Budg AI Privacy Policy

Effective date: 17 September 2026. Operator: MobiStack (contact@mobistack.co).

1. Who we are

MobiStack makes and operates Budg AI, a personal finance app with a built-in AI assistant. We decide how and why your personal data is processed through the app, which makes us the data controller where that term applies. You can reach us at contact@mobistack.co.

This policy explains what we collect, why, who processes it for us, how long we keep it and what you can ask us to do. It is written to match the privacy details shown on the app's App Store page.

2. What we collect

Linked to your account

• Contact details: your email address and name, from the sign-in method you choose (Sign in with Apple, Google, or email and password, all handled by Firebase Authentication). If you hide your email with Sign in with Apple, we receive Apple's relay address instead.
• Financial information you enter or import: accounts and balances, transactions, budgets and your answers to the budget questionnaire, goals, planned payments, categories, currencies and exchange rates, and the statement files you import (CSV, Excel or PDF) together with the transactions read from them.
• Purchase history: whether you have a Premium subscription, which plan, and when it renews or expires. We validate this with Apple or Google. We never see your card number or payment details; the stores handle payment.
• Profile photo, if you choose to add one.
• Conversations: your chat messages with Budg, transcripts of your voice conversations and voice notes, and Budg's replies.
• Identifiers: your Firebase user id, an app instance id for your device, and a push notification token if you turn notifications on.
• Usage data: which screens and features you use, collected as Firebase Analytics events, so we can see how the app is used and improve it.

Not linked to you

• Diagnostics: crash reports from Firebase Crashlytics, used only to find and fix bugs.

What we do not collect

• Bank login details. The app never connects to your bank.
• Card numbers or payment details.
• Your location, your contacts, or an advertising identifier.

We do not show ads, we do not sell your data, and we do not track you across other companies' apps or websites, so the app never asks for tracking permission.

3. Device permissions

• Camera and photo library: only for the optional profile photo.
• Microphone: only for voice mode and voice notes, while you use them.
• Notifications: optional, for bill reminders, goal deadlines, tracking streaks and weekly recaps. You choose which ones in the app and in your device settings.

4. Why we use your data

• To provide the service: store your finances, build your budget, show your charts and reminders.
• To sync your data between your devices and keep the app working offline.
• To power the AI features: answering your questions, drafting budgets, categorising and recording transactions, and voice conversations.
• To send the reminders and notifications you turn on.
• To understand how the app is used and improve it (analytics), and to find and fix crashes.
• To keep the service secure, validate purchases, prevent abuse, and meet our legal obligations.

Where the GDPR or a similar law applies, we rely on: performance of our contract with you (providing the service and Premium), your consent (notifications and the profile photo), our legitimate interests (security, preventing abuse, and understanding how the app is used so we can improve it), and legal obligations.

5. Who processes your data for us

We use these service providers. Each one processes data only to provide its service to us.

We may also disclose data if the law requires it, to protect the rights or safety of you, us or others, or to a successor if MobiStack is sold or merged, in which case this policy continues to apply to your data.

6. How the AI features use your data

When you ask Budg something, your message and the relevant parts of your financial data (for example your recent transactions, budget and goals) are sent to the AI provider to generate the answer. In voice mode your audio is streamed to Google's Gemini service, which returns speech and text; we keep the transcript in your conversation history, not the audio. Voice notes are sent to OpenAI for transcription and the audio is not stored.

We do not use your data to train AI models, and we do not give it to anyone for that purpose. Our AI providers receive it only to generate the response to your request.

7. How long we keep your data

We keep your data for as long as your account exists. You can delete your account at any time in the app (More > Advanced > Delete Account) or at https://piggyaibackend.fly.dev/legal/delete-account. Deleting your account removes your account and its data from our live systems; copies held in backups are purged within 30 days. Records we must keep by law, for example about purchases, are kept for the period the law requires. Anonymous analytics and crash data that cannot be linked to you may be kept longer.

8. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you;
• correct it if it is wrong (most of your data you can edit directly in the app);
• delete it (see section 7);
• receive a copy of it in a portable format;
• object to or restrict some processing;
• withdraw consent at any time where processing is based on consent, for example by turning off notifications;
• complain to a data protection supervisory authority, in particular in the EU or UK country where you live or work.

To exercise a right that the app does not cover, email contact@mobistack.co. We will answer within the time the law requires, and within one month under the GDPR.

9. Children

Budg AI is not directed to anyone under 18, and we do not knowingly collect personal data from them. If you believe a person under 18 has created an account, contact us and we will delete it.

10. Security

Data travels between the app and our servers over encrypted connections (HTTPS and TLS). Our hosting providers encrypt stored data. Every request to our servers is authenticated with your Firebase sign-in token, and every read and write is limited to your own account. Purchases are validated on our servers against Apple and Google, never trusted from the device alone. Access to production systems is limited to the people who need it. No system is completely secure, so please keep your sign-in details safe and tell us at once if you think your account has been misused.

11. International transfers

Our application servers run in the European Union (Frankfurt, Germany). Some of the providers listed in section 5, including Google, OpenAI, MongoDB Atlas and Apple, may process data in the United States or other countries. Where the law requires, these transfers rely on the safeguards those providers offer, such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

12. Changes to this policy

We may update this policy. We will publish the new version at this address with a new effective date and, for significant changes, tell you in the app or by email.

13. Contact

MobiStack, contact@mobistack.co.