My-Budget.top

1. Introduction

This Privacy Policy explains what information BudgetApp (the "Service") collects, why we collect it, and how we protect it. By using the Service, you agree to the collection and use of information as described in this policy. This document does not by itself provide legal protection; it describes the actual data-handling practices of the application.

2. Information collected

BudgetApp collects only the information you provide directly when creating and using your account, and the information necessary to operate the service. We do not collect browsing history, location data, contacts, or data from other applications.

3. Account and authentication data

When you register, we store:

Email address — used as your unique account identifier and for account recovery.
Display name (login) — a public-facing name shown in the interface. On email/password registration this is auto-generated as "Guest ####" and can be changed in Profile. On Google sign-in it may be prefilled from your Google profile name.
Password hash — stored as a bcrypt hash. The plaintext password is never stored or accessible to us.
Authentication token — a random token used for email verification (account activation).
Google ID (google_id) — the stable sub claim from Google's OpenID Connect token, stored only if you connect or sign in with Google. This links your BudgetApp account to your Google account.
has_password flag — indicates whether the account has usable email/password credentials.
Account status fields — creation date, last login timestamp, confirmation status, and active/inactive state.

You can have either or both sign-in methods (email/password and/or Google) on the same account. The Service never creates duplicate accounts for the same person.

4. Financial data entered by users

The core purpose of BudgetApp is to store and organize your personal financial records. You control all of the following data:

Wallets — names, currencies, and current balances.
Categories — custom income, expense, and transfer categories you create.
Transactions — income, expenses, and transfers between wallets, each with amount, category, wallet, date, and optional note.
Wallet transfers — records of moving money between your own wallets.

This data is stored solely for your personal use in the dashboard, reports, and charts. It is not shared, sold, or used for advertising or profiling.

5. Google OAuth

BudgetApp optionally supports Continue with Google using the OpenID Connect flow. When you choose this:

You are redirected to Google's consent screen.
Google returns an ID token containing your Google account's sub (unique, stable identifier), email, name, and given name.
BudgetApp verifies the token server-side (issuer, audience, signature) before using any data.
We store only the google_id (the sub claim) to link your BudgetApp account to that Google account.
We do not store Google access tokens, refresh tokens, or any other Google credentials.
The email from the Google ID token must match your BudgetApp account email when linking; otherwise the operation is rejected.

Google's own privacy policy applies to the data Google collects during the sign-in process.

6. Backup email

You may optionally add a backup email address in Profile → Backup Email. This is an additional contact/recovery address — it is not a separate sign-in method and is not used for authentication. It is stored encrypted at rest and is never shared.

7. Cookies and sessions

BudgetApp uses server-side PHP sessions to maintain your authenticated state:

A session cookie (typically PHPSESSID) is set on login. It contains only a random session identifier — no personal data.
If you check "Remember me", a long-lived remember_token (SHA-256 hash of a random value) is stored in the database and a corresponding cookie is set. The token allows automatic re-authentication across browser restarts.
Sessions are regenerated on each login to prevent fixation.
No tracking, analytics, or third-party cookies are set by the application.

8. Data security

All passwords are hashed with bcrypt (cost factor 10). Legacy SHA-512 hashes are upgraded to bcrypt on next login.
Database connections use TLS (the application runs behind HTTPS in production).
Prepared statements are used for all database queries to prevent SQL injection.
Session cookies are marked HttpOnly and Secure (HTTPS only).
CSRF protection (state parameter) is used for the Google OAuth flow.
Backup email is stored with basic sanitization; no additional encryption layer beyond the database's own is currently applied.

While we implement reasonable safeguards, no internet transmission or storage system is 100% secure. You are responsible for keeping your password and backup email secure.

9. Data retention and deletion

Account data is retained while your account is active.
You can delete your financial data (transactions, wallets, categories) at any time from the interface.
Account deletion is not yet implemented in the UI; to request full account deletion, contact us via the channels on the Contact page. We will process such requests within a reasonable timeframe.
Session and remember-token data are removed on logout or expiry.

10. Third-party services

BudgetApp integrates with the following third-party services:

Google OAuth (see section 5) — for authentication only.
Email delivery — activation and verification emails are sent via the server's local mail agent (no external transactional email provider is used).

No analytics, crash-reporting, advertising, or tracking services are embedded. No data is sent to third parties except as described above.

11. User responsibilities

Keep your password and backup email confidential.
Use a strong, unique password.
Do not share your account with others.
Ensure the financial data you enter is accurate and lawful.
Comply with applicable laws when using the Service.

12. Changes to this policy

We may update this Privacy Policy as the application evolves. The Last updated date at the top of this page will change. Continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact

If you have questions about this Privacy Policy or your data, contact us: