TraceCosts Privacy Policy
First and most important: we do not sell your data. Ever. TraceCosts is a personal finance app that works on your device first; your numbers are yours.
1. What data the app handles
Data you enter: transactions (amounts, categories, notes, merchants, tags), accounts and balances, budgets, savings goals, recurring rules, templates, receipt and goal photos, your profile name and declared monthly income (both optional), and preferences. They are stored in a local database on your phone.
Account data (optional): if you create an account for backup, we store your email address, a user identifier and, if you typed one, your profile name. Your password is handled by our authentication provider (Supabase Auth) with secure hashing; we never see it or store it in plain text.
Usage analytics: the current version of the app does not send usage analytics, crash reports or advertising data. If we ever turn analytics on, we will update this policy before that version is released. Those events would never include amounts, notes, merchants, names, emails, or balances, and while you are signed in they would be linked to your account, not anonymous.
2. Where your data lives
The app is offline-first: everything works without a connection and your data lives on your device. If you turn on backup, your records (transactions, accounts, categories, budgets, goals, recurring rules, templates, and your profile with its name, declared income, and preferences) sync encrypted in transit (TLS) to our database on Supabase, where every row is protected by per-user isolation (Row Level Security): neither other users nor third-party applications can read your records. Receipt photos are backed up to private per-user storage; your goal photos are never uploaded to our servers.
3. Who it is shared with
No one, for commercial purposes. We only use one infrastructure provider to operate the service: Supabase (database, authentication, and backup storage). There is no analytics service, no advertising, and there are no data brokers.
4. Your rights and controls
Right from the app, no need to contact support:
Export everything: Settings → "Export & delete (Your data)" → "Export ALL my data" generates a complete JSON file with transactions, accounts, categories, budgets, goals, recurring rules, templates, and profile. This right is always free.
Delete everything: Settings → "Delete account & data", type DELETE and tap "Permanently delete everything". If you signed in, this permanently deletes your cloud data and your sign-in record (email address); it also wipes the device. We only keep a record of the deletion date, with no personal data. Full guide (including what to do if you no longer have access to the app): delete your account.
Trash: deleted transactions can be restored for 30 days; after that they disappear from the app's views.
5. Retention
We keep your cloud data for as long as you keep your account. If you delete it from the app, the deletion of your cloud data and your sign-in record is permanent and immediate. Without an account (local mode), we hold nothing: your data exists only on your device, and permanent deletion or uninstalling the app removes it from the app.
Your phone's own backups: on iPhone, if iCloud Backup or a computer backup is on, the app's local database and photos are included in that backup, which you control (it is what restores the app on a new iPhone). Deleting the app does not remove copies already in those backups. iOS also keeps the app's secure storage (the sign-in session and the PIN lock) after the app is deleted; TraceCosts clears them the next time it is installed. On Android, the app's data is not included in device backups.
6. Children
TraceCosts is not directed at children under 13, and we do not knowingly collect data from children.
7. Changes to this policy
If we change this policy, we will update the date on this page and announce it in the app when the change is significant.
8. Contact
Privacy questions or requests: support@mordobo.com.