Privacy Notice

The short version

• Payce reads your bank only if you connect it, and only to read: it cannot move money or make payments.
• Everything the app works out from your data is shown to you and nobody else.
• We don’t sell your data, share it for advertising, or put analytics or trackers in the app.
• You can delete your account, and everything with it, in Settings at any time.

1. Who we are

Payce is run by Georgy Kikvidze, trading as Shynekrystal, registered with the Netherlands Chamber of Commerce (KVK) under number 99643138, at Amsterdam, the Netherlands. We are the controller of your personal data: we decide why and how it is used.

Contact us about anything in this notice at [email protected].

2. What we hold, and why

Your account

When you sign in with Apple, Apple gives our sign-in provider an identifier for you and your email address — or a private relay address, if you chose Hide My Email. We ask Apple for your email only, never your name. The sign-in provider keeps a log of sign-ins, including the internet address they came from.

Why: to sign you in and keep your data yours. Legal basis: performing our contract with you (GDPR Art. 6(1)(b)).

What you tell the app

Your primary currency, pay date and minimum balance; how money comes in; the balances you state for cash, checking and savings; the bills, income, budgets and transactions you add; your categories and the answers you give when the app asks what something was; your goals — names, amounts, dates, item links and pictures; your wishlists; loans you track; and the investment positions you enter (symbols and quantities).

Why: these are the app. Legal basis: our contract with you (Art. 6(1)(b)).

Your bank data, if you connect a bank

With your consent, given at your bank through Enable Banking, we receive for each account your bank shares: its name, the bank, the last four characters of its IBAN, its currency and its balance; and up to 13 months of transactions, then new ones each time it syncs — the date, the amount, who was paid or paid you and their IBAN, the description your bank gives, and the bank’s category codes. We never receive your bank login: you sign in at your bank, in your phone’s browser.

Why: to keep your figures current without you typing them. Legal basis: our contract with you (Art. 6(1)(b)), and your explicit consent to the account information service (PSD2 Art. 67).

What the app works out

From the above, the app files transactions into categories, finds your recurring bills and income, sets budgets, plans each week’s allowance, and judges whether a goal can be reached by its date. All of it is shown to you only.

Legal basis: our contract with you (Art. 6(1)(b)).

Your subscription

If you subscribe to Pro or Max, the App Store or Google Play sells it and takes payment. Through our billing provider we receive the plan, its status, which store sold it, the store’s identifier for it, the product, its trial, renewal and end dates, and whether it was a test purchase. Your payment details never reach us.

Why: to know how many bank accounts your plan connects. Legal basis: our contract with you (Art. 6(1)(b)).

What you agreed to

When you accepted the Terms and this Notice, and which versions; and for each bank connection, when you agreed to what it reads.

Why: we must be able to show that you agreed. Legal basis: legal obligation (Art. 6(1)(c), with Art. 7(1)).

Server logs

Our server records each request with your account’s internal identifier and its outcome — never your amounts, descriptions, payees or names.

Why: to keep the service running and secure. Legal basis: our legitimate interest in doing so (Art. 6(1)(f)).

3. Sensitive things a bank history can reveal

Transactions can reveal what the law treats as sensitive: your health, through pharmacy or doctor payments, or your beliefs, through donations or memberships. Payce files spending into categories, one of which is Health, and does so only to show you your own spending. You give your explicit consent to this when you connect a bank (GDPR Art. 9(2)(a)). None of it is shown to anyone else, combined with other people’s data, or used to train anything. You withdraw it by removing the bank connection.

4. What we don’t collect

Your bank login; the full IBANs of your own accounts (we keep the last four characters); card numbers; your location; your contacts; your photos; advertising identifiers; analytics or crash reports of any kind. Face ID and fingerprints stay on your phone: the phone tells the app only whether you unlocked it.

5. Shop links and pictures

When you paste a link to a shop’s page, our server fetches that page to read the item’s name, price and picture, so the shop sees our server, not you. Some shops refuse our server; for those, the app reads the page from your phone, and the shop sees your phone’s internet address, as it would if you opened the page yourself. Item pictures are loaded from the shop’s own address, so the shop sees the internet address of whoever views them — you in the app, or a visitor to a list you shared.

6. Shared wishlists — for the people you share them with

A wishlist you share is a page anyone with its link can open. It shows the things you chose to put on it — their names, pictures, prices and shop links — and nothing else about you: never your balances, your accounts or your other goals.

A visitor can reserve a thing by typing a name. That name is shown to other visitors of the same list, so nobody buys the same present twice; the app never shows it to the owner. So that the same browser can cancel the reservation, the page sets one cookie, wl_guest, which is strictly necessary and kept by the browser for up to 400 days. Nothing else is stored about a visitor. A reservation is deleted when it is cancelled, or with the thing it was for.

Legal basis for a visitor’s name: the visitor’s and the owner’s legitimate interest in the reservation (Art. 6(1)(f)). The cookie needs no consent because it is strictly necessary for what the visitor asked for.

7. Who handles your data for us

These companies process your data on our behalf, under data processing agreements:

• Supabase, Inc. — our database and sign-in. Your data is stored in Frankfurt, Germany.
• Railway Corporation — runs our server and keeps its logs, in Amsterdam, Netherlands.
• Enable Banking Oy (Finland) — a licensed account information service provider, supervised by the Finnish Financial Supervisory Authority, that connects to your bank when you ask it to.
• RevenueCat, Inc. (United States) — our billing provider. It receives the purchases you make in the stores and a random identifier for your account — never your name or email.

These act on their own account, under their own privacy policies: Apple (Sign in with Apple and the App Store), Google (Google Play), and your bank.

These receive no personal data at all: Frankfurter (exchange rates — a currency code), and Twelve Data and Yahoo Finance (prices — the symbol of an investment, never who holds it).

We do not sell your data, and we do not share it for advertising.

8. Data outside the European Economic Area

RevenueCat processes data in the United States, under the European Commission’s Standard Contractual Clauses. Supabase and Railway are US companies; they store our data in the region named above, and any access from outside the EEA is covered by Standard Contractual Clauses. Ask us for a copy of the safeguards.

9. How long we keep it

• Your account and everything in it: until you delete your account.
• A bank account you remove: it is never read again, and the consent at Enable Banking is ended once no other account from the same bank connection is still in use. Its transactions are hidden, and kept so they come back if you reconnect it, until you delete your account.
• When a subscription ends, or a lower plan covers fewer accounts: the bank accounts the plan no longer covers stop syncing, their consent is ended, and they are deleted with their transactions 30 days later — unless you subscribe again and reconnect before then. Everything you typed stays.
• Records of what you agreed to: as long as your account exists.
• Server logs: up to 90 days.
• After you delete your account: it is deleted straight away; copies in our database backups are overwritten within 30 days, and server logs within 90.

10. Your rights

• A copy of your data, and in a format you can take elsewhere: email us and we send it within a month.
• Correction: what you entered, you can change in the app. Bank data is your bank’s record; ask your bank to correct it.
• Deletion: Settings → Delete account. If you can’t open the app, see how to delete your account.
• Restriction and objection: email us, and we stop the processing you name while we look into it.
• Withdrawing consent to a bank connection: remove its accounts in the app, which ends the consent at Enable Banking. You can also withdraw it at your bank.
• A complaint: to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or the authority where you live or work. We’d like the chance to put it right first.

We confirm a request comes from you — from the email on your account, or from inside the app — before acting on it.

11. Automated decisions

Payce makes no decision about you that has legal or similarly significant effects. Its figures — the weekly allowance, budgets, whether a goal can be reached — are arithmetic shown to you, to act on or not. It never scores your creditworthiness, and nothing in it is financial advice.

12. Security

Everything between the app and our server travels encrypted. Our providers encrypt the database at rest. Your sign-in session is kept in your phone’s Keychain or Keystore, and only our server can reach the database.

13. Age

Payce is for people aged 18 or over. We don’t verify age, and don’t knowingly hold a minor’s data; tell us if you think we do, and we delete it.

14. Changes to this notice

Each version carries its date at the top. When we change something that matters, the app asks you to accept the new version before you carry on. Earlier versions are available on request.