Privacy notice
Valnivo is a personal financial planning tool. It shows where your money goes each month and where it could take you over the years. This notice explains, as required by the EU General Data Protection Regulation (GDPR), what the app stores, where, who can read it, and what your rights are. It is written to be read, and every statement in it was checked against the app's own code on the date above.
1. Who is responsible
The data controller is Kabil Jbeli, an individual based in Luxembourg, who develops and runs Valnivo. Contact for anything in this notice: kabiljbeli011@gmail.com. Valnivo has no data protection officer: it is run by one person, does not monitor people at scale and processes no special categories of data, so article 37 GDPR does not require one. That assessment is written down and kept.
2. What data, why, and on what basis
| Data | Where it comes from | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|---|
| What you type: income and spending entries, categories, budgets, regular payments, accounts and investments, countries and currencies, goals, plans for the future, settings. | You. | Running the app for you: showing your figures and your projections. | Performance of a contract, art. 6(1)(b): providing the service you asked for. |
| When you sign in: your name, email address, profile-picture address and Google account identifier. | Your Google account, through Google sign-in, with your permission at the moment you sign in. | Signing you in, keeping your data separate from everyone else's, showing who is who in a joint space. | Performance of a contract, art. 6(1)(b). |
| If you switch on push reminders: a delivery token for your browser or phone, and one short generic note per day ("2 regular payments are due today") with no amounts, names or categories. | Created by your device and by the app on your device. | Sending you the reminders you asked for. | Performance of a contract, art. 6(1)(b), at your request; switch it off at any time. |
| Technical data any web server sees: your network (IP) address and request logs, held briefly by Google. | Your connection, automatically. | Serving the pages, security, abuse prevention. | Legitimate interest, art. 6(1)(f): a working and secure service. The interest is narrow (delivering a page you asked for and keeping the database from abuse), the data is what every website receives, it is kept for a short time and used for nothing else, so it does not override your interests. |
| Advertising identifiers and cookies set by Google AdSense. None today: no advertising code is in the app at all. Section 8 says what would change if that were ever switched on. | Google, on your device. | Showing a small number of ads to keep the app free. | Consent, art. 6(1)(a), asked for before any advertising cookie is set; you can decline and withdraw. |
What you have to provide, and what happens if you do not
Nothing is required to use Valnivo. You may use the whole app without signing in, in which case no account exists and none of the account data above is collected. Signing in is optional; if you choose it, Google sign-in necessarily provides your name, email address, picture and identifier, and without them the account features cannot be provided. Without signing in you will not have an online copy on other devices, joint spaces or push reminders; everything else works.
No automated decisions, no profiling
Valnivo does not use your personal data for automated decision-making or profiling that produces legal effects or similarly significant effects concerning you. The projections are arithmetic you ask for on figures you entered, run on your own device; nobody and nothing evaluates you, ranks you or decides anything about you. Your data is never used for advertising and never used to train anything.
The app never asks for bank credentials, card numbers or account numbers, and it does not connect to your bank.
3. Where it is kept, and who can read it
Your financial entries stay on your device unless you sign in. They are saved in the browser's storage (IndexedDB), as the browser stores it, not additionally encrypted by the app; protect them with your device's own lock. When you sign in with Google, a copy is kept in Google Firebase (Cloud Firestore) so you see the same figures on your phone and your computer.
What leaves your device when you do not sign in. Loading the app is a web request to Google Firebase Hosting, which, like any website, sees your network address and request details briefly (section 2). The app's code, fonts and images are all served from there; nothing is loaded from any other server. When you ask for a live inflation figure or exchange rate (by pressing the button, or when you add a country that has no built-in figures), a request goes to the public statistics source in section 4 carrying the country or currency code and, as any request does, your network address. No figure of yours is ever included. There are no analytics and no tracking of any kind.
The online copy is encrypted end-to-end. Your entries, budgets, accounts, goals and plans are sealed on your device (AES-GCM, with a key derived from a random seed generated on your device) before they are sent. The seed is shown to you once as a recovery code and is never sent anywhere in readable form. Google stores sealed data it cannot read, and neither can the person who runs Valnivo. The database is also limited by security rules to your own account. Your Google sign-in on its own cannot reconstruct the key: to read your online copy on a new device you need the sign-in and the recovery code, or a passkey you set up. A passkey works cryptographically, not as a mere login: the seed is sealed with a secret the passkey itself produces and stored in your private record, so only that passkey can unseal it. If the code and every unlocked device are lost, nobody can recover the online copy, and that is by design.
What is not encrypted, because the service needs it to work: your name, email address and profile-picture address from Google; for a joint space, its name and the names and emails of its members; your push delivery tokens and the short reminder notes described in section 2; and your public key. Nobody outside the space, or outside your account, can see any of that except the public key, which is public by nature and reveals nothing.
The person who runs Valnivo holds an administrative credential for the database (it is what the reminder job uses). With it, the most that can be read is the unencrypted data in the previous paragraph and the sealed documents themselves, which are ciphertext. Your ledger cannot be read from outside your devices, by anyone.
A joint space shared with a partner or family is encrypted the same way, with its own key. That key is wrapped for each member on the device of the member who invites them, using the invitee's public key (elliptic-curve Diffie–Hellman, P-256), and travels through the database only in wrapped form; only the invitee's own private key, itself sealed with their data key, can unwrap it. Only members can read the space. Your own money is never copied into a space; only what you record there or choose to show there is visible to the others.
4. Who else processes data
Google Ireland Limited, with Google LLC (United States) as its sub-processor — processor.
Services: Firebase Authentication (sign-in), Cloud Firestore (the online copy), Firebase Hosting (serving the app), Firebase Cloud Messaging (delivering push reminders), Firebase App Check with reCAPTCHA Enterprise (telling the genuine app from scripts; it starts only once you sign in), and Google AdSense if ads are ever switched on. Terms: the Google Cloud Data Processing Addendum and the Firebase Data Processing and Security Terms. Location: Google's infrastructure, which may include the United States (section 5).
GitHub, Inc. (United States, a Microsoft company) — processor, for push reminders only.
What it does: once an hour a small job runs on GitHub Actions to send the reminders that are due. What reaches it: for the people who switched reminders on, and only those: the account identifier, the delivery token(s), and the day's generic reminder note (section 2). It is read from the database into the job's memory, handed to Firebase Cloud Messaging, and the note is deleted. The job never reads a ledger, which is sealed anyway; the only thing GitHub keeps afterwards is the job's log, which contains counts ("3 due, 3 sent") and no personal data, kept by GitHub for 90 days. What GitHub holds permanently: the database credential the job uses, stored as an encrypted secret; with it the job could read the unencrypted data listed in section 3, and by its code reads only the reminder records. Where: GitHub-hosted runners, normally in the United States (section 5). Terms: the GitHub Data Protection Agreement, which contains the Standard Contractual Clauses.
World Bank, European Central Bank (via Frankfurter), CoinGecko — not processors: public data sources you query.
When you ask, the app fetches public statistics from them for inflation, exchange rates and coin prices. Those requests carry the country or currency codes you chose and, like every web request, your network address, which each source receives as a controller under its own notice. No account identifier, cookie or figure of yours is ever sent, and nothing is fetched unless you ask.
Nobody else receives your data. It is never sold, never shared for advertising, and never used to train anything.
5. Transfers outside the EU
Google and GitHub run on infrastructure that may be located outside the European Economic Area, including the United States. Google LLC and GitHub, Inc. are both certified under the EU–US Data Privacy Framework, and both agreements above also include the European Commission's Standard Contractual Clauses as a fallback. Because your ledger is encrypted on your device before it leaves, what crosses borders of yours is sealed data, your Google account details, and, if you use reminders, delivery tokens and generic notes.
6. How long it is kept
| What | How long | Why that long |
|---|---|---|
| Everything on your device | Until you erase it in Settings or clear the browser's data. | It is your working copy. |
| Your online copy (sealed) and your key records | For as long as your account exists; deleted from the live database at once with "Delete my account". | The copy exists to follow you between devices for as long as you use the service; there is no shorter period that would still do that. |
| Account details from Google (name, email, picture, identifier) | Until you delete your account. | Needed to sign you in and to name you in a joint space. |
| Your public key | Until you delete your account. | Needed for members to hand you a joint-space key. |
| Push delivery tokens | Until you switch reminders off, the token stops working, or you delete your account. | Needed to deliver; a dead token is removed the first time delivery fails. |
| Reminder notes | Written up to 30 days ahead; deleted the moment they are sent, or 12 hours after their time if they could not be. | A note is only useful on its day. |
| Joint spaces | Until you leave; a space you created is deleted with your account. | Members need it for as long as they run it. |
| Google's request logs | Google's standard short retention for Firebase Hosting and Firestore logs. | Security and operations, then gone. |
| Google's database backups | Deleted data is removed from Google's own operational backups on Google's schedule, which is not under the controller's control; no separate backups are kept by Valnivo. | Disaster recovery on Google's side; the ledger in them is sealed. |
| GitHub job logs | 90 days. | Checking the job ran; the logs hold counts only. |
| Advertising consent record | None today. If ads are switched on: stored by Google's consent message on your device, asked again after at most 12 months. | Proof of your choice; the CNPD recommends renewal within 12 months. |
7. Your rights
Under the GDPR you can, at any time:
- Access your data: it is all visible in the app, and "Save a full backup" in Settings gives you a complete copy.
- Rectify it: every figure can be edited in the app.
- Erase it: "Erase all data" clears this device; "Delete my account" removes the online copy and your sign-in.
- Port it: the backup is a plain, documented JSON file; entries can also be exported as CSV.
- Restrict or object to processing, and withdraw consent to ads at any time (Settings → Advertising, once ads exist), as easily as it was given.
- Complain to a supervisory authority. In Luxembourg this is the Commission nationale pour la protection des données (CNPD), cnpd.public.lu. You may also contact the authority of the country where you live.
For anything the app cannot do itself, write to kabiljbeli011@gmail.com. Requests are answered within one month. Where the GDPR permits, that period may be extended by up to two further months for complex or numerous requests, and you will be told within the first month if so. Because the online copy is encrypted with your key, the controller cannot read it on your behalf; what can be done from outside is deletion.
8. Cookies and local storage
The app uses the browser's storage (IndexedDB and local storage) only to work: your ledger, your preferences, which version of this notice you have seen, your sign-in session, and your encryption seed. These are strictly necessary for the service you asked for and need no consent. Once you sign in, Firebase App Check may also store a short-lived token from reCAPTCHA Enterprise, used only to tell the genuine app from scripts. There are no analytics or tracking cookies, and no third-party fonts or scripts are loaded.
Advertising, today: none. No advertising script is loaded, no advertising cookie or identifier is set, and the web app contains no code that could do so without a new build. The Android app contains Google's Mobile Ads library but is built without any ad identifier, so it requests no ad and asks for no consent; a build that did would come with a new version of this notice first.
If advertising is ever switched on, this notice will be updated to a new version first, and the following will hold: no advertising script runs and no advertising identifier or cookie is set before you have made a choice; Google's consent message (which follows the IAB Transparency & Consent Framework) asks you before the first ad, explains what Google would process, and lets you refuse as easily as accept; if you refuse, no personalised ad is shown and no advertising cookie is set; your choice is stored by that message on your device and asked again after at most 12 months; and you can change or withdraw it at any time from Settings → Advertising. Google would process advertising data as described in its own notice for partner sites.
9. Price, and Valnivo Plus
Valnivo is free. It has a tier called Valnivo Plus (no advertising, unlimited joint spaces and saved plans, higher projection accuracy, bank statement import, passkey unlock) which is currently included for everyone while the app is in beta. Plus will most likely become payable once the app is stable.
Today the app collects no payment details and contains no payment function. If Plus becomes payable: you will be told well in advance inside the app and in a new version of this notice; nothing will be charged without your explicit purchase; payments would be handled by Google Play (Android) or a payment provider such as Stripe (web), who would process your payment details under their own notices, and the app would only receive confirmation that a purchase was made; the free version would keep working, with the Plus features switched to their free limits; and your data would never be affected by your choice.
10. Children
The app is not directed at children under 16 and does not knowingly collect their data.
11. Changes to this notice
When this notice changes, the version, date and time at the top are updated, the new text is published at this address, and the app shows its short notice once more. Earlier versions are summarised here.
| Version | Date and time (Luxembourg) | What changed |
|---|---|---|
| 8 | After an outside compliance review. Added: where each data item comes from, what you must provide and what happens if you do not, the no-profiling statement, the legitimate-interest balance, the DPO position. Rewrote "nothing leaves your device" to distinguish your figures from ordinary network details; said plainly that the device copy is not encrypted by the app and that reminder notes are not encrypted; described exactly what the person running Valnivo can and cannot read; described the passkey and joint-space key mechanisms. GitHub got its own processor entry with data, location, retention and transfer basis. Retention is now a table with a reason per item. Response time is "one month" with the GDPR extension. The advertising section says there is no ad code today and what would hold if that changed, including 12-month consent renewal and withdrawal from Settings. Two things in the app changed to make the notice true: the interface font is now shipped with the app instead of fetched from Google Fonts, and Firebase App Check starts only after sign-in, so a visitor who never signs in makes no request to Google beyond loading the page. | |
| 7 | Terms of use published alongside this notice; the first-run screen now asks for agreement to both. No change to data practices. | |
| 6 | The app was renamed again, from Finora to Valnivo, because the Finora name was already in use. Nothing changed about what is collected, who controls it, or your rights. The Android package identifier is still com.ledgger, which Google Play does not allow to be changed. |
|
| 6 | The app was renamed from L&H (Ledger & Horizon) to Valnivo. Nothing changed about what is collected, who controls it, or your rights. The Android package identifier stays com.ledgger, because Google Play does not allow it to be changed after publication. |
|
| 6 | Push reminders described: delivery tokens and generic daily notes stored online, sent by an hourly job on GitHub through Firebase Cloud Messaging. Opt-in; removable at any time. | |
| 5 | Reminders described (made on the device, no server). Goals and remembered import layouts added to the app; both are part of your ledger data. | |
| 4 | Section 9 added: the app is free, Valnivo Plus is included for everyone during the beta and will most likely become payable later; no payment details are collected today. First-run notice mentions it. | |
| 3 | Rewritten as a GDPR notice: controller, legal bases, processors, transfers outside the EU, retention, rights and the CNPD, cookies. Added "Delete my account and online data". | |
| 2 | End-to-end encryption described; joint spaces added; contact email added. | |
| 1 | First version. |