Privacy Policy

Jeison Córdoba, as an individual based in Spain, processes the data you enter in Remesia. Contact: jscordoba.9018@gmail.com.

• Account data: name, email address and, if you sign up with an email and password, the password (never stored in plain text — Better Auth handles it as a hash). If you log in with Google, we receive your name and email from Google.
• Financial data you enter: income, expenses, loans, budgets, categories, the household you belong to and who else is in it, amounts and currencies, and the exchange rates you set or that the app looks up for your foreign currency.
• Payment data: if you subscribe to the paid plan, you enter it directly with Paddle (see section 5); Remesia never sees your card. Paddle only tells us what is needed to activate your plan: customer and subscription identifiers, the chosen plan, its status and its dates.
• Minimal technical data: error logs (Sentry) configured without associated personal data, and what is strictly necessary to keep you logged in (session cookies).
• Anonymous usage statistics: which pages are visited, which website people arrive from, the language and the type of device, with no cookies and nothing that identifies you (never amounts, names or emails). If your browser sends “Do Not Track” or you turn it off in Settings → Your data, nothing is sent.

• Providing the service: showing your totals, calculating budgets and splitting your household’s expenses.
• Verifying your email and managing access to your account (logging in, resetting your password).
• Sending you operational emails: household invitations, due-date reminders, email confirmation, password reset.
• Managing your paid plan: activating, renewing or cancelling it.
• Security: preventing unauthorised access and abuse of the service.
• Understand which parts of Remesia are used and which aren’t, to improve it (anonymous statistics).

Your data is not used for advertising or sold to third parties.

Processing is based on the performance of the contract you accept when using Remesia (the Terms of Service), on your consent when you choose to log in with Google, and on the legitimate interest in keeping the service secure and running (error logging).

Anonymous usage statistics are based on the legitimate interest of improving the service: they use no cookies, don’t identify you and you can turn them off at any time.

The following providers process data on the controller’s behalf, only as needed to run Remesia:

• Google — if you choose to log in with Google.
• Neon (database, in Frankfurt, Germany) and Vercel (hosting: the app’s server runs in Frankfurt and pages are served from its global network).
• Resend — sending the operational emails mentioned above (United States).
• Sentry — technical error logging, configured not to collect personally identifiable information.
• Umami (Umami Software) — anonymous usage statistics, with no cookies; it doesn’t store your IP address.

Payments for the paid plan are handled by Paddle.com Market Limited (United Kingdom), our reseller and Merchant of Record. Paddle processes your payment and billing data as an independent controller, under its own privacy policy.

When a provider processes data outside the European Economic Area, it does so under the safeguards provided by the GDPR for international transfers (standard contractual clauses or equivalent mechanisms offered by each provider).

Your data is kept while your account is active. If you delete your account (or an administrator deletes it), your data and the household data linked to it are permanently erased, except for anything that must be kept by law.

You can exercise your rights of access, rectification, erasure, portability, objection and restriction of processing by writing to jscordoba.9018@gmail.com. You can also delete much of your data directly in the app, or ask for your whole account to be deleted. If you believe your rights have not been respected, you can complain to the Spanish Data Protection Agency (AEPD).

Passwords are stored as hashes (never in plain text), connections use HTTPS, and access to the production database is separate from the development environment. Even so, no system is one hundred per cent invulnerable.

Remesia is not intended for children under 16. If you are under that age, you need your legal guardian’s consent to use it.

Remesia uses a technical session cookie (needed to keep you logged in), another one that remembers the language you chose, and some local browser storage for the app’s own preferences (for example, remembering your last login method). No advertising or third-party analytics cookies are used.

If this policy changes in a significant way, you will be notified within the application or by email before the change takes effect.