Privacy Policy

🔒 In one line

📱 You can use the app without an account

On iPhone, Sobres works in two ways, and you choose:

• Local mode (no account): when you choose "Continue without an account", the whole app works and your data —budgets, accounts, transactions, categories, goals— is stored only on your device. In this mode we don't send anything to any server or collect your email.
• Synced mode (with an account): if you create an account or sign in, you turn on backup and sync between your devices. You can go back to local mode by signing out; your data stays on the device.

The web app (app.sobres-app.com) always requires an account: your data is stored on our server and displayed in your browser. It's the same account and the same budget as on your iPhone.

📝 Information we collect

We collect only the following, and only to run the app:

• Account data (only if you create an account): your email address and an encrypted password, to sign in and recover access, and the language you prefer for your account emails. If you sign in with Apple or Google, instead of a password we receive from that provider your email and the basic profile data it shares (such as your name). If you use local mode without an account, we don't collect your email.
• Budget data you create: budgets, groups and categories, accounts and cards you enter manually, transactions and amounts, savings goals and scheduled payments. On iPhone it is always stored on your device and syncs to the cloud only if you're signed in; in the web app it lives on the server.
• Visits to the web app: for each page you open on app.sobres-app.com we record the page (without any identifiers in the address), the approximate country, region and city derived from your connection, the type of device, the browser and operating system family (no version), the browser language and, if you came from another site, that site's name (not the page). We also note when a transaction is entered from the web and from which screen. We don't store your IP address or your browser's full identifier: we use them to calculate a code that changes every day and can't be reversed, only to count distinct visitors. If you're signed in, the record also carries your account identifier. These records are deleted automatically after 120 days.

⚙️ How we use your information

• To store and display your budget on your device (always on iPhone) or in your browser (in the web app).
• If you have an account: to authenticate you, keep your session and sync your budget between your devices.
• If you have an account: to send you account emails (verification and password recovery).
• To understand how Sobres is used and decide what to improve: with visits to the web app and with aggregate figures calculated over accounts (for example, how many people use each currency, how many have recorded transactions or how many keep using the app after their first week). Those figures are totals: they can't be used to see anyone's budget.

☁️ Storage and sync

Your data is always stored locally on your device (with Apple's SwiftData). In local mode (no account) that's where it ends: nothing is sent to any server.

Only if you're signed in, your data is backed up and synced on Supabase, our database and authentication provider. Each user is isolated by row-level security rules (Row Level Security): only you can access your own data. Communication with the server is always encrypted in transit (HTTPS/TLS). Supabase processes the data on our behalf; its servers may be located outside your country.

The web app and this site are served from Vercel, our hosting provider. Vercel is the one that derives the approximate country and city from your connection that are used to count visits.

🍪 Cookies and browser storage (web app)

The web app uses only its own cookies, needed for it to work or to remember your preferences:

• Session: they keep you signed in to your account, and one more signs you out automatically after 15 minutes without use.
• Preferences: theme and appearance, hide balances, language, time zone, payment reminders, active budget and the accounts you pin to the top. They belong to this browser and aren't sent to anyone else.

It also keeps in the browser's local storage the time of your last activity (so the inactivity sign-out works across tabs) and the day of the last payment reminder (so it isn't repeated). We don't use advertising, analytics or third-party cookies.

💱 Exchange rates (multi-currency)

If you use accounts in another currency, the app looks up a global exchange-rate table on our server. It's a read-only lookup and doesn't send any of your personal or financial data.

🚫 What we DON'T do

• We don't use third-party analytics, telemetry or tracking tools: the web app's visit measurement is our own and its data doesn't leave our database
• We don't access your location, contacts, camera or microphone
• We don't use advertising identifiers or cross-app tracking
• We don't sell, rent or share your information for commercial purposes
• We don't show ads of any kind
• We don't connect to your bank or read statements: you enter balances and transactions manually

🤝 Sharing with third parties

We don't sell or share your personal information with third parties for commercial purposes. We only share it with the infrastructure providers strictly necessary to run the app —Supabase, for authentication and database, and Vercel, to host the web app—, which process it under our instructions. Like any internet service, those providers keep technical request logs (including the IP address) for a limited time to operate and protect the service. If you sign in with Apple or Google, that provider knows you use Sobres to sign in. We may also disclose your information if required by law.

🔑 Face ID / Touch ID

Sobres can use Face ID or Touch ID to lock access to the app, along with a privacy mode to hide your balances. Biometric authentication is handled entirely by iOS; the app never accesses or stores your biometric data.

💾 Backups and export

You can export your information as JSON (full backup) or CSV (transactions). These files are generated on your device and shared only wherever you decide to send them (AirDrop, email, etc.).

🗑️ Deleting your account and your data

You can delete your account directly from the app, on iPhone or on the web (Settings → Delete account). Once you confirm, your user and all your associated data on the server are permanently deleted —including the web app visit records that carry your account identifier—, as well as the local copy on the device you delete it from. This action is irreversible. If you also delete the app, the local copy is deleted too.

Visits you made without being signed in don't carry any data that lets us link them to you, so they can't be deleted per account: they're deleted automatically after 120 days.

🛡️ Security

We protect your information with encryption in transit (HTTPS/TLS), passwords stored in encrypted form and per-user isolation (RLS). No system is 100 % foolproof, but we apply reasonable measures in line with best practices.

👶 Children

Sobres is not directed at children under 13 and we do not knowingly collect information from children. If you believe a child has given us data, contact us to have it deleted.

✏️ Changes to this policy

If we change this privacy policy, we will publish the updated version on this same page and update the effective date. We recommend reviewing it periodically.

✉️ Contact

Do you have questions about privacy, or want to exercise your rights over your data?
Write to us at hola@sobres-app.com