Privacy Policy
Effective August 11, 2026 · Takeout Budget Premium
The short version: your budget is yours. We have no account for you, no copy of your numbers we can read, and nothing to sell.
What we collect
No accounts, no sign-in, no analytics trackers. Your budget — income, bills, expenses, savings history — is stored on your device, in the app's local storage. We do not receive it, and there is no server of ours holding a readable copy.
Premium adds features that can contact a third party. Every one of them is off until you turn it on, and each is described below.
Optional: encrypted multi-device backup
Off by default. This is an encrypted backup channel, not live collaboration — edits upload automatically from each device, but you must tap Pull now on each device to see changes from another phone.
If you turn it on and set a sync passphrase, the app encrypts your entire budget on your device before anything is sent, using AES-GCM with a 256-bit key derived from your passphrase (PBKDF2-SHA-256). Only the resulting ciphertext is uploaded.
- Where it goes: a storage bucket we operate on Cloudflare (Cloudflare Workers + R2), acting as our processor. It holds an encrypted blob and the time it was last written. Nothing else.
- What we can see: nothing readable. We do not hold your passphrase — it stays in memory on your device during a session, is never saved to disk or export files, and is never uploaded. We cannot derive it. If you lose it, we cannot recover your backup for you — nobody can. That is the trade for us not being able to read it.
- How your backup is addressed: the storage identifier is itself derived from your passphrase, so it is not tied to your name, email, phone, or device.
- How long it is kept: until you delete it, or until it is overwritten by your next upload. We do not archive previous versions. If two devices edit offline, the last upload wins until you pull and merge on the other device.
Deleting your synced data
In the app: Premium → Encrypted backup → "Delete my synced data". Enter your sync passphrase and confirm. The stored copy is removed from the server and backup is switched off on that device. The budget on your phone is not touched by this.
Turning the sync switch off on its own only stops future uploads — it does not remove the copy already stored. Use the delete button for that. If you cannot access the app, email us at the address below and we will remove the stored blob; because it is addressed by a passphrase-derived identifier, we may need you to supply that identifier from the app to locate it.
Optional: store-name lookup
Off by default. If you turn it on and tap the button, your approximate location is sent once to OpenStreetMap's public lookup service to find nearby store names. We keep only the store name you pick. Your coordinates are never stored and never sent to us.
Optional: receipt camera
Off by default. Receipt and register photos are read on your device by an on-device text reader. The image is not uploaded — not to us, not to any cloud OCR service — and is discarded after the amount is read.
Optional: AI prompt-packs
The app can prepare a text summary of your numbers for you to copy into an AI assistant of your choosing. You do the pasting; the app sends nothing, and the text never touches our servers — we could not sanitise it for you without first taking a copy, which is exactly what we do not do. Read it before you paste it. It contains your income, your bill names and amounts, and where your money goes. Once it is in someone else’s chatbot it is governed by their terms, may be retained or used to train their model, and cannot be withdrawn. The text is editable in the app — take anything out before you copy it.
Downloads
The app may download library files — a display font, the on-device text reader — from public content networks. These are file downloads, like loading any web page. Your budget is not sent.
Backups
The Export button creates a file on your device. Where you keep or send that file is up to you. We never receive a copy.
Payments and subscriptions
Takeout Budget Premium is sold as an in-app subscription. Purchases are processed by Google Play; we never see or receive your card details.
To check whether this device is entitled to Premium, the app uses RevenueCat as our subscription processor. RevenueCat receives an anonymous app-user identifier and your Play purchase receipt, and returns "entitled" or "not entitled". Your budget data is never sent to RevenueCat — the two systems never touch. Managing, pausing, or cancelling a subscription is done in your Google Play account.
Children
Takeout Budget is not directed at children under 13. It is intended for adults managing household money (18+).
Changes
If this policy ever changes, the change will be visible on this page before it takes effect. Any future feature that would send your data off your device will be opt-in and explained in plain language first.