Privacy Policy

1. Data we collect and why

We collect only what we need to run the service for you:

• Account data — your email address, your name or display name, your password (kept only as a scrypt hash, never in readable form), and your interface preferences (language, timezone, reporting currency). An optional avatar image URL is stored if your sign-in provider supplies one. Purpose: to create and secure your account and sign you in. Legal basis: performance of our contract with you (Article 6(1)(b) GDPR).
• Google sign-in (only if you choose it) — if you use "Continue with Google", Google provides us your email address, name, profile-picture URL, your Google account identifier, and confirmation that Google has verified your email. We request only the openid, email and profile scopes. We do not request or receive access to Gmail, Google Drive, Google Calendar, your contacts, or any other Google product or data. We store an account-link record and the OAuth tokens Google returns, used solely to authenticate you. Legal basis: performance of our contract, triggered by your choice to use Google. Google’s own processing is governed by Google’s Privacy Policy.
• Content you enter — your Spaces, expenses (amounts, currencies, VAT rates, dates, status), vendor names, payment-source labels (type, optional card brand, and at most the last four digits of a card; the application is built to detect and reject full card numbers and full IBANs), currency rates, and any free-text notes. Notes and the optional "responsible person" name/email fields may contain personal data if you enter it — please keep that to a minimum. Purpose: to provide the service. Legal basis: performance of our contract.
• Technical and security data — server-side session records that keep you signed in; rate-limiting records tied to your IP address on authentication endpoints to prevent brute-force attempts and abuse; and server logs containing timestamps, HTTP status codes and coarse error codes. We deliberately do not log passwords, tokens, email addresses or financial free text, and strings that look like card or bank numbers are redacted. Legal basis: our legitimate interest in keeping the service secure (Article 6(1)(f) GDPR).
• Payment reminders (only if you turn them on) — if you enable "Notifications on this device" we store, per device you connect, the browser push subscription your browser gives us (an opaque endpoint URL at Apple / Google / Mozilla and two public cryptographic keys), your browser user-agent string, and a snapshot of your language and timezone so reminders are scheduled and worded correctly. We also keep a small log of which reminders were sent, missed or failed, so the same reminder is never sent twice. If you additionally opt in to email reminders, we send them to your verified account address via our email provider. This never includes card or bank data. Legal basis: performance of our contract, on your request. You can disconnect a device or turn reminders off at any time in Settings; disconnecting or signing out deletes that device record.
• Transactional email — we send email to verify your address, to reset your password, to confirm account deletion, and — only if you opt in — as payment reminders. We do not send marketing email, and turning payment reminders off never affects the verification / password-reset / security emails.

2. Cookies and local storage

We use a single essential session cookie (costlume.session_token) that keeps you signed in; a NEXT_LOCALE cookie that remembers your language choice; short-lived cookies used only during the Google sign-in exchange; and a costlume-theme value stored in your browser to remember light or dark mode.

We use no analytics, advertising or third-party tracking cookies. Because everything we set is either strictly necessary or a functional preference you choose yourself, no consent banner is shown.

3. Who we share data with

We do not sell your personal data and do not share it for advertising. We use the following processors, each bound by a data-processing agreement:

• Vercel Inc. — application hosting and content delivery. Deployment region: Frankfurt, Germany (EU).
• Neon Inc. — managed PostgreSQL database where your account and content data are stored. Region: Frankfurt, Germany (EU).
• Resend (Plus Five Five, Inc.) — delivery of the transactional emails described above (including opt-in payment reminders); receives your email address and the message content.
• Google Ireland Limited / Google LLC — only if you choose "Continue with Google", and only for authentication.
• Browser push services (Apple Push Notification service, Google FCM, Mozilla) — only if you turn on device notifications; they relay the reminder to the device you connected. The message contains the merchant name and amount from your expense, no account credentials.

4. International transfers

Your account and content data are stored in the European Union (Frankfurt). Some of our processors (Vercel, Resend, Google) are established in the United States. Where personal data reaches them, the transfer relies on the European Commission’s Standard Contractual Clauses and/or the EU–US Data Privacy Framework, together with the safeguards set out in those providers’ data-processing terms.

5. How long we keep data

• Account and content data: kept for as long as your account exists.
• Sessions: expire automatically after a period of inactivity (currently seven days) and on password reset or sign-out.
• Rate-limiting records: short-lived; cleared automatically once their time window passes.
• After account deletion: when you confirm deletion, your user record and every piece of data linked to it — Spaces, expenses, vendors, payment sources and any categories you created — are removed from the live database immediately. We keep encrypted database backups for disaster recovery only; these are retained for a limited period and then expire automatically, after which the deleted data no longer exists in any of our systems. We do not restore individual accounts from backups.

6. Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to processing, and to receive your data in a portable format. You also have the right to lodge a complaint with a supervisory authority — in Latvia, the Data State Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv).

You can already, at any time: edit your profile in Settings; delete individual expenses and non-primary Spaces yourself; export your expenses as CSV from the dashboard; and permanently delete your entire account from Settings (we email you a link to confirm). For a copy of all of your account data in a portable format, or to exercise any other right, email kristaps.groza@gmail.com.

7. Security

We protect your data with encryption in transit (TLS), encryption at rest provided by our infrastructure providers, password hashing with scrypt, server-side sessions, rate limiting and origin/CSRF checks on sensitive actions, and strict security headers (Content-Security-Policy, HSTS). No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the competent authority of a personal-data breach where the law requires it.

8. Children

Costlume is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18; if you believe a child has provided us data, contact us and we will delete it.

9. Changes to this policy

We may update this Privacy Policy from time to time. The "last updated" date at the top changes with each revision, and for material changes we will notify signed-in users.

10. Contact

SIA Krostel, registration number 40203674283, Aviācijas iela 1–75, Rīga, LV-1057, Latvia. Email: kristaps.groza@gmail.com.