Privacy Policy
Last updated September 30, 2026
Table of contents
1. Controller
The data controller for Tesorly is Incognito, an individual entrepreneur registered in Georgia. You can reach us at hello@tesorly.com with any privacy question or request. This policy explains what we process, why, and what your rights are, under the Law of Georgia on Personal Data Protection and, where it applies to you, the EU/UK General Data Protection Regulation (GDPR).
This policy is written in English. The English text is the only binding version; any translation is provided for convenience.
2. Data we collect
Account data: your email address and whether you have confirmed it (and, while you are changing it, the new address waiting for its confirmation link), display name, a bcrypt hash of your password if you have set one (never the password — an account created through Google or Apple has none until you set it), your preferred currency and language, and, if you choose to provide them, your date of birth and an avatar image (PNG or JPEG, up to 1 MiB).
Sign-in through Google or Apple: when you sign in with, or link, a Google or Apple account, the provider gives us its stable identifier of you, the email address it holds for you (Apple may give a private relay address that forwards to your real one, if you choose to hide it), whether it has verified that address and, the first time, the name it holds. We keep the identifier and the address as reported, to recognise you next time and to show in Settings → Security which accounts are linked. We do not receive the provider’s password, and we keep none of its tokens beyond the seconds needed to verify the sign-in. For the minutes a sign-in takes we hold its state, a nonce and a hash of a secret kept by your browser tab, so that the answer can only come back to the tab that started it.
Sessions: for each sign-in, the family of the device — the operating system and the browser, or the Tesorly app, as the browser names them (for example «Windows · Chrome» or «iPhone · Safari»), never the full User-Agent string and never a network address — and when the session started and was last used. Settings → Security lists them and lets you end any of them.
Financial data you record in your ledgers: transactions (amount and currency, the converted amount in the ledger’s base currency and the rate used, date, description, category, the bank’s reference id for an imported transaction, who recorded it and who paid), categories, budgets, savings goals and contributions, recurring-transaction rules, categorization rules, shopping lists (each list’s name; its items — the text you typed and an optional note — with who added and who ticked each item and when, and the transaction an item was recorded into; an item that was recorded as an expense or cleared from the list is kept for 180 days after it was ticked and then deleted), and for each statement import its file name, format and counts. The statement file itself is parsed and discarded; its contents survive only as the transactions you chose to import (descriptions may include counterparties, references and account numbers as they appeared in the statement). A receipt photo is read on your device and never reaches us — in the browser and in the app alike, by our own recognition models downloaded from our server (see section 5) — and only the transaction you save from it is stored.
Shared-ledger data: your membership in each ledger, your role, your share weight (a number you set for proportional splitting, for example a monthly income), invitations you send (the invited email address, the account it resolved to, an optional message) and invitations addressed to you.
Notifications: the in-app notifications generated for you (budget alerts, goal reached, a goal’s deadline approaching, upcoming recurring transactions, ledger invitations, your Pro plan ending), each with a snapshot of the event it describes, and whether you have read them.
Plan and payment data: whether your account is on the free plan or Pro, until when, whether you have used the free trial, and a note when Pro was granted by us; and, for each Pro purchase, the term bought, the price in US dollars, the status of the payment, the gateway’s invoice identifier and, as the gateway reports it, the cryptocurrency and amount received. We do not store wallet addresses or transaction hashes.
Consent records: which version of the Terms of Service and of this Privacy Policy you accepted, when, and your product-updates email preference.
Technical data: your IP address, used to rate-limit login, registration, sign-in through a provider, password resets, email confirmation and account deletion and written to server logs together with the method, path, status code and timing of each request; a hash of each refresh token issued to you and of each password-reset or email-confirmation link sent to you (never the token itself); and, from the Tesorly app, the platform and version of the app, so that an outdated app is told to update.
Usage data: when you last used the Service (recorded once an hour at most), and the steps of your first days with it — opened the home page, started and finished registration, recorded a first transaction, saw a Pro offer, started a trial, paid — together with which screens you open (the screen’s name, never what is on it, never an address you typed) and which features you use (recording a transaction, an import, a rule, a budget, a goal, an invitation, an export, a receipt photo), and the errors the Service runs into on your device — when it shows its error screen, or when an error it did not expect occurs: where the error was caught, the screen’s name, the version of the web page or the app, the platform (web, Android or Windows) and the error’s text, cut to 200 characters, with any email address, token, identifier or long number removed on your device and again on our server. Each step carries your interface language, your screen width and, when another site sent you, that site’s domain. The steps are recorded under an anonymous device id that the Service generates and keeps in your browser’s local storage or, in the Tesorly app, in the app’s own storage on the device — never a cookie — and, once you are signed in, are linked to your account. They stay on our server and are never shared. You can switch this off in Settings → Privacy → Usage statistics. While your browser sends Do Not Track or Global Privacy Control, nothing its requests do is counted — neither in the browser nor on our server; the Tesorly app has no such signal, so there the switch in Settings → Privacy is the way to opt out. Only a payment, which the payment provider reports to us, is still recorded unless you switch counting off.
We do not collect: your online-banking credentials, your precise location, hardware or advertising identifiers, advertising data, third-party analytics, statement files or receipt photos.
3. Purposes & legal bases
We process your data only to provide and secure the Service, on the following legal bases:
- Performance of a contract — running your account (including the email that confirms your address, a password-reset email when you ask for one, and verifying a sign-in through Google or Apple), storing and showing your records, computing budgets, goals, conversions, forecasts and shared-ledger balances, and delivering in-app notifications.
- Legitimate interests — securing the Service: rate-limiting, abuse prevention, server logs, refresh-token rotation and reuse detection, a session per device so that you can see and end them, and confirming that an address belongs to the person using it; and understanding how the Service is used so we can improve it: the usage data in section 2, counted by us alone, which you can switch off at any time.
- Consent — the product-updates email preference. No such emails are sent today; the preference is stored so that it is honoured when they are, and you can withdraw it at any time.
- Legal obligation — where the law requires us to retain or disclose specific data.
4. Automated processing
Categorization rules, receipt recognition, duplicate detection on import, budget forecasts and shared-ledger balances are automated, but none of them makes a decision that produces a legal or similarly significant effect on you (GDPR Article 22). They only suggest or estimate; you decide what is saved.
Receipt recognition runs entirely in your browser: the recognition models and runtime are downloaded from our own server and the photo is read on your device. The photo is not uploaded to us or to anyone else; only the transaction you choose to save, after checking the draft, is sent to the Service.
6. Where your data is stored
We are established in Georgia and the data is stored with our hosting provider and its encrypted backups with Backblaze B2 (section 5). If you use the Service from another country, including the EU/EEA or the UK, your data is processed outside your country when you send it to us. Where the law requires a safeguard for such a transfer, we rely on the safeguards available to us, such as standard contractual clauses with these providers; contact us for details.
7. Retention
We keep your data for as long as your account exists. Deleting your account removes it immediately and irreversibly, cascading to everything that references it — except the records you wrote in a shared ledger that still has other members, which stay with that ledger with your name removed, and the shared ledgers you are the only member of, which are deleted with you. The database is copied every day into an encrypted backup, and each copy is kept for up to twelve months (daily copies for 14 days, weekly copies for 8 weeks and monthly copies for 12 months) and then deleted, so data you delete, including a deleted account, can persist in a backup for up to twelve months. Backups exist only to recover the Service as a whole after a failure; we do not restore data for an individual account from them, so deleted data cannot be recovered by us or by you.
An invitation, with the invited email address, is kept until it is accepted, declined or revoked, and for no longer than 14 days, after which it is deleted within the hour. A session ends 7 days after it was last used, when you end it in Settings → Security, when you sign out, or when your password is changed or reset; its refresh tokens go with it, and expired sessions and their tokens are deleted within the hour. A password-reset link is valid for one hour and an email-confirmation link for 24 hours; each works once, its hash is deleted when it is used or replaced; an expired reset link is deleted within the hour, an expired confirmation link 30 days after it expired. The state of a sign-in through Google or Apple is kept for ten minutes at most. A linked Google or Apple identity is kept until you unlink it or delete your account. Statement files are discarded as soon as they are parsed; the record of an import (its file name, format and counts) is kept while any transaction from it exists, and an import none of whose transactions remain is deleted 180 days after it was made. A notification you have read is deleted 180 days after it was raised (a goal-reached notice stays with its goal). Server logs are rotated rather than retained indefinitely. Usage events (section 2) are kept for 180 days and then deleted; the time you last used the Service is kept while your account exists. Switching usage counting off deletes the events linked to your account and the time you last used the Service; deleting your account unlinks them from it, and they are deleted when their 180 days are up. Exchange-rate tables contain no personal data and are kept as reference data.
8. Security
We use TLS in transit, bcrypt to hash passwords, hashed storage and rotation of refresh tokens with reuse detection, one session per device that you can end at any time, single-use, short-lived password-reset and email-confirmation links stored only as hashes, sign-in through Google and Apple verified against the provider’s signed token (with state, nonce and, for Google, PKCE) and never redirected anywhere but the Service, rate limits on login, registration, sign-in through a provider, password resets and email confirmation, a content security policy in the browser, and per-ledger data isolation so that one account can only read the ledgers it is a member of.
No method of transmission or storage is completely secure, and the Service is operated by a single individual, and the daily backups described in section 7 may themselves fail or be incomplete. We do not guarantee the security, confidentiality, integrity or availability of your data, and, to the extent the law allows, we accept no liability for a breach, leak or unauthorized access whatever its cause. If we become aware of a breach that the law requires us to report, we will notify the competent authority and, where required, you.
9. Your rights
Subject to applicable law, you have the right to:
- Access the data we hold about you — most of it is visible in the Service itself.
- Rectification — correct your profile and records yourself in the Service.
- Erasure — delete your account from Settings → Privacy → Delete account. If you are the only owner of a shared ledger that has other members, make another member an owner or delete the ledger first.
- Portability / export — download it yourself: Settings → Privacy → Your data (the active ledger’s transactions as CSV, everything in your account as JSON); email us if you need another format.
- Restriction of, and objection to, processing based on our legitimate interests — for the usage data, switch it off yourself in Settings → Privacy → Usage statistics.
- Withdraw consent — turn off product-update emails in Settings → Privacy at any time.
- Lodge a complaint with the Personal Data Protection Service of Georgia or, if the GDPR applies to you, with your local supervisory authority.
We can act on a request only if it comes from the email address registered on the account, and we may ask you to confirm it from within the Service.
11. Emails
The Service sends six kinds of transactional email: a welcome email once, after registration, carrying the link that confirms your address unless the address is already confirmed — you registered through an invitation link sent to it, or Google or Apple vouched for it — in which case the email carries no link; an email-confirmation email, when you ask for a new link or change your address — to the new address; a password-reset email, only when someone asks for one for your address; an invitation email, when a member of a shared ledger invites your address and no account exists for it yet; a notice that your Pro plan ends in seven days and again the day before, while your account has Pro with an end date; and a security notice when a password is first set on an account that had none (one that signed in through Google or Apple), so that you learn of it if it was not you. It sends no other notifications and no product updates. Your product-updates preference is stored for the time such emails are introduced; they will be opt-in and you will be able to withdraw consent in Settings → Privacy. Emails about the Service itself — security notices and notices of material changes to these policies — would not be marketing and would be sent regardless of that preference.
12. Children
The Service is not intended for anyone under 18, and we do not knowingly collect data from anyone under that age. If you believe a minor has registered, contact us and we will delete the account.
13. Changes
The version and effective date of this policy are shown at the top of this page. If we make a material change, we will make reasonable efforts to notify you in the Service before it takes effect. When a change needs your agreement, the Service asks you to accept the new version the next time you use it; until you do, your data stays as it is, and you can still export it or delete your account.
14. Contact
Questions about this Privacy Policy, or a request concerning your data? Contact us at hello@tesorly.com.