Privacy

Controller

This application is operated by Luca Tillinger, reachable at info@rehluchs.de.

End-to-end encryption

All financial data (amounts, descriptions, categories, goals, accounts, family names) is encrypted in your browser before it is sent to the server. The operator is technically unable to read it.

What is stored

Email address, a hash of your login proof, encrypted keys and records, language, colour theme, currency, sign-in times, security events (e.g. failed sign-ins) and the browser identifier of signed-in sessions.

What is not stored

Your password, your recovery key and your financial data in plain text. There is no tracking, no analytics and no third-party content (not even external fonts).

Cookies & local storage

One strictly necessary session cookie for sign-in, optional cookies for language and theme. During a session your key is kept in your browser's local storage – encrypted with a session key held by the server. It is deleted when you sign out.

Server logs

The web server logs technical access data (e.g. IP address, time, requested URL) to fend off attacks. These are deleted after a short time.

Hosting

The application is hosted on a server in Germany operated by Strato.

Product search & affiliate links

When you search for products, the search term is sent to the partner (e.g. Amazon) but not stored. Product links are affiliate links: when clicked, the shop learns that you came from this app. Product images are loaded directly from the partner. If you paste a product link, the server fetches that public product page once (without any of your data) to read name, price and EAN and to look for the same product on Amazon.

Bank connection

When you connect a bank, access happens via Enable Banking Oy (Finland), a licensed account information service. Transactions pass through our server when fetched, are not stored, and are saved encrypted by your browser.

AI categorisation

For automatic categorisation, the counterparty and reference of new transactions (no amounts or account numbers) are sent to the configured AI model and not stored. The AI model is an open-source model running locally on the server. No external AI services are used.

Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection. You can export and delete your data yourself at any time in the settings. You may also lodge a complaint with a data protection authority.