Privacy

Shmudget holds the budget you type into it and the email address you signed up with. That is nearly all of it. I do not sell any of it, I do not advertise against it, I do not connect to your bank, and I do not read it for anything except fixing a fault you have asked me to fix.

The rest of this page is the detail, including the parts that are less comfortable. Clause 5 is the one worth reading.

To give you an account:

• your email address, and your name if you gave one
• a scrambled version of your password, never the password itself, so nobody including me can read it back
• whether you signed in with Google, and the id Google uses for you. Not your Google password, and no key to your Google account
• whether you have confirmed your address, and which version of the terms you accepted

Then whatever you put in the budget:

• every line you enter, with its amount, how often it happens and when
• the names you give things: categories, types, providers, which account a line comes out of
• anything you write in a description or a comment
• your dashboards, and your currency, format and theme settings
• if you have shared your budget, the address you invited and whether they took it up

Descriptions and comments are free text and I never look inside them, which cuts both ways: whatever you type there is stored exactly as typed. It is a good place for "car rego, due March" and a bad place for an account number.

• No connection to your bank. Shmudget cannot see your accounts or your transactions, and no screen anywhere asks for a bank login
• No card numbers. If you pay for a plan, the card goes to the payment processor on its own form and never reaches Shmudget
• No BSB, no account number, no tax file number, no date of birth, no home address, no phone number. Nothing in the app asks for any of them
• No location, no contacts, no address book, and nothing that follows you around other websites

Running your account, showing you your budget, emailing you a confirmation code when you sign up, and replying if you write to me. Also keeping the thing working, because knowing that a page broke is how it gets fixed.

Two other sorts of email exist. A notice about the service itself (planned downtime, a change to the terms, anything that has touched your data) goes to everyone with a confirmed address, because you would be worse off not knowing. Anything with a pitch in it, meaning new features and the occasional discount, only goes to people who ticked the box for it when they signed up. That box starts unticked, every one of those emails carries a link that stops them in one click, and the same switch is in your settings.

Not for building a profile of you, not for advertising to you anywhere but in those emails, not for training anything, and not for selling or renting to anybody. Your address never goes to a mailing list company. If that ever changes I will tell you before it does rather than after.

Running an app means paying other companies to do parts of it. These are the ones involved, and what each can see:

• Cloudflare hosts the app, stores the database, and runs the check that keeps bots off the signup and contact forms. It can see everything the app stores, plus your IP address and a log of the requests your browser makes
• Resend sends the email, when Cloudflare is not carrying it. Either one sees your address and what the message says, which is a confirmation code, one of the notices or offers above, or your own contact message on its way to me
• Google is involved only if you choose the Google sign-in button, and then only to tell me the address is yours
• A payment processor handles paid plans. It takes the card on its own form and hands back a reference. What is stored here is that reference, which plan you are on and whether it is current

The one worth spelling out is the logos. When Shmudget shows a little icon next to a provider, your browser fetches that icon straight from a public favicon service, currently DuckDuckGo with Google as a fallback. That request carries your IP address and the web address of the company whose icon it is. So that service can work out that somebody at your connection was looking at a page mentioning that bank, that insurer or that lender. It never receives anything from the database, so it does not see your amounts, your name or your account. It is still more than nothing, which is why it is here rather than buried. If it bothers you, tell me and I will look at serving the icons myself.

None of these companies may use your information for their own purposes, and I do not hand it to anybody else unless a law actually requires it.

One cookie keeps you logged in. That is the app working rather than the app watching, and you cannot turn it off and still have an account. Another remembers whether you picked the light or the dark theme.

Shmudget may also run Google Analytics, which sets its own cookies and tells Google which page was opened, roughly where in the world from your IP address, and what browser you used. Page addresses here are things like /dashboard and /entries, so none of your figures, names or categories go anywhere near it. If you would rather not be counted, a browser that blocks trackers blocks this one, and nothing in the app breaks when you do.

On Cloudflare's network, which spans a lot of countries, and the other companies in clause 5 are global too. So your information may be stored or handled outside Australia, and I cannot honestly promise it stays here. What protects it there is the contracts those companies operate under rather than geography.

Your budget stays until you remove it. Delete a line and it is gone. Delete your account from Settings and the whole lot goes with it, immediately and with no undo, so export first if you might want it back. Backups may hold a copy for a short while after that before they age out.

Confirmation codes expire on their own. If you write to me through the contact form, that message sits in my mailbox like any other email until I clear it out.

Inviting somebody in gives that address everything in your budget, and an editor can change everything in it. That is the point of it, but it does mean you have handed your finances to another person, and you should be as sure of them as you would be handing over a folder. You can take the access away again at any time from Settings, and taking it away is the only thing that stops it.

Nearly all of it is already on your screen, and you can change any of it by editing it. You can export the whole budget to a CSV whenever you like, and delete the account whenever you like. If you think I am holding something about you that is wrong, or you want to know exactly what there is, use the contact button and ask. I will answer.

What is actually in place:

• everything travels over an encrypted connection
• passwords are stored as a one-way hash, so a copy of the database does not hand anybody your password
• every query is scoped to your own budget, so one account cannot read another's
• no key to your Google account is kept, even briefly, because the app has no reason to hold one
• the app never stores a rendered page in your browser's offline storage, so your figures do not outlive the session on a shared computer

What I will not tell you is that it cannot be broken into. This is one person and one app, no system is proof against everything, and anybody promising otherwise is selling something. What I can promise is that I do not collect what I do not need, which is the only protection that still works when the rest of it fails.

If somebody gets into the database, I will email everyone affected as soon as I understand what actually happened. I will tell you what was taken, what it means for you and what to do about it, and I will say it plainly even when it makes me look bad. I would rather tell you early and be embarrassed than tell you late.

You need to be at least 16 to have an account, the same as in the terms. Shmudget is not built for children and I do not knowingly hold anything about one.

This page will change as the app does. The current version is always here with a date at the top. If a change matters to you I will tell you in the app or by email before it takes effect.

Come to me first, through the contact button in the app. I read every message and I would rather hear it from you than not hear it. If you are not happy with how I handled it, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au, which oversees privacy in Australia.