDPR), what the app stores, where, who can read it, and what your rights are. It is written to be read, and every statement in it was checked against the app's own code on the date above.
1. Who is responsible
The data controller is Valnivo Labs, based in Luxembourg, which develops and runs Valnivo. Valnivo Labs is a trade name, not a registered company: if you need the controller named for a formal request or a complaint to a supervisory authority, ask at the address below and it will be given to you. Contact for anything in this notice: privacy@valnivo.eu. Valnivo has no data protection officer: it does not monitor people at scale and processes no special categories of data, so article 37 GDPR does not require one. That assessment is written down and kept.
2. What data, why, and on what basis
| Data | Where it comes from | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|---|
| What you type: income and spending entries — including which of your accounts an entry was paid from, when you say — categories, budgets, regular payments, accounts and investments, debts you record (what is owed, the rate, the payment, your own name for it, and your lender's amortisation table if you paste or import one), countries and currencies, goals, plans for the future, settings. | You. | Running the app for you: showing your figures and your projections. | Performance of a contract, art. 6(1)(b): providing the service you asked for. |
| If you report a bug or suggest a feature: whatever you write in it, and the GitHub account you post it under. This happens on GitHub, not in the app, and the report is public — the forms say so before you post. A copy is made in a private repository so nothing is missed; nothing is ever copied back. | You, by posting it. | Fixing what is broken and deciding what to build. | Legitimate interests, art. 6(1)(f): improving the service. Nothing obliges you to post, and no figure of yours is attached — only what you choose to write. |
| When you sign in: your name, email address, profile-picture address and Google account identifier. | Your Google account, through Google sign-in, with your permission at the moment you sign in. | Signing you in, keeping your data separate from everyone else's, showing who is who in a joint space. | Performance of a contract, art. 6(1)(b). |
| If you switch on push reminders: a delivery token for your browser or phone, and one short generic note per day ("2 regular payments are due today") with no amounts, names or categories. | Created by your device and by the app on your device. | Sending you the reminders you asked for. | Performance of a contract, art. 6(1)(b), at your request; switch it off at any time. |
| Technical data any web server sees: your network (IP) address and request logs, held briefly by Google. | Your connection, automatically. | Serving the pages, security, abuse prevention. | Legitimate interest, art. 6(1)(f): a working and secure service. The interest is narrow (delivering a page you asked for and keeping the database from abuse), the data is what every website receives, it is kept for a short time and used for nothing else, so it does not override your interests. |
| If you import a bank statement: the dates, amounts, payees, references and account number printed in the file you choose. | A file you download from your bank and pick yourself. Valnivo is not connected to your bank. | Turning a statement into entries in your ledger, so you do not type them. | Performance of a contract, art. 6(1)(b), at your request. The file is read by code running in your browser; it is not uploaded, and it is not stored — only the entries you confirm are kept, as part of your ledger. |
| While a feature is open only to chosen testers: a record kept by the controller listing which features your email address may use. It contains your email address and one yes/no per feature, nothing else. | Written by the controller, using the email address of the account you sign in with. | Letting a small number of people try a feature before it is opened to everyone. | Legitimate interest, art. 6(1)(f): testing a feature with willing users before release. The data is one address you already gave by signing in plus a yes/no, only you can read your own record, and it is deleted when the feature opens or you ask. |
| Which optional features are switched on: one small document describing the app, not you. Reading it sends no data about you beyond the ordinary network details of any request. | Read from Google Firebase when you open Import and export in Settings, or when you sign in. Never at start-up. | Knowing whether to offer an optional feature, so it can be opened or closed without publishing a new version of the app. | Legitimate interest, art. 6(1)(f): running the service. It is a single read of a public switch, carries nothing of yours, and happens only when you go looking for such a feature. |
| The year you were born, if you choose to give it. Optional, and one of only two things Valnivo asks about your person rather than your money — the other is the country you are paid from, below. It exists so that a goal can be set at an age — “retire at 62” — instead of a date, which is meaningless unless the app knows how old you are. A year, never a full date of birth: four digits is the least that answers the question. It is part of your ledger like everything else you type, so it is on your device and, if you have sync on, inside the sealed copy — which Valnivo Labs cannot read. It is used only on your own device, to turn an age into a date and back. Leave it empty and the app never mentions an age. | Typed by you in Settings, never derived from anything and never asked for anywhere else. | Letting you set and read a long goal in the terms you actually think in. | Art. 6(1)(b), at your request: you supply it or you do not, and nothing else changes either way. |
| The country you are paid from, if it is not the one you live in. Optional, and the second thing this app asks about your person rather than your money. The ledger has always held the country you live in and the countries your money is in; this one says where your income comes from, which for anybody living on one side of a border and working on the other is the fact the rest of it turns on. It decides which pair of countries a comparison opens on and where income is counted in the per-country summary. No tax or social security is worked out from it: the separate income-tax and take-home-pay calculators use only what you type into them, and never read it. It is part of your ledger like everything else you type, so it is on your device and, if you have sync on, inside the sealed copy — which Valnivo Labs cannot read. It is never sent anywhere. Leave it unset and the app treats your pay as coming from where you live, which is what it did before this existed. | Chosen by you in Settings, from the countries already in your ledger. Never derived, and never asked for anywhere else. | Showing a comparison between the two countries your money actually crosses, without asking you to name them again. | Art. 6(1)(b), at your request: you set it or you do not, and nothing else changes either way. |
| That you recorded something in a joint space. Only if another member has asked to be told. One record a day, per person telling and per person told, holding the space's identifier, both people's account identifiers, the date, and how many things of each kind were recorded. It carries no amount, no category, no payee, no note and no message of any kind — the record has no field a sentence could be written in, and the database refuses one. The words you receive ("Sofia recorded 3 entries in Household") are built from the space's name and members, which are not encrypted because the database has to route on them. If your own device holds the space, it fills in what the entries were, on the device, and nothing about that travels. | Written by the other member's device after they record something, if you switched this on for that space. | Telling you that something changed in money you share, so you can go and look. | Legitimate interest, art. 6(1)(f): it exists only because you asked to be told, you can switch it off in the same place, and it says nothing about a person that the members of that space could not already see. It is deleted as soon as it is delivered. |
| A projection or a comparison you choose to share. When you make a share link, one dated snapshot is sealed and stored so that whoever you send the link to can open it. For a projection that is figures a year at a time, the currency, the date and the two assumptions behind them; for a rent or buy or same pay across a border comparison it is the figures you typed into it, the rates it used and the two country codes. It carries no entries, no accounts, no categories, no goals, no name, no email address and no account identifier: nothing that says whose it is or where it came from. The key that opens it exists only inside the link. | Derived from your own figures, on your device, when you press "Make a link". | Letting you show somebody your projection without giving them access to anything else. | Performance of a contract, art. 6(1)(b), at your request — nothing is stored unless you press the button. You are the one disclosing it: you decide who receives the link, and anyone who has it can see those figures until it dies. Valnivo holds a sealed blob and cannot read it, and because the key travels in the part of the address that browsers never send to a server, we cannot tell which link was opened, or by whom. A link lasts between one hour and 48 hours, whichever you chose, and you can revoke it before then in Settings. |
| If you make a donation: your email address, the amount, the date, and the card's brand, country and last four digits. This happens on a page Stripe hosts, not here — you leave this site to make it, Stripe collects your payment details on its own page, and Valnivo never sees a card number. Those details are in Stripe's dashboard, which Valnivo Labs can read; nothing about a donation is written into the app, into your ledger or into your online copy, and a donation is not attached to any Valnivo account. The app is never told that you donated. | You, by donating on Stripe's page. | Receiving the gift, and keeping the record of money received that follows from having received it. | Performance of a contract, art. 6(1)(b), for taking the payment you asked to make, and a legal obligation, art. 6(1)(c), for the accounting record of it. A donation buys nothing — section 2a of the terms of use says so — so you are owed nothing and no record of any entitlement exists. |
| A loan you record with another Valnivo user, if you use it: the amount, the currency, the day it was lent, when it is to be paid back, a note, both names as written on it, and each repayment either of you records; the borrower's email address as the lender typed it; the address each of you is signed in with, recorded when the lender proposes and when the borrower opens it, so that the record shows which account signed; and a signed history of every step — which of you took it (your account identifier), what it was, the server's time, and a signature made on your device with a key that never leaves it. A signed loan is never edited: if the lender corrects it, the corrected terms are a new loan that names the one it replaces and what was already paid back under it, and both of you sign that too. | You and the other person, each for the steps you take. | Keeping a record the two of you signed, so that each of you holds the same terms and anyone you show a copy to can check it is authentic. No money moves and no interest is charged. | Performance of a contract, art. 6(1)(b), for your own steps. For the other person's name and address, which the lender types: the legitimate interest, art. 6(1)(f), of the two people in keeping a record of a loan between them. The other person sees the record before signing anything and may decline. |
| If you ask Valnivo to timestamp a file (for now, a saved loan PDF): the file's fingerprint — its SHA-256, 64 characters from which the file cannot be rebuilt — together with your sign-in, which identifies your account, and, as any request does, your network address. The file itself never leaves your device: it is read in your browser and only the fingerprint is sent. What comes back is Valnivo's signed statement that this fingerprint existed at that time, which you keep beside the file. | You, by pressing the button and choosing the file. | Signing the timestamp you asked for, and limiting each account to a number of timestamps a day so the service cannot be used to sign in bulk. | Performance of a contract, art. 6(1)(b): providing the timestamp you asked for. |
| If you write to one of Valnivo's addresses — privacy@, contact@, support@, commercial@ or sales@valnivo.eu: your email address, what you write, and anything you attach. It is kept apart from the app: nothing you write is copied into it or linked to a Valnivo account. | You, by writing. | Answering you: a request under your rights, a deletion request, a complaint or a question. | A legal obligation, art. 6(1)(c), for a request under your GDPR rights. Otherwise legitimate interest, art. 6(1)(f): answering somebody who chose to write, using what they wrote for nothing else. |
What you have to provide, and what happens if you do not
Nothing is required to use Valnivo. You may use the whole app without signing in, in which case no account exists and none of the account data above is collected. Signing in is optional; if you choose it, Google sign-in necessarily provides your name, email address, picture and identifier, and without them the account features cannot be provided. Without signing in you will not have an online copy on other devices, joint spaces or push reminders; everything else works.
Opening Valnivo inside Valnivo Home
Valnivo Home is a separate Valnivo Labs site. When you are signed in there and it opens Valnivo, Home proves that sign-in to Valnivo, and Valnivo creates an account for the same user id if you do not already have one here. That account is new. It is not joined to a Google account you already use on valnivo.eu, and the ledger you keep on this site stays on this site. What you enter is still sealed as the rest of this notice describes. Signing in on valnivo.eu itself does not use the Home account. Valnivo Home’s own notice, on that site, describes the dashboard.
No automated decisions, no profiling
Valnivo does not use your personal data for automated decision-making or profiling that produces legal effects or similarly significant effects concerning you. The projections are arithmetic you ask for on figures you entered, run on your own device; nobody and nothing evaluates you, ranks you or decides anything about you. Your data is never used for advertising and never used to train anything.
The app never asks for bank credentials or card numbers, and it does not connect to your bank: it cannot see your accounts, cannot move money, and has no access to anything you have not handed it. Importing a statement means picking a file you downloaded yourself; the account number printed in that file is read on your device to tell one statement from another and is not stored in your ledger or sent anywhere. A statement can also name people you paid; that is your own household record, it stays with your entries, and if you keep an online copy it is sealed on your device first (section 3), so nobody else — including Valnivo Labs — can read it.
3. Where it is kept, and who can read it
Your financial entries stay on your device unless you sign in. They are saved in the browser's storage (IndexedDB), as the browser stores it, not additionally encrypted by the app; protect them with your device's own lock. When you sign in with Google, a copy is kept in Google Firebase (Cloud Firestore) so you see the same figures on your phone and your computer.
What leaves your device when you do not sign in. Loading the app is a web request to Google Firebase Hosting, which, like any website, sees your network address and request details briefly (section 2). The app's code, fonts and images are all served from there; nothing is loaded from any other server. When you ask for a live inflation figure or exchange rate (by pressing the button, or when you add a country that has no built-in figures), a request goes to the public statistics source in section 4 carrying the country or currency code and, as any request does, your network address. No figure of yours is ever included. Opening Import and export in Settings reads the one switch document described in section 2, which asks a question about the app and says nothing about you. There are no analytics and no tracking of any kind.
Closing prices are the one fetch that says something about what you hold, which is why it is switched off unless you ask for it. If you use it, pressing to price one of your investments sends that investment's ticker symbol — and your own key for the price service — to that service, along with your network address as any request carries. That is more than the country and currency codes every other live figure sends, because a ticker says what you own, so it is said plainly here rather than left to be noticed: it is a disclosure to a third party, one instrument at a time, only when you press, and never on a schedule or in the background. The key is yours, not ours. Valnivo ships none, so you create a free one with the price service and paste it into Settings; the agreement is between you and them, and it is stored in your ledger exactly as your figures are. No figure of yours, no account identifier and no cookie is ever sent with it, and the price that comes back is only ever shown to you — nothing is recorded against your investment until you accept it.
A statement you import is read on your device. The file is opened by code running in your browser — the XML, MT940 or PDF is parsed there, including the PDF reader itself — and neither the file nor any line of it is uploaded anywhere. Nothing is sent to a server to be recognised, and there is no optical character recognition: a scanned statement simply yields no text and is reported as unreadable. What survives the import is the entries you confirmed, which are part of your ledger and treated exactly like entries you typed.
The online copy is encrypted end-to-end. Your entries, budgets, accounts, goals and plans are sealed on your device (AES-GCM, with a key derived from a random seed generated on your device) before they are sent. If you choose to keep a recovery code, the seed is shown to you once as that code; either way it is never sent anywhere in readable form. Google stores sealed data it cannot read, and neither can Valnivo Labs. The database is also limited by security rules to your own account. Your Google sign-in on its own cannot reconstruct the key: to read your online copy on a new device you need the sign-in and the recovery code, or a passkey you set up. A passkey works cryptographically, not as a mere login: the seed is sealed with a secret the passkey itself produces and stored in your private record, so only that passkey can unseal it. If the code and every unlocked device are lost, nobody can recover the online copy, and that is by design.
What is not encrypted, because the service needs it to work: your name, email address and profile-picture address from Google; for a joint space, its name and the names and emails of its members; your push delivery tokens and the short reminder notes described in section 2; your public key; and, for a loan between two users, the parts listed as not sealed further down this section, which include the address each of you signed with. Nobody outside the space, or outside your account, can see any of that except the public key, which is public by nature and reveals nothing.
Valnivo Labs holds an administrative credential for the database (it is what the scheduled job in section 4 uses). With it, the most that can be read is the unencrypted data in the previous paragraph and the sealed documents themselves, which are ciphertext. Your ledger cannot be read from outside your devices, by anyone.
A joint space shared with a partner or family is encrypted the same way, with its own key. A member of that space can ask to be told when you record something in it; if they do, they are told that you did and how many things, never what they were, and you can see in the space's settings that they are receiving them. That key is wrapped for each member on the device of the member who invites them, using the invitee's public key (elliptic-curve Diffie–Hellman, P-256), and travels through the database only in wrapped form; only the invitee's own private key, itself sealed with their data key, can unwrap it. Only members can read the space. Your own money is never copied into a space; only what you record there or choose to show there is visible to the others.
A loan between two users is sealed the same way, with a key of its own that only the two of you hold: nobody else — including Valnivo Labs — can read its amounts, dates, names, note or repayments. What is not sealed, because the service needs it: which two accounts it is between, the borrower's email address (so the invitation reaches them when they sign in with it, as a joint space's does), where it stands, the time of each step, each step's signature and the public half of the key that made it, and a fingerprint of the terms salted with random bytes so that it reveals nothing about them. The address each of you is signed in with is part of that history and, like the rest of this list, is not sealed: the two of you can read it, it is printed on the signed PDF — so whoever you show the PDF to sees both addresses — and it is within reach of the administrative credential described above and read by the scheduled job described in section 4. It is there because it is what proves which account signed, and a name can be anything its owner typed. A public record keyed by that fingerprint holds only how many steps the history has and their hashes; it is what lets anyone you give the document to check it with Valnivo, and it says nothing to anyone you have not. Valnivo sends no email about a loan and does not tell the lender whether an address has an account. When the shared record of a signed loan is deleted (section 6), that public record stays, because it is what checks a signed PDF, and it holds nothing about either of you.
A share link is the one thing here that anybody else can read, and only because you sent it to them. The snapshot behind it is sealed with a key made for that link alone — not with your recovery code, which is never used for anything shared — so it cannot be used to reach your ledger, and revoking it or letting it expire leaves nothing readable. Treat a link the way you would treat a photograph of the figures: anyone it is forwarded to can open it while it lives. It stops working within 48 hours at the very most.
4. Who else processes data
Google Ireland Limited, with Google LLC (United States) as its sub-processor — processor.
Services: Firebase Authentication (sign-in), Cloud Firestore (the online copy), Firebase Hosting (serving
the app), Firebase Cloud Messaging (delivering push reminders), Firebase App Check with reCAPTCHA
Enterprise (telling the genuine app from scripts; it starts only once you sign in), and, for a timestamp
you ask for, Cloud Run (the service that receives the fingerprint, in Belgium, europe-west1)
and Cloud Key Management Service (which holds Valnivo's signing key, in the same region, and signs with
it; the key cannot be copied out of it, not even by Valnivo). Terms: the
Google Cloud Data Processing Addendum
and the Firebase Data Processing and Security Terms.
Location: Google's infrastructure, which may include the United States (section 5).
GitHub, Inc. (United States, a Microsoft company) — processor for the scheduled job described below, and the host of two things you can reach from the app.
Downloading the app. The installable file for Android is published as a GitHub release rather than served from this site, so pressing the download button asks GitHub for a file and GitHub receives your network address and browser description, as any web request does. It happens only when you press it, it carries no account identifier and no figure of yours, and nothing about the download comes back to us — we cannot tell that you downloaded anything. Installing from Google Play instead means Google receives the equivalent under its own notice.
Reporting a bug or suggesting a feature. Those forms are GitHub issues in public repositories. What you write there is public and is held by GitHub under your own account with them. A job then copies each report into a private repository so nothing is missed; that copy holds what you already published, and nothing is ever written back from it.
What it does: every two hours through the waking hours, a small job runs on GitHub Actions. It sends the reminders that are due, delivers the joint-space notices that are due and deletes them, and it deletes the share links whose time has run out — the database hands it only each link's expiry, so the sealed figures never reach it and it could not read a shared projection even if it tried. For a joint-space notice it also reads that space's name and its members' names, so that it can write "Sofia recorded something in Household"; those are not encrypted, because the database routes on them. It never reads a ledger, so it cannot know what was recorded, and it drops a notice without sending it if either person has left the space or you have since switched the notices off. For a loan between two users, if the person to be told switched those notices on, it reads the steps taken on that loan since it last looked — for each, what it was, which of the two took it, its time and the short detail it carries in the clear, which for a proposal and an opening is the address the signer was signed in with; never the sealed terms — and tells the other person which step it was, with no name, amount, date, address or note; for a loan not yet opened it looks up, by the address the lender typed, which account that address belongs to, and the lender is never told the answer. It then marks the loan so no step is told twice. It also deletes loan records on the schedule in section 6, reading only a loan's status, when it was made, and whether each of your devices has said it holds the closed history — never the terms. What reaches it: for the people who switched reminders on, and only those: the account identifier, the delivery token(s), and the day's generic reminder note (section 2). For a loan, the parts that are not sealed (section 3): the two account identifiers, the borrower's address as the lender typed it, and the steps described above, including the addresses recorded with them. It is read from the database into the job's memory, handed to Firebase Cloud Messaging, and the note is deleted. The job never reads a ledger, which is sealed anyway; the only thing GitHub keeps afterwards is the job's log, which contains counts ("3 due, 3 sent") and no personal data, kept by GitHub for 90 days. What GitHub holds permanently: the database credential the job uses, stored as an encrypted secret; with it the job could read the unencrypted data listed in section 3, and by its code reads only what is listed above under What it does and What reaches it. Where: GitHub-hosted runners, normally in the United States (section 5). Terms: the GitHub Data Protection Agreement, which contains the Standard Contractual Clauses.
Porkbun LLC (United States) and Google (Gmail) — e-mail you send to one of Valnivo's addresses.
The five addresses on valnivo.eu are not mailboxes. Porkbun, the registrar that holds the domain valnivo.eu, receives a message sent to one and forwards it to a Gmail mailbox, where it is read and answered. The mailbox keeps the message until your request is closed (section 6). Where: Porkbun processes data in the United States; Gmail runs on Google's infrastructure, which may include the United States (section 5).
Stripe Payments Europe, Limited (Ireland), with Stripe, Inc. (United States) behind it — the donation page.
Donating is a link out. No Stripe code runs on this site: nothing is embedded, nothing is fetched from Stripe, and somebody who never presses the button contacts this site and nothing else. Press it and you go to a page Stripe hosts, where Stripe collects your email address and your payment details and takes the payment. Stripe decides its own purposes for much of that — fraud checks, and the records its authorisation as a payment institution obliges it to keep — so there it acts under its own privacy policy and not solely on our instructions. What reaches us: the list of donations in Stripe's dashboard — an email address, an amount, a date, and the card's brand, country and last four digits. Never a card number, and never anything of yours from this app: the donation page does not know whether you have a Valnivo account, and no donation is recorded against one. Terms: the Stripe data processing agreement, which contains the Standard Contractual Clauses.
World Bank, European Central Bank (via Frankfurter), CoinGecko, and a market-price service if you set one up — not processors: public data sources you query.
When you ask, the app fetches public statistics from them for inflation, exchange rates and coin prices. Those requests carry the country or currency codes you chose and, like every web request, your network address, which each source receives as a controller under its own notice. No account identifier, cookie or figure of yours is ever sent, and nothing is fetched unless you ask.
Closing prices are the exception worth naming: if you switch that on and supply your own key, the request carries a ticker symbol of yours and that key, so the service learns that somebody holds that instrument. It receives this as a controller under its own terms, which are between you and them because the key and the account are yours. It is off unless you set it up, one instrument per press.
Valnivo widgets on other people's websites — not a recipient of anything of yours.
Some of the app's calculations are published as small pages other sites can embed. They are built to work out an answer and forget it: no account, no ledger, no cookie, no storage and no statistics of their own, and they cannot reach anything you have recorded here. Whatever you type into one stays in that frame, and the site hosting it cannot read inside it either.
The Excel task pane is the same pages inside a task pane, with one addition: if you select cells in your sheet and press Use the selected cells, it reads the figures in that selection and fills the calculator in the pane with them. It reads nothing unless you press that button, it never watches what you select, and it never writes to your workbook — the add-in asks Excel for read access only. Those figures go no further than the pane: nothing is stored, nothing is sent to us, and closing the pane is the end of them.
Valnivo Professional — a separate product, and not part of this notice.
There is a page describing a service for organisations that project figures for the people they plan for. It has its own notice, the privacy notice for Valnivo Professional, and its own agreement with each organisation that uses it, the data processing agreement, because there the firm is the controller and Valnivo Labs its processor. The calculator on the page describing it runs in your browser and sends nothing anywhere. Nothing about it touches your ledger or this notice.
Nobody else receives your data. It is never sold, never shared for advertising, and never used to train anything.
5. Transfers outside the EU
The database holding your online copy is in Berlin, Germany (Google Cloud region
europe-west10), so the sealed copy of your ledger rests inside the European Economic Area.
Google and GitHub are global companies nonetheless, whose operations and support may reach infrastructure
outside the European Economic Area, including the United States. Google LLC and GitHub, Inc. are both certified under the
EU–US Data Privacy Framework, and both agreements
above also include the European Commission's Standard Contractual Clauses as a fallback. Because your
ledger is encrypted on your device before it leaves, what crosses borders of yours is sealed data, your
Google account details, if you use reminders, delivery tokens and generic notes, and, for a loan between
two users, the parts section 3 lists as not sealed — including the address each of you signed with — which
the scheduled job reads on GitHub's runners.
If you write to one of Valnivo's addresses, your message passes through Porkbun LLC, a company in the United States, on its way to a Gmail mailbox. Porkbun is not certified under the EU–US Data Privacy Framework, so no adequacy decision covers it; its privacy policy says it transfers personal data under appropriate safeguards, for example Standard Contractual Clauses (art. 46 GDPR). What crosses that border is the message you chose to send.
If you donate, the payment is taken by Stripe Payments Europe, Limited in Ireland, with Stripe, Inc. in the United States behind it; the Standard Contractual Clauses in Stripe's own agreement are the basis for what crosses that border. What crosses it is what you typed on Stripe's page — never anything from your ledger, which Stripe has no way to reach.
6. How long it is kept
| What | How long | Why that long |
|---|---|---|
| Everything on your device | Until you erase it in Settings or clear the browser's data. | It is your working copy. |
| A debt and its amortisation table | Part of your ledger: for as long as the ledger is, and removed when you remove the debt. | The table is what makes a payoff date true rather than computed, so it is kept as long as the debt it belongs to. |
| Your online copy (sealed) and your key records | For as long as your account exists; deleted from the live database at once with "Delete my account". | The copy exists to follow you between devices for as long as you use the service; there is no shorter period that would still do that. |
| Account details from Google (name, email, picture, identifier) | Until you delete your account. | Needed to sign you in and to name you in a joint space. |
| Your public key | Until you delete your account. | Needed for members to hand you a joint-space key. |
| Push delivery tokens | Until you switch reminders off, the token stops working, or you delete your account. | Needed to deliver; a dead token is removed the first time delivery fails. |
| Reminder notes | Written up to 30 days ahead; deleted the moment they are sent, or 12 hours after their time if they could not be. | A note is only useful on its day. |
| A projection or comparison you shared | Between one hour and 48 hours, whichever you chose when you made the link, and at once if you revoke it. It stops being served the moment it expires, and the scheduled job deletes it, normally within the hour. | The ceiling is the point of the feature: a link that outlives the conversation is a credential somebody has forgotten they created. |
| Your own record of a link you made (its label and dates) | Deleted when the app next opens Settings after it expires, and with your account. | It exists so you can see and revoke your live links. The shared copy carries nothing that says it is yours, which is why deleting this half is the app's job rather than the scheduled one's. |
| The year you were born | Until you clear the field, or with the rest of your ledger when you delete your account. | It is part of your ledger; clearing the field removes it at once, and nothing keeps a copy. |
| The country you are paid from | Until you set it back to the country you live in, or with the rest of your ledger when you delete your account. | It is part of your ledger; clearing it removes it at once, and nothing keeps a copy. |
| That a co-member recorded something | Deleted as soon as it is delivered, and at the latest 12 hours after its time if it could not be. Nothing is kept about it afterwards. | It is a tap on the shoulder, useful for a few hours; the answer is in the space itself, which you can already read. |
| Whether you want to be told, per space | Until you switch it off, leave the space, or delete your account. | It is your own setting, and the other members can see it so that nobody is told about without knowing. |
| A loan signed by both of you, and its history | For the whole of the loan, and after it is closed until both of your devices hold the closed record in your own copies; then the shared record and its history are deleted. It is not deleted when either of you deletes your account before then, and your account identifier stays on it until it goes. | It is the other person's record as much as yours (GDPR art. 17(3)(e)), and the projection reads each of your own copies, so once both hold it nothing already calculated from it changes when it goes. Nothing in it can be changed or withdrawn, by either of you or by Valnivo; a mistake is corrected by a new version you both sign. |
| A loan proposal nobody signed — waiting, declined or withdrawn | At most two weeks from when it was made, then deleted with its history. | It holds the address the lender typed, possibly of somebody who never signs in; two weeks is long enough to answer, and nothing was agreed. |
| The public record of a signed loan (its hashes) | Kept after the loan itself is deleted. | It is what lets anyone holding the signed PDF check that it is authentic. It holds only the history's length and hashes: no name, amount, date or address. |
| Your own copy of a signed loan | Part of your ledger: for as long as the ledger is. | So you keep the record and its proof even if the shared one cannot be reached. |
| The key your device signs with | In this browser's storage until you clear it; its private half cannot be read out or copied, not even by the app. | Signing each step you take on a loan. |
| Joint spaces | Until you leave; a space you created is deleted with your account. | Members need it for as long as they run it. |
| A statement file you import | Not kept at all: it is read in the browser and never stored or uploaded. The entries you confirm are kept as part of your ledger. | The file has done its job once the entries exist. |
| Tester access record for your email address | Until the feature is opened to everyone, or you ask for it to be removed. | It exists only to let a feature be tried before release. |
| A timestamp you asked for | Nothing is kept. The service writes no fingerprint, account or address anywhere; it counts each account's timestamps for the current day in memory only, and that count is gone when the day ends or the service restarts. The signed statement is yours, in the file you saved. | A timestamp needs nothing kept to be checked: anyone can check it against Valnivo's published key. |
| Google's request logs | Google's standard short retention for Firebase Hosting, Firestore and Cloud Run logs. | Security and operations, then gone. |
| Google's database backups | Deleted data is removed from Google's own operational backups on Google's schedule, which is not under the controller's control; no separate backups are kept by Valnivo. | Disaster recovery on Google's side; the ledger in them is sealed. |
| A donation you made | Held in the payment account for as long as Stripe's own obligations as a payment institution require, and as long as accounting and tax law requires a record of money received — ten years in Luxembourg. | Money that has been received cannot be un-received, and the record of it is an obligation rather than a choice. |
| Anything about a donation, in the app | Nothing at all: the app is never told that you donated, so there is nothing to delete. | A donation buys nothing, so there is nothing to remember about it. |
| GitHub job logs | 90 days. | Checking the job ran; the logs hold counts only. |
| A message you send to one of Valnivo's addresses | Until your request is closed, then deleted within 12 months. Porkbun's privacy policy does not say how long it keeps a message it forwards or a record of forwarding it. | Long enough to show that a request was answered, if that is ever questioned, and no longer. |
| Your key for the price service, and how many units of an investment you hold | Until you clear the key, or delete the investment | Both are things you typed, kept in your ledger like the rest of it. Clearing the key stops every price request; nothing about a price is kept anywhere else, and a valuation you accepted is an ordinary figure in your ledger from then on. |
7. Your rights
Under the GDPR you can, at any time:
- Access your data: it is all visible in the app, and "Save a full backup" in Settings gives you a complete copy.
- Rectify it: every figure can be edited in the app. A signed loan is the exception: it is never edited, and is corrected by a new version that both of you sign, which replaces it.
- Erase it: "Erase all data" clears this device; "Delete my account" removes the online copy and your sign-in. A loan you recorded with another person is the exception: it is their record too, so deleting your account does not remove it; it is deleted on the schedule in section 6.
- Port it: the backup is a plain, documented JSON file; entries can also be exported as CSV.
- Restrict or object to processing. Where anything ever rests on your consent, withdrawing it is as easy as giving it; today nothing here does.
- Complain to a supervisory authority. In Luxembourg this is the Commission nationale pour la protection des données (CNPD), cnpd.public.lu. You may also contact the authority of the country where you live.
For anything the app cannot do itself, write to privacy@valnivo.eu. Requests are answered within one month. Where the GDPR permits, that period may be extended by up to two further months for complex or numerous requests, and you will be told within the first month if so. Because the online copy is encrypted with your key, the controller cannot read it on your behalf; what can be done from outside is deletion.
8. Cookies and local storage
The app uses the browser's storage (IndexedDB and local storage) only to work: your ledger, your preferences, which version of this notice you have seen, your sign-in session, and your encryption seed. These are strictly necessary for the service you asked for and need no consent. Once you sign in, Firebase App Check may also store a short-lived token from reCAPTCHA Enterprise, used only to tell the genuine app from scripts. There are no tracking cookies and no third-party fonts, and the app itself loads no analytics. The one third-party script apart from that App Check one is the visit counter on these public pages (not in the app, and not inside the Android or iPhone app): GoatCounter, which sets no cookie and stores nothing on your device, and counts a page view with the page address, the referring page, the browser and screen size and a country, without keeping your IP address. It is not loaded when your browser sends Do Not Track or Global Privacy Control.
Advertising: none, and none is planned. Valnivo carries no advertising — not on the website, not in the Android app, and not in the widgets other sites embed. No advertising script is loaded, no advertising cookie or identifier is set, and there is no code left in the app or in the Android build that could do either: the advertising libraries, the placements and the consent machinery were all removed on 9 September 2026, and a test in the source refuses to let them back.
Earlier versions of this notice described what would happen if advertising were ever switched on — a consent message before the first ad, a 12-month renewal, withdrawal from Settings. None of that is needed now, and it is gone rather than left standing as a possibility. If that ever changed it would be a new version of this notice, decided and published before a single line of it shipped.
9. Price, and Valnivo Plus
Valnivo is free, and carries no advertising. It has a tier called Valnivo Plus (unlimited joint spaces and saved plans, higher projection accuracy, bank statement import, passkey unlock) which is currently included for everyone. Plus may become payable one day, but not soon: on Valnivo Labs' own estimate that is at least two to three years away, and nothing about the app assumes it sooner.
Today the app collects no payment details and contains no payment function. You may donate, and that is a link out to a page Stripe hosts (sections 2 and 4) rather than a payment inside the app: it buys nothing, it is not a purchase, and it has nothing to do with Plus. If Plus becomes payable: you will be told well in advance inside the app and in a new version of this notice; nothing will be charged without your explicit purchase; payments would be handled by Google Play (Android) or a payment provider such as Stripe (web), who would process your payment details under their own notices, and the app would only receive confirmation that a purchase was made; the free version would keep working, with the Plus features switched to their free limits; and your data would never be affected by your choice.
10. Children
The app is not directed at children under 16 and does not knowingly collect their data.
11. Changes to this notice
When this notice changes, the version, date and time at the top are updated, the new text is published at this address, and the app shows its short notice once more. Earlier versions are summarised here.
Earlier versions of this notice — an archive
These rows describe what past versions said, not what is true now. Whatever is above this line is the current text; a row below may describe something that has since been removed. If the two ever disagree, the text above wins — and it is worth saying, because an outside reader has already quoted a withdrawn practice from this table as though it were current policy. These numbers version this document and nothing else. They are not releases of the app, which has release numbers of its own — 2026.09 is September 2026’s — and a gap between two rows says nothing about what was built in between. Each release of the app, and its main changes, is on What has changed.
| Version | Date and time (Luxembourg) | What changed |
|---|---|---|
| 24 | The loan record is open to every account. The notice no longer says it is open by invitation only. Nothing new is collected, nobody new receives it, and nothing is kept for a different length of time. This is a new version because the sentence above had stopped being true. | |
| 23 | Opening Valnivo inside Valnivo Home. Valnivo Home can open Valnivo while you are signed in there. Valnivo then creates an account for that same user id if you do not already have one here. It is a new account, not a join to a Google account you already use on valnivo.eu, and the ledger on this site stays on this site. Signing in on valnivo.eu itself is unchanged. The same version number, because this names a path the test sites already use and the live site does not frame yet; the text above is what applies. | |
| 23 | E-mail you send us, and what is not sealed on a loan. Two things the app already did, which this notice did not say. E-mail: the five role addresses on valnivo.eu are forwarded by Porkbun, the domain's registrar in the United States, to a Gmail mailbox (they were forwarded by ImprovMX until this version, which had no transfer safeguard to name); the notice now says what is processed when you write (your address and your message), why, on what basis, who receives it, where, under which safeguard, and for how long — until your request is closed, then deleted within 12 months. Loans: the address each person signs with was described as readable by the two of you; it is also, like the rest of a loan's unsealed parts, within reach of the administrative credential and read by the scheduled job, on GitHub's runners in the United States, which is now said where each of those is described. Nothing new is collected and no retention changed. The same pass reworded, without changing any right, a bank sentence in the terms ("never connects" became "does not connect"). | |
| 22 | A timestamp of a file, signed by Valnivo. You can ask Valnivo to sign a statement that a file — for now, a saved loan PDF — existed at a given time, so that the time does not rest on Valnivo's database alone. The file never leaves your device: its fingerprint is sent, with your sign-in and, as any request does, your network address, to a new service on Google Cloud in Belgium, which signs with a key held in Google's key management service that cannot be copied out. Nothing is kept. This is a new version because it is a new request from your device to a new service, carrying your account. The statement vouches only for the time; it says nothing about what the file says, and it is not a qualified electronic seal. | |
| 21 | How long a loan between two users is kept, and how one is corrected. A signed loan was kept for as long as the service existed; now it is kept for the whole of the loan and, once closed, until both of your own copies hold it — then the shared record is deleted, and only its public record of hashes stays, so a signed PDF can still be checked. A proposal nobody signed — waiting, declined or withdrawn — is deleted two weeks after it was made; it used to be kept for ever. A signed loan is still never edited, but it can now be corrected: the corrected terms are a new version that names the one it replaces and what was paid under it, and both of you sign it. This is a new version because it changes how long data about you is kept and how you can correct it. | |
| 20 | A signed loan records the address each person is signed in with. When the lender proposes a loan and when the borrower opens it, the address they are signed in with — which Google has verified, and which the database checks is theirs — is written into the loan's signed history. This is a new version because it gives the other person something they did not have: your email address, and it is printed on the signed PDF, so anyone either of you shows it to sees it too. It is there because a name proves nothing — anybody can call an account anything — and the address is what shows which account signed. For now the feature is open by invitation only. | |
| 19 | Being told when the other person takes a step on a loan. Off unless you switch it on, and only you can. When it is on, the scheduled job reads which step was taken — never the terms, which are sealed — and sends you a notification that names no person and no amount; for a loan not yet opened it finds your account from the address the lender typed, and the lender is not told whether it did. It uses the delivery tokens already described for reminders, stores nothing new beyond a count on the loan of the steps already told, and sends to nobody new. No new version, and no fresh acceptance: it is the same data, the same recipient and the same job, for something you ask for. | |
| 19 | Money lent between two Valnivo users, signed by both (in beta). This is a new version because it is the first thing in this app that holds a record about another person that you created — their name and the address they sign in with — and the first record that is not deleted with your account, because it is theirs too. What is new: a loan's terms and repayments, sealed with a key only the two of you hold; the borrower's address, the two account identifiers, the status, the time of each step and each step's signature, in the clear; a public record of the history's length and hashes, keyed by a fingerprint that reveals nothing; and a signing key on your device that never leaves it. Nobody new receives anything: it is stored in the same database, in the EU. No money moves and no interest is charged. | |
| 18 | The controller is named as Valnivo Labs, the name Valnivo is provided under, rather than described as its operator. Valnivo Labs is a trade name and not a registered company, and the undertaking stays: the controller's name is given to you on request for a formal request or a complaint to a supervisory authority. No new version, and no fresh acceptance: this is who is responsible, said in other words — nothing about what is collected, why, who receives it, how long it is kept or what you may ask for has changed. | |
| 18 | The downloads for macOS and Windows have been withdrawn for now, and the sentence about downloading describes the Android file alone again. Nothing is new: the same recipient, GitHub, receives the same thing when you press the one download button that remains. No new version, and no fresh acceptance, for the same reason the row that added them was not one: it is the same disclosure covering fewer buttons. | |
| 18 | The Excel task pane can read the cells you select. Press Use the selected cells and the figures in your current selection fill the calculator in the pane. This is a version change because the previous version said the opposite — that the pane "reads no cell of your spreadsheet" — and that sentence stopped being true the day the button was built. Nothing else about it moved: the reading happens on your own machine when you press, nothing is watched, nothing is written to your workbook, and none of those figures reaches us or is kept. The add-in asks Excel for read access and not write access, which is the same promise stated to Excel itself. | |
| 17 | The country you are paid from, if it is not the one you live in. Optional, and the second thing this app has ever asked about your person rather than your money — which is why this is a new version rather than a dated row, the same reason the year you were born got one. Nothing new is sent anywhere, nobody new receives anything, and nothing is kept for longer: it is part of your ledger, on your device and sealed inside your online copy if you use one, and it is never transmitted. No tax or social security is worked out from it, here or anywhere else in this app. It decides which pair of countries a comparison opens on, and where your income is counted in the per-country summary. Leave it unset — which every ledger is until you change it — and the app treats your pay as coming from where you live, exactly as before. The same pass corrected a sentence that this made untrue: the year you were born was described as the only thing asked about your person, and is now described as one of two. | |
| 16 | Valnivo can now be downloaded for macOS and Windows as well as Android, and the sentence about downloading says so. Nothing about it is new in kind: the same recipient, GitHub, receives the same thing — your network address and browser description — when you press a download button, because the files are published as GitHub releases rather than served from this site. No new version, and no fresh acceptance: version 10 treated the original disclosure as a version change precisely because GitHub receiving your address on a download was then new, and this is the same disclosure covering two more buttons. Nothing else moves: no figure of yours is sent, no account identifier goes with it, and we still cannot tell that you downloaded anything or which one. | |
| 16 | Donations, and Stripe named as a real recipient rather than as something that might happen one day. You can give something towards a free personal project. It is a link out: no Stripe code runs on this site, and somebody who never presses the button still contacts this site and nothing else. Stripe collects your email address and your payment details on its own page and takes the payment; what Valnivo can see afterwards is the list of donations in Stripe's dashboard — an email address, an amount, a date, and the card's brand, country and last four digits — never a card number. Nothing about a donation reaches your ledger, your online copy or your account, and the app is never told that you donated, which is also why there is nothing about it to delete. A donation buys nothing, so no record of entitlement exists to be kept. Section 9 was corrected in the same pass: the app still contains no payment function, and that sentence on its own would now have read as saying there is no way to give anything. | |
| 15 | Closing prices for an investment you already own, described before it is switched on for anyone. This is a new version because of what the request says about you. Every other live figure this app fetches sends a country code or a currency code, which says nothing about your money; asking for a price sends a ticker symbol of yours, which says what you hold. That is a difference in kind, so it is written down rather than folded into an existing row. The key is yours: Valnivo ships none, you make a free one with the price service, and the agreement is between you and them. It is off unless you set it up, it fetches one instrument per press and never on its own, and no price is recorded against your investment until you look at it and accept it. Nothing else changed: nobody new receives anything else, nothing is kept for longer, and no figure of yours goes with the request. | |
| 14 | The year you were born, so a goal can be set at an age rather than a date. Optional, and a year rather than a date of birth — it is the only thing this app has ever asked about your person, it is asked for in one place with the reason beside it, and leaving it empty changes nothing. It is part of your ledger: on your device, sealed in your online copy if you use one, used only on your own device to turn an age into a date. Nothing new is sent anywhere, nobody new receives anything, and nothing is kept for longer. This is a new version rather than a dated row because it is a new kind of thing to hold about you, and that deserves to be said plainly rather than slipped in. | |
| 13 | Being told when a co-member of a joint space records something. Off unless you switch it on, for each space separately, and it is your own choice that nobody else can make for you. What is stored is one record a day saying that a named member recorded so many things on a day — no amount, no category, no payee and no message, because the record has no field one could be written in. It is deleted the moment it is delivered. The words are built from the space's name and its members' names, which have never been encrypted because the database routes on them; what the entries actually were is filled in by your own device, if it holds the space, and never travels. This is the first thing Valnivo stores about when somebody used it, which is why it is a new version rather than a dated correction. | |
| 12 | Debts. You can record what you owe — a mortgage or a loan, with its rate, its payment and your lender's own amortisation table if you have one — so the projection accounts for it and shows when it ends. It is more of the same kind of thing you already type: kept on your device and in your sealed online copy exactly as the rest of your ledger is, and sent nowhere. A pasted or imported table is read in your browser, and no account number from it is stored. Nothing changed about who receives your data or how long it is kept. | |
| 11 | Section 9 says how far away a price is. It said Plus would "most likely become payable once the app is stable", which reads as months; the operator's own estimate is at least two to three years, and saying so is fairer to anybody deciding whether to rely on the free version. Nothing is charged today, there is still no payment code in the app, and no data practice, purpose, recipient or retention period changed — so this is a correction rather than a new version, and no fresh acceptance is asked for. | |
| 11 |
Section 5 now says where your online copy actually rests: Berlin, Germany
(europe-west10), inside the European Economic Area. Nothing moved — the database has
always been there and this notice simply had not said so, which left it vaguer about transfers than
the facts warrant. No purpose, recipient, category or retention period changed, so this is a
correction rather than a new version, and no fresh acceptance is asked for.
|
|
| 11 | Valnivo will not carry advertising. Not a plan withdrawn — the code is gone: the ad placements, the advertising library in the Android app, the consent machinery and the publisher files were all removed, and a test in the source refuses to let them back. So this notice no longer describes advertising as something that might happen: section 2 has no advertising row, section 4 no longer lists AdSense among the Google services, section 6 has no advertising consent record, and section 8 says plainly that there is none and none is planned. Nothing you do or give changed, and no fresh acceptance is asked for — this only narrows what Valnivo may do with your data, which never needs your permission. | |
| 11 | A dated correction rather than a new version, and this row says why. A share link can now carry two comparisons as well as the projection — rent or buy, and the same pay across a border — so section 2 describes what each one puts in a link. Nothing else moved: the same purpose, the same legal basis, the same categories of figure, the same recipients, the same one-hour to 48-hour life, and still nothing that identifies you. No fresh acceptance is asked for, on the same reasoning as the earlier corrections: what changed is which of your own figures you can choose to send, not who receives anything or what is kept. | |
| 11 | You can now share one projection by link. That is a new kind of processing and the reason for this version: a dated snapshot of your projection, sealed, stored so whoever you send the link to can open it, and dead within 48 hours at the most — one hour if you choose. It carries no entries, no accounts, no name and nothing identifying you, the key exists only inside the link, and Valnivo cannot read it or tell who opened it. Section 2 describes it, section 3 says plainly that you are the one disclosing it, and section 6 gives the two retention periods. The scheduled job now also deletes expired links, reading only their expiry — section 4. Nothing else about what you type, why, how long it is kept or what you may ask for has changed. | |
| 10 | Three things that were missing rather than new, and one that is new. Reporting a bug is now described as what it is — a public GitHub issue, copied into a private repository so nothing is missed. Downloading the Android app asks GitHub for the file, so GitHub receives your network address when you press that button; that is the new one, and it is why this is a version change rather than a dated correction. The embeddable widgets and the Excel task pane are stated to collect nothing and to be unable to reach your data. And Valnivo Professional, the service for organisations, is named as a separate product with its own notice, so nobody has to wonder whether it applies to them. What you type, why, how long it is kept and what you may ask for are unchanged. | |
| 9 | The controller is described by role rather than named, and this notice now says that the name is given to you on request if you need it for a formal request or a complaint to a supervisory authority — so nothing about your rights depends on the name being printed here. No change to what is collected, why, who receives it, how long it is kept or what you may ask for, which is why this stays version 9 and you are not asked to read it again. | |
| 9 | Contact details changed: write to privacy@valnivo.eu about anything in this notice or about your rights, rather than to the personal address used before. The controller is named as Valnivo, operated by one person from Luxembourg. No change to what is collected, why, who receives it, how long it is kept or what you may ask for — which is why this stays version 9 and you are not asked to read it again. | |
| 9 | Bank statement import described, ahead of it being opened to everyone: what a statement contains, that the file is read by code in your browser and never uploaded, that no server and no character recognition is involved, that the file itself is not kept, and that the account number in it is not stored in your ledger. Said plainly that Valnivo is not connected to your bank and cannot see or move money. Added the two things that make an optional feature possible: the record listing which features a tester's email address may use, and the single public switch document the app reads when you open Import and export — never at start-up, so someone who does not go looking for an optional feature still contacts nothing but the site itself. Retention now says the statement file is not kept and when a tester record goes. | |
| 8 | After an outside compliance review. Added: where each data item comes from, what you must provide and what happens if you do not, the no-profiling statement, the legitimate-interest balance, the DPO position. Rewrote "nothing leaves your device" to distinguish your figures from ordinary network details; said plainly that the device copy is not encrypted by the app and that reminder notes are not encrypted; described exactly what the person running Valnivo can and cannot read; described the passkey and joint-space key mechanisms. GitHub got its own processor entry with data, location, retention and transfer basis. Retention is now a table with a reason per item. Response time is "one month" with the GDPR extension. The advertising section says there is no ad code today and what would hold if that changed, including 12-month consent renewal and withdrawal from Settings. Two things in the app changed to make the notice true: the interface font is now shipped with the app instead of fetched from Google Fonts, and Firebase App Check starts only after sign-in, so a visitor who never signs in makes no request to Google beyond loading the page. | |
| 7 | Terms of use published alongside this notice; the first-run screen now asks for agreement to both. No change to data practices. | |
| 6 | The app was renamed again, from Finora to Valnivo, because the Finora name was already in use. Nothing changed about what is collected, who controls it, or your rights. The Android package identifier is still com.ledgger, which Google Play does not allow to be changed. |
|
| 6 | The app was renamed from L&H (Ledger & Horizon) to Valnivo. Nothing changed about what is collected, who controls it, or your rights. The Android package identifier stays com.ledgger, because Google Play does not allow it to be changed after publication. |
|
| 6 | Push reminders described: delivery tokens and generic daily notes stored online, sent by an hourly job on GitHub through Firebase Cloud Messaging. Opt-in; removable at any time. | |
| 5 | Reminders described (made on the device, no server). Goals and remembered import layouts added to the app; both are part of your ledger data. | |
| 4 | Section 9 added: the app is free, Valnivo Plus is included for everyone during the beta and will most likely become payable later; no payment details are collected today. First-run notice mentions it. | |
| 3 | Rewritten as a GDPR notice: controller, legal bases, processors, transfers outside the EU, retention, rights and the CNPD, cookies. Added "Delete my account and online data". | |
| 2 | End-to-end encryption described; joint spaces added; contact email added. | |
| 1 | First version. |