How MoneyLeft handles your data.
MoneyLeft works with an account: when it starts, it asks you to create one or to sign in. Your archive is kept on your iPhone, and a backup copy is kept on your account, on a server in Europe, until you switch it off. I do not use your data for anything other than letting you use the app — with a single exception, the records of what we have told you, described further down — and I do not look at your accounts, your transactions or your balances.
The data controller is Matteo De Min, the developer of MoneyLeft, reachable at matteo.de.min@outlook.it. There is no data protection officer: the app is made by one person, and I am the one who answers at that address.
On your iPhone: the archive is a file protected by the device's encryption — while the phone is locked it is unreadable even to someone holding it. The iOS keychain holds the account session, the email address of your last sign-in (so the app can greet you with "Welcome back" without you typing it again: not the password) and a random device identifier. iOS may keep the keychain even after you have uninstalled the app.
On your account, on the server:
On the server, row level security rules prevent any user — including you, if not correctly authenticated — from reading or writing another account's data.
On one point I would rather be explicit than let it be assumed: like anyone who runs a database, I have technical access to the data stored on the server. I do not use it to look at anyone's archive, and I only access it if you ask me for help with a problem that requires it, or, for the records described above only, if a dispute arises. If that is not acceptable to you, you can switch off the copy on your account, or export your data and delete the account at any time: the copies on the server disappear together with the account.
If you use a Shortcuts automation for Apple Pay payments, iOS passes to MoneyLeft only the amount, the merchant name and, if available, its category of the payment just made, which become a transaction as if you had entered it yourself. MoneyLeft does not read Wallet and does not see your card details.
On the phone the archive is encrypted by the system and unreadable while the phone is locked. All communication with the server is encrypted (HTTPS). On the server each account can read and change only its own data, thanks to row-level security rules, and technical access to the database is protected and used only in the cases described above. No system is one hundred per cent secure: if a data breach is likely to result in a high risk to you, we tell you without undue delay, as Article 34 of the GDPR requires.
The legal basis depends on what we do with the data.
Access to the account, syncing between your devices with MoneyLeft Pro and linking the subscription to you are based on the performance of the contract you accept by creating the account (Article 6(1)(b) GDPR): without processing that data we could not let you in, keep your devices in step, or recognise that the subscription is yours. The MoneyLeft Pro subscription is handled by Apple. On the same basis we process the messages you send me from the app, which are needed to reply to you, and we use your email for the notices provided for in the Terms: changes, suspension or closure of the account, closure or transfer of the service. On the same basis we use the date of the last sign-in to the account to recognise inactive accounts, as explained below.
The backup copy is based on the legitimate interest in protecting your data from loss if your phone breaks, is lost or is replaced (Article 6(1)(f) GDPR): we consider it to prevail because the copy serves you first of all, stays linked to your account, is not looked at by us, and can be switched off whenever you like, which deletes it from the server.
The records of what we have told you are based on our legitimate interest in being able to show, should a dispute arise, which Terms you had accepted and that we had notified you of the changes (Article 6(1)(f) GDPR). This is why we record only dates and versions of the texts, without email addresses.
Your data is never used for purposes other than those described here, nor for automated decision-making or profiling.
Only to those needed to make the account and the subscription work:
Nobody else. No selling, no sharing for advertising or statistical purposes.
If the service passes to another person or company, as the Terms explain, whoever takes over becomes the data controller: we tell you beforehand, in the app and at your account email.
We disclose your data to the authorities only when the law requires us to, for example under a court order (Article 6(1)(c) GDPR): in that case only the data requested and, where the law allows, we tell you.
On your iPhone: for as long as you keep the app installed and stay signed in to your account. If you sign out, the app waits for the last copy to reach the server and then removes the data from the phone (if the copy is switched off, before you sign out it warns you that the data on that phone cannot be recovered, unless it is synced with Pro or you have exported a backup); if instead the session expires, the data on the phone stays where it is until you sign back in. Uninstall the app and the local archive goes with it. If you delete the account, the app also erases the archive on the phone you delete it from, including any data it had set aside. The email address of your last sign-in stays in the keychain even when you sign out, and is removed when you delete the account.
On the server: for as long as your account exists. A device's backup copy disappears sooner if you switch it off: it is deleted from the server as soon as you confirm. When you delete the account from the app's settings, the data on the server is erased immediately and permanently along with the account — backup copies included, no bin, no residual retention period — with the sole exception of the records. "Delete all data", on the other hand, keeps the account and removes everything else, from the phone and from the server, backup copies included (with Pro active, only a technical list of what was deleted remains, without amounts, so that it does not reappear on your other devices): here too, only the records and the messages to the developer remain, which follow the rule below.
Messages to the developer are deleted automatically from the server 30 days after the last message in the conversation, and disappear immediately if you delete the account. You can delete a conversation yourself from the app, starting 24 hours after the last message.
The records are kept for as long as the account exists and, after you have deleted it, for a maximum of ten years: this is the ordinary limitation period for rights (Article 2946 of the Italian Civil Code), that is, the time within which a dispute could still arise. After deletion we use them only to defend our rights in that case, as permitted by Article 17(3)(e) GDPR, and when the period ends they are erased.
If we close an account for serious breaches of the Terms, the data on the server is kept for 30 days and then deleted as for a deletion, with the sole exception of the records. If MoneyLeft were to close, the data on the server is deleted on the shutdown date stated in the notice. The server provider's technical logs (IP address, date and time) are kept for at most 30 days for requests and, for account sign-ins, for as long as the session stays open and never beyond the deletion of the account.
If for 24 months in a row you never open the app with your account signed in and an internet connection, we delete the account and the data on the server the same way as if you deleted it yourself, with the sole exception of the records. To know this we only look at the date of the account's last sign-in on the server, which the app updates when you open it. At least 60 days before, we email the address on your account: to keep it, just open the app. We don't do this if you have an active MoneyLeft Pro subscription, and the data on your phone stays where it is.
No tracking. No advertising. No behavioural analysis. No selling or sharing of data with third parties. Only three network connections are possible: the one to our server for your account — sign-in, the backup copy if it is on, syncing with Pro, recording the records described above, the messages to the developer if you write to me and, if you subscribe, recording which account the purchase belongs to, so that it stays yours — the one to the App Store for the subscription, handled entirely by Apple; and, only if you use multiple currencies, reading the European Central Bank's public exchange rates from our server, which carries neither your account nor the app's data (only the IP address remains, as for every connection, in the server's technical logs). Nothing else.
The moneyleft.it website is published with GitHub Pages, a service of GitHub (GitHub, Inc., San Francisco, United States, and GitHub B.V., Amsterdam, Netherlands). When you visit a page, GitHub records your IP address for security purposes, even if you do not have a GitHub account. GitHub processes that data under its own privacy statement, which does not say how long it keeps it. GitHub participates in the EU-U.S. Data Privacy Framework. We publish the site on GitHub Pages on the basis of our legitimate interest in keeping it available and protected (Article 6(1)(f) GDPR).
The site uses no cookies and no statistics tools.
If you write to the contact address, I receive your email address and what you write. I use them only to reply to you. If your request concerns the app or your account, the legal basis is the performance of the contract (Article 6(1)(b) GDPR), as for the messages you send me from the app; for other requests it is our legitimate interest in replying to people who write to us (Article 6(1)(f) GDPR). The mailbox is an Outlook.com account from Microsoft (Microsoft Corporation, United States; for Europe, Microsoft Ireland Operations Limited, Dublin), which processes the data under its own privacy statement. The transfer to the United States goes to an organisation that participates in the EU-U.S. Data Privacy Framework, covered by the European Commission's adequacy decision (EU) 2023/1795. I keep them for as long as they are needed to reply and to handle any follow-up to the request, then I delete them. You can exercise the rights described below on this data too, by writing to the same address.
If you turn on the biometric lock, the face or fingerprint check is handled entirely by iOS: MoneyLeft only asks Face ID or Touch ID for a yes or no, and never sees or stores your biometric data.
Forecasts, saving suggestions and recurrence profiles are statistical calculations performed on your device, on your own numbers. They are not artificial intelligence and they are not sent anywhere.
To use MoneyLeft you must be at least 16 years old: by creating the account you confirm this.
Over the data linked to your account you may exercise at any time the rights set out in Articles 15 to 21 GDPR: access, rectification, erasure, restriction of processing, portability, and objection to processing based on our legitimate interest (the backup copy and the records: see below).
You can exercise almost all of them yourself, inside the app, without asking anyone:
For the others, or if something does not work, write to matteo.de.min@outlook.it: I reply within one month, as the GDPR requires.
You may object at any time to processing based on our legitimate interest (Article 21 GDPR):
You have the right to lodge a complaint with a supervisory authority. In Italy it is the Garante per la protezione dei dati personali (garanteprivacy.it). If you live in another country of the European Union, you may contact the authority of your own country.
MoneyLeft shows and projects your own numbers. It is not financial, investment or tax advice, and the forecasts are estimates based on your history.
We tell you with a notice in the app and, if the way we use your data changes, also at your account email, before the change applies. The date at the top shows the latest version.
Data controller: Matteo De Min, Frazione Sant’Antonio 148/4, 10081 Castellamonte (TO), Italy, VAT no. IT13334350017, REA TO-1355715.
For any question about this policy or about your data, write to matteo.de.min@outlook.it.