Privacy Policy
Last updated: 2026-06-11
1. Data Controller
The controller of your personal data is the operator of GWYM (Grow With Your Money), a sole proprietorship (OSVC) registered in the Czech Republic.
Contact email: privacy@gwym.app
2. Personal Data We Collect
Account Data
- Email address (required for registration)
- Username (required for registration)
- Password (stored as a secure hash, never in plain text)
- First and last name (optional)
- Preferred language and currency settings
Financial Data
- Income sources and entries
- Expense categories and entries
- Assets, liabilities, and net worth data
- Invoices and receipts (uploaded files)
- Recurring transaction rules
- Bank account identifiers (IBAN, account numbers)
Usage Data
- Session data (authentication tokens)
- Anonymous analytics via Plausible (no cookies, no personal data)
- Error reports via Sentry (with financial data scrubbed)
3. Purpose and Legal Basis
| Purpose | Legal Basis (GDPR) |
|---|---|
| Providing the financial tracking service | Contract performance (Art. 6(1)(b)) |
| Account authentication and security | Contract performance (Art. 6(1)(b)) |
| AI-powered financial insights (Pro tier) | Contract performance (Art. 6(1)(b)) |
| Error monitoring and service stability | Legitimate interest (Art. 6(1)(f)) |
| Anonymous usage analytics | Legitimate interest (Art. 6(1)(f)) |
| Email notifications (service updates) | Contract performance (Art. 6(1)(b)) |
4. Data Recipients
We share your data with the following categories of recipients (sub-processors):
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Server hosting | Germany (EU) |
| Sentry (Functional Software, Inc.) | Error tracking (financial data scrubbed) | USA (EU SCCs) |
| Plausible Analytics | Anonymous, cookie-free website analytics | EU |
| Resend | Transactional email delivery | USA (EU SCCs) |
5. Data Retention
- Account and financial data: retained while your account is active
- After account deletion: all personal data is permanently deleted promptly upon request
- Error logs (Sentry): automatically deleted after 90 days
- Analytics data (Plausible): aggregated, no personal data retained
- Database backups: retained for 30 days, then permanently deleted
6. Your Rights
Under GDPR, you have the following rights:
- Right of access -- request a copy of your personal data
- Right to rectification -- correct inaccurate data via account settings
- Right to erasure -- delete your account and all data via account settings
- Right to data portability -- export your data in CSV format via the export feature
- Right to restriction -- request restriction of processing
- Right to object -- object to processing based on legitimate interest
To exercise any of these rights, contact us at privacy@gwym.app. We will respond within 30 days as required by GDPR.
7. Supervisory Authority
You have the right to lodge a complaint with the Czech Data Protection Authority (UOOU -- Urad pro ochranu osobnich udaju) if you believe your data protection rights have been violated.
8. Cookies and Local Storage
GWYM uses the following browser storage:
| Name | Type | Purpose | Required |
|---|---|---|---|
| sessionid | Cookie | User authentication | Essential |
| csrftoken | Cookie | Cross-site request forgery protection | Essential |
| django_language | Cookie | Language preference | Essential |
| theme | Local storage | Light/dark theme preference | Functional |
| cookie_consent | Local storage | Cookie consent preference | Essential |
Plausible Analytics does not use cookies and does not collect personal data. No third-party tracking cookies are used.
9. Automated Decision-Making
GWYM provides AI-powered financial insights and health scores. These are informational only and do not produce legal effects or similarly significant effects on you. All automated analyses can be reviewed and overridden by you. No decisions are made solely on the basis of automated processing.
10. International Transfers
Your data is primarily hosted within the EU (Hetzner, Germany). Where sub-processors are located outside the EU (Sentry, Resend), transfers are protected by EU Standard Contractual Clauses (SCCs) as required by GDPR.
11. Changes to This Policy
We may update this privacy policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email or in-app notification. The "Last updated" date at the top of this page indicates the most recent revision.