Privacy Policy

1. Who we are

FinanceDuo (the "Service") is provided by Corobis ("we", "us"). We are the controller of the personal data described in this policy. You can reach us about anything privacy-related at support@finance-duo.com.

This policy applies to www.finance-duo.com, the web app at app.finance-duo.com, the FinanceDuo apps for iOS and Android, and the emails we send you. It should be read together with our Terms of Service and Cookie Policy.

2. What we collect

Information you give us

• Account details — your email address, your name, and a password (or a sign-in from Google or Apple). Passwords are handled by our authentication provider and are never stored by us in readable form.
• Profile details from onboarding — your birth year and sex, if you choose to provide them, and your preferred currency.
• Financial records you enter — wallets and their balances, income, expenses and transfers, categories, notes, recurring subscriptions, savings and debt goals, and the amounts and dates associated with them. FinanceDuo does not connect to your bank and we never ask for bank logins or card numbers.
• Attachments — photos or files (for example receipts) that you attach to a transaction.
• Shared-group data — if you use the Duo features, the groups you create or join, the people you invite, shared expenses and how they are split.
• Messages to us — the content of emails you send to support or feedback.

Information collected automatically

• Account activity — when your account was created and when you last signed in.
• Usage analytics— which screens you open and which actions you take (for example "added a transaction"), together with device type, operating system, app version, approximate region and an analytics identifier. We do not send the amounts, notes or names from your financial records to analytics.
• Crash and diagnostic reports from the mobile apps — stack traces, device model and OS version, so we can fix bugs.
• Push notification tokens — a device token that lets us send reminders and group notifications to your phone, if you allow notifications.
• Server logs — IP address, request time and the endpoint called, kept for security and troubleshooting.
• Cookies and similar storage on the web app — see the Cookie Policy.

Information from third parties

• Google or Apple sign-in — your name, email address and an account identifier, if you choose to sign in that way. With Apple you may choose to hide your email address.
• App Store, Google Play and Stripe, via our subscription provider — whether you have an active Premium subscription, which plan it is and when it renews or expires. For web purchases, Stripe and RevenueCat also process your email address, billing country and payment details to take the payment. We never receive or store your full card details.

Data that stays on your device

• Receipt scanning. When you scan a receipt in the mobile apps, the camera image is processed on your device to read the merchant, date and amount. The image is not uploaded unless you choose to save it as an attachment.
• Biometric unlock.Face ID, Touch ID and fingerprint unlock are handled entirely by your phone's operating system. We never receive your biometric data — only a yes/no result.

3. How we use your data and our legal bases

If you are in the European Economic Area, the UK or Switzerland, we rely on the following legal bases:

We do not sell your personal data, and we do not use your financial records to target advertising.

4. Who we share data with

We share personal data only with service providers that help us run FinanceDuo, under contracts that restrict them to processing it on our instructions:

We may also share data:

• With other users, at your direction — members of a group you belong to see your name, email and the shared expenses within that group. Other users can find you by email or name when inviting you to a group.
• For legal reasons — when required by law, court order or to protect the rights, safety or property of our users or others.
• In a business transfer — if FinanceDuo is merged, acquired or sold, in which case this policy will continue to apply to your data.

5. International transfers

Some of our providers (for example Google, RevenueCat and Cloudflare) process data in the United States or other countries outside the European Economic Area. Where that happens we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses, together with additional safeguards where needed.

6. How long we keep data

• Account and financial records — for as long as you have an account. When you delete your account we delete your profile and records from our live systems.
• Attachments — until you remove them, delete the transaction they belong to, or delete your account.
• Shared-group expenses — expenses you added to a group may stay visible to the remaining members after you leave, so their balances stay correct; your name may be shown as a former member.
• Rewarded-ad tokens — short-lived, automatically removed after they expire.
• Server logs — kept for a limited period for security and troubleshooting, then deleted.
• Analytics and crash data — kept by Google according to the retention settings we configure, after which it is deleted or aggregated.
• Purchase records — kept as long as required by tax and accounting law.

Residual copies in backups are overwritten in the normal backup cycle.

7. Your rights and choices

Depending on where you live, you have the right to:

• Access the personal data we hold about you and get a copy of it.
• Correct inaccurate data — most of it you can edit directly in the app.
• Delete your account and data — in the app under Settings, or by emailing us.
• Export your financial data — the app lets you download it as CSV, and Premium users as a PDF report.
• Object to or restrict processing based on our legitimate interests.
• Withdraw consent at any time, for example by clearing optional profile fields, turning off notifications, or disabling ad tracking in your phone's settings. This does not affect processing that happened before.
• Complain to a data protection authority. Our lead authority is the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), but you can also contact the authority where you live or work.

To exercise any right, email support@finance-duo.com from the address linked to your account. We will answer within one month and may need to confirm your identity first.

Deleting your account does not cancel a Premium subscription bought through the App Store or Google Play. Cancel it in your store account first — see our Refund Policy.

8. How we protect your data

Data travels between your device and our servers over encrypted (HTTPS/TLS) connections. Every request to our API must carry a valid, short-lived sign-in token. Access to production systems is limited to the people who need it to run the Service. You can add a further lock to the mobile apps with Face ID or fingerprint unlock.

No system is perfectly secure. If we become aware of a breach that affects your personal data, we will notify you and the relevant authorities as required by law.

9. Children

FinanceDuo is not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

10. Changes to this policy

We may update this policy as FinanceDuo evolves. The date at the top shows when it last changed. If we make material changes we will tell you in the app or by email before they take effect.

11. Contact

Questions about this policy or your data: support@finance-duo.com.