Privacy Policy

1. Who is responsible

The controller of your personal data (володілець персональних даних under Ukrainian law) is Private Entrepreneur Koval Oleksii Andriiovych (ФОП Коваль Олексій Андрійович; "PE Koval", "we"), Ukraine, RNOKPP 3651501498, entered in the Unified State Register of Legal Entities, Individual Entrepreneurs and Public Organisations of Ukraine on 8 December 2021, record No. 2010350000000093426. Place of registration: Chervone, Mykolaiv Oblast, Ukraine; phone +380 68 698 94 32. Contact for privacy requests: support@degroshi.com.

We have not appointed a data protection officer or a representative in the EU.

This policy applies to the Degroshi web app (degroshi.com), the Degroshi apps for iPhone and Mac, the API (api.degroshi.com) and to visitors of our website.

2. What data we process

To create an account you must give us an email address and a password, or sign in with Google or Apple. Everything else is optional, but a feature cannot work without the data it works on (for example, a bank connection needs the bank's data).

2.1 Account and profile

• Email address, first and last name, password (stored as a hash by our authentication system), whether the email address is verified.
• When you sign in with Google or Apple: the identifier, name and email address those providers share with us, and the tokens needed to keep the sign-in working.
• Profile picture, if you upload one.
• Preferences: language, base currency, favourite currencies, time zone, display settings and onboarding progress.
• Sessions: a session token, when it was created and expires, the IP address and browser or device ("user agent") that created it. API keys you create (stored as a hash) and the external tools you authorise to access your data (which tool, the access you approved and when).
• If you add your own AI provider key or account in the settings: the key (encrypted) and the details of that connection.
• Security: short-lived one-time codes for email verification and password reset (stored as hashes), the time of your last sign-in, and the devices you have signed in from: a hash of a random key that tells your browser or app installation apart, a label such as "Chrome on macOS", and when the device was first and last used. When someone signs in to your account from a device it has not used before, we email you the device, time, IP address and, where known, country of that sign-in, so you can act if it was not you.
• Notifications: your notification settings (channels, types, quiet hours, whether push texts may show amounts), the notifications in your in-app inbox, and, if you allow push notifications on a device, that device's push token, platform, app version and language.

2.2 Financial records (your content)

• Spaces, accounts (name, type, currency, balance, institution), transactions (date, amount, currency, description, merchant, category, notes, tags, transfer and split details), receipt line items, budgets, recurring rules, categories.
• Receipt images and other attachments you upload, stored in a private bucket.
• Space membership: who is in a space, their role, which accounts they may see, invitations you send (the invitee's email address).

2.3 Data from connected services

Only what the connection needs, read-only, and only when you set the connection up (details in the Connected Services Notice):

• Monobank: the identifier of the access request you confirmed in the Monobank app (Degroshi is a registered Monobank provider; nobody pastes a token; the identifier is our access credential and is encrypted at rest), your Monobank client name and the permissions you granted, the cards, jars and private-entrepreneur (ФОП) accounts you choose to link, their balances and credit limits, and statement transactions with their bank details (merchant description and category code, original amount and currency, commission, cashback, the counterparty's name, IBAN and tax code where Monobank provides them, the payment comment and receipt number), plus notifications of new transactions that Monobank sends to our API.
• Crypto wallets (Zerion): the wallet address, an ENS name if you used one, holdings and valuations, on-chain transactions, and, if you verified the wallet, the signed message and signature as proof of ownership.
• Crypto exchanges (CCXT): the read-only API key and secret (encrypted at rest), what permissions the exchange reports for the key, balances, holdings and account activity (trades, conversions, deposits, withdrawals and fees).

2.4 Subscriptions and payments

If you buy a paid plan:

• On the web (monobank acquiring, buyers who live in Ukraine): your plan, price, currency and billing period; the status, dates and amounts of each payment (including the amount actually charged in UAH, refunds and the reason a payment failed); the masked card number and card network, and the card's issuing bank and country as monobank reports them; a token for your saved card, which monobank issues for renewals and we store encrypted; when you consented to recurring charges and which version of the Terms you accepted. Your email address is sent to monobank so that it can email you the payment's receipt. We never receive or store your full card number or security code; you enter them on monobank's page.
• On the web (Paddle, buyers outside Ukraine): Paddle is the Merchant of Record and an independent controller of the payment data you give it (name, address, payment details, tax details). To start your checkout we send Paddle your email address and our identifiers of your account, the checkout and the price; Paddle sends us back the status, dates, amounts, currency and tax of each transaction, the country of the billing address, the card network and last four digits, refunds and chargebacks, and the subscription's state. We also record when you consented to recurring charges and which version of the Terms you accepted.
• Where you live: when you pay through monobank you confirm that you live in Ukraine. We record the country you confirmed, as evidence for tax purposes together with the card's country. To suggest where you pay, the Plan & billing page uses data we already hold (your language and time zone settings, whether you connected Monobank, whether an earlier monobank payment was made with a card issued in Ukraine, and which provider billed your earlier web subscriptions); it only preselects an option, and you choose.
• In the App Store (through RevenueCat): the store, product, plan, period, price and currency, the purchase status and dates, the country of the store account, whether it was a test purchase or came through family sharing, and the store's link to manage the subscription. RevenueCat knows you only by your Degroshi account identifier (a random id), which also goes to Apple with the purchase; we do not send it your name or email.
• Plans given to you without payment (for example as a beta tester), and the record that Suricate thanked you for subscribing.

2.5 AI features

• Your messages to the assistant and its answers, the facts you ask it to remember, a rolling summary of older conversation, the tools it called and their results.
• Text and voice clips you turn into drafts; the transcript of a voice clip.
• Receipt images you ask the app to read, and the extracted draft.
• Category corrections you make (used to learn your own categorisation), and usage counters for the fair-use limits.

2.6 Technical data and product events

• Server logs: request path, status, timing, a correlation id, the IP address and user agent, the acting user id. Error reports (Sentry, EU data region) with the request context; credential headers and cookies are stripped before sending.
• Monitoring data (Grafana Labs): metrics, logs and traces of the Service that carry only random identifiers (such as request, trace and user ids) and no financial data.
• Error reports from the web app (Sentry, EU data region): the error and the steps before it (pages opened and requests made, their addresses cut before any query string), timings and your browser's user agent. Your browser sends them to our own server, which passes on only the report, so Sentry receives neither your IP address nor cookies, and no account identifier is attached.
• Crash reports from the iPhone and Mac apps (Sentry, EU data region): the crash or error and the steps before it (screens opened and requests made, without their content), the timings of the app's requests to our API, the device model, its language and time zone, the system and app versions and a random installation identifier created only for this (not your account identifier). They never contain amounts, names or notes. Crash reports are on by default; you can turn them off at any time in Settings → Privacy & security → Send crash reports, and the app then sends none.
• If you subscribe to updates on our status page (status.degroshi.com): your email address and the updates you chose, to email you about incidents and planned maintenance. Every such email has an unsubscribe link.
• If you only visit our website, without an account: the technical data your browser sends with each request (IP address, user agent, the page requested), in our hosting logs.
• AI observability (Langfuse), when enabled: timing, model, token counts and cost per AI call. By default the content of prompts and answers is not sent; it is replaced by a hash and a length.
• Product events: a small set of named events about how you use the app (for example that you opened it, created an entry, or opened a weekly summary), with the time, platform and space, and, if we ask you a short optional question in the app, your answer. They never contain amounts, they are stored only in our own database, and no third-party analytics service receives them.
• Metrics about the Service as a whole (request counts, latencies), not about individual people.
• Domain events and a change feed used for realtime updates and offline sync between your devices.

2.7 Data stored on your device

• Web: cookies and browser storage described in the Cookie Policy.
• Apps: your session token and a random device key (which tells this installation apart when you sign in, section 2.1) in the Keychain, a local copy of your spaces' data for offline use, and local payment reminders you schedule (generated on the device). Where push notifications are available and you allow them, the app registers a push token with Apple and sends it to us. While crash reports are on, the random installation identifier they carry is kept in the Keychain; Settings shows it so you can give it to support. If you turn on the app lock, Face ID or Touch ID is handled by the device; we never receive biometric data.
• Apple Pay capture (iPhone): if you set up the payment automation in the Shortcuts app, iOS passes the details of each Apple Pay payment (merchant, amount and card name) to the app on your device, which proposes a transaction for you to confirm; like any other entry, it may be sent to our AI features for a category suggestion.
• Merchant logos and suggestions: the merchant field's autocomplete and merchant logos are loaded from Brandfetch directly by your browser or app. Brandfetch receives the name you type or a merchant's domain, together with your IP address and browser or device details, but no account identifier, amounts or other records.

We do not collect precise location, contacts, health data or advertising identifiers.

2.8 Business spaces (upcoming)

Business spaces for private entrepreneurs and companies are not available yet. When they launch they will process additional data, such as your tax regime and registration details, counterparties, documents, and, for employers, employees' details. For data about other people that you enter in a business space you will act as the controller and we as your processor; we will publish a business addendum to this policy and offer a data processing agreement before launch.

2.9 Data we receive about you from other people

• Invitations. If someone invites you to a space, we receive your email address from them and use it only to send you the invitation and to let you accept it. The invitation link works for 14 days; the invitation stays in the space's list until it is accepted or withdrawn, or the space is deleted.
• Other people's records. A user's records may mention you, for example your name, IBAN or tax code as the counterparty of a bank transfer that their bank shares with us, or your name in a note. We process such data only as part of that user's records, to provide the Service to them, and never for any other purpose. Informing each person mentioned in this way individually would be impossible or would take a disproportionate effort (GDPR Art. 14(5)(b)); this policy is how we inform them.

3. Why we process it and on what legal basis

Where we rely on legitimate interests, we have checked that they are not overridden by your interests. You can object at any time to processing based on legitimate interests, including product events (section 8).

We do not use your data for advertising, we do not sell it, and we do not use it to train AI models (see section 4).

4. AI processing and profiling

The AI features are described in the AI Terms and Disclosure. For privacy, the key points are:

• What is sent. Only the data a feature needs: your message and the context it refers to (relevant accounts, transactions, categories, budgets), a voice clip, a receipt image, or the text of a transaction to categorise. Access tokens, API keys and passwords are never sent to AI providers.
• Providers. Anthropic (Claude models) for the assistant, drafts, receipts and categorisation; Voyage AI for text embeddings used to match merchants and categories; AssemblyAI for speech-to-text; TypeSafe (the "Jev" model) only if we switch it on as an alternative categoriser (it is off by default). All are in the United States (section 6).
• No training. We do not train models on your data, and our providers are contractually bound not to train on it: Anthropic's commercial terms prohibit training on customer content; TypeSafe's policy states it does not train on inputs; Voyage AI and AssemblyAI offer an account-level opt-out from training, which we use.
• Profiling. Category suggestions and the assistant learn from your own past records (for example that "Silpo" is groceries for you). This is profiling in the GDPR sense, but it only affects suggestions in the app. We make no decisions with legal or similarly significant effects about you by automated means (GDPR Art. 22). Every AI proposal must be confirmed by you before it is saved.
• Opting out. You can simply not use the AI features; a space owner can switch them off for a space.

5. Who receives your data

We share personal data only with service providers that process it for us under contract, listed with their purpose and location in the Sub-processors list. In short:

• Hosting and storage (EU): Railway (Amsterdam region) for the API, web app, database and cache; Cloudflare for DNS, the private file bucket (R2) and passing our monitoring alerts on to us. Our status page and its subscriptions are hosted separately by Railway in the US (Virginia), so that it stays up when the Service does not.
• AI providers (US): Anthropic, Voyage AI, AssemblyAI; TypeSafe if enabled.
• Email: Resend, for service emails and the status page updates you subscribe to.
• Sign-in: Google and Apple, when you choose to sign in with them.
• Push notifications: Apple Push Notification service, when you allow push notifications on your iPhone.
• Payments: monobank (JSC "Universal Bank", Ukraine) for web card payments of Ukrainian residents; Paddle (Paddle.com Market Limited, UK, and its affiliates), our reseller and Merchant of Record for web purchases outside Ukraine; Apple for App Store purchases; RevenueCat (US) to record App Store purchases against your account.
• Connected services: Monobank, Zerion, an Ethereum RPC provider (Alchemy, for ENS and smart-contract wallet checks), WalletConnect/Reown (in your browser or app, when you verify a wallet), and the exchanges you connect; each receives only what its API requires.
• Reference data and content delivery: Open Exchange Rates and Massive (Polygon.io) for exchange rates (no personal data); Brandfetch for merchant logos and suggestions (section 2.7); Cloudflare's cdnjs for the web app's icon font, which, like any website, sees your IP address and browser details.
• Monitoring: Sentry (error reports from the API and the web app, crash reports from the apps; EU region in Frankfurt); Grafana Labs (metrics, logs and traces, uptime checks; US); Langfuse (AI observability, when enabled).

Recipients you choose. When you authorise an external AI client (for example ChatGPT through our connector) or add your own AI provider key, the data that tool reads, or that we send with your key, goes to that tool's provider under your own agreement with it. These providers are not our sub-processors.

Other members of your spaces see the data you share with them.

Authorities. We disclose data when the law requires it, for example on a lawful request from a Ukrainian authority, or to establish or defend legal claims.

Business transfer. If the Service is transferred to a successor, your data may be transferred with it; we will notify you.

6. International transfers

Your data is stored in the European Union (Railway, Amsterdam). Ukraine is where we are established.

United States. The AI providers (Anthropic, Voyage AI, AssemblyAI and, if enabled, TypeSafe), Resend, Grafana Labs, RevenueCat, Railway (for the status page only) and, when enabled, Langfuse process data in the United States. For people in the EU/EEA these are transfers outside the EEA. They are protected by:

• the providers' data processing agreements that include the EU Standard Contractual Clauses (GDPR Art. 46(2)(c)): Anthropic, Voyage AI, AssemblyAI, Resend, Railway, Cloudflare, Alchemy, Reown and RevenueCat;
• where the provider is certified, the EU-US Data Privacy Framework (GDPR Art. 45): AssemblyAI, Resend, Grafana Labs and Cloudflare.

TypeSafe is switched off; it will receive no personal data of people in the EU/EEA unless such safeguards are in place. You can ask us for a copy of these safeguards at support@degroshi.com. When you sign up, we tell you that the AI features process data in the United States.

Ukraine. Web card payments of Ukrainian residents are processed by monobank (JSC "Universal Bank") in Ukraine, where we are established.

United Kingdom. For web purchases outside Ukraine we send Paddle (Paddle.com Market Limited, UK) the data described in section 2.4; Paddle processes the purchase as an independent controller, together with its affiliates where they take part. The European Commission recognises the United Kingdom as providing adequate protection (GDPR Art. 45).

Ukrainian law. Transfers to the EEA and to the other states that Ukrainian law treats as providing adequate protection (the United Kingdom among them) are permitted under Art. 29 of Law 2297-VI. Transfers to the United States rely on Art. 29(3) of that law: they are needed to perform our contract with you (point 2), and we provide the contractual guarantees described above (point 5).

7. How long we keep data

8. Your rights

Under Ukrainian law (Art. 8 of Law 2297-VI) and, if you are in the EU/EEA, under the GDPR, you have the right to:

• Access your data and get a copy, and know where it comes from, where it is kept, why we process it and to whom it goes.
• Correct inaccurate data: you can edit your profile and records in the app.
• Delete your data: delete individual records in the app, or your whole account in the settings (web and apps). Section 9 explains what happens.
• Restrict processing, or object to processing based on legitimate interests.
• Portability of the data you gave us, in a machine-readable format.
• Withdraw consent where processing is based on consent, without affecting what happened before.
• Not be subject to solely automated decisions with legal or similarly significant effects (we make none), and know how any automated processing works.
• Complain to a supervisory authority (section 12) and seek protection in court.

There is no self-service export yet. To get a copy of your data, email support@degroshi.com from the address on your account: we send the copy to that address by email, in a machine-readable format. For any other right that is not available in the app, write to the same address. We answer without undue delay and within one month (30 calendar days), free of charge. We may ask you to confirm your identity.

9. Deleting your account

You can delete your account in the settings on the web or in the apps. For safety, you must have signed in recently (within 15 minutes) and type your email address to confirm.

What happens, in one transaction:

• Your user record, sessions, the devices you have signed in from, Google/Apple links, API keys, external tool authorisations, your own AI provider keys, assistant conversations and memories, favourite currencies, space and household memberships, bank, wallet and exchange connections (with their credentials), personal categories, notifications, notification settings, push tokens and product events are deleted.
• A web subscription is cancelled: there are no further charges; a monobank subscription's saved card is released for deletion (section 7), and a Paddle subscription is cancelled at Paddle so that it does not renew. Subscription and payment records stay as accounting records, no longer linked to you, for the period in section 7. We ask RevenueCat to delete its record of your App Store purchases. An App Store subscription is not cancelled by deleting your account: cancel it in your Apple account settings, otherwise Apple keeps charging.
• Your uploaded files (avatar, space icons, attachments) are queued and removed from the storage bucket by a background sweeper.
• Spaces you own are handed to the senior remaining admin, otherwise the senior member. If nobody else can take over (nobody else, or only viewers), the space and all its data are deleted.
• Shared spaces you do not own keep the records you created there (accounts and categories are reassigned to the space owner), so other members do not lose shared data.
• Your personal activity events are deleted; events in spaces that remain lose the link to you.
• Deletion markers (record ids only) stay in the sync feed for up to 180 days so your other devices can clean up. Copies in database backups expire with the backups (section 7).

10. Security

We protect your data with technical and organisational measures described in the Security overview: TLS for all traffic, encryption of connected-service credentials and saved-card tokens at rest (AES-256-GCM), hashed passwords, API keys and one-time codes, a private file bucket with access checks, Postgres row-level security for shared spaces, rate limits, and scrubbing of credentials from error reports. No system is perfectly secure; keep your password safe and tell us about any suspected breach at security@degroshi.com.

If a breach is likely to put your rights at risk, we will notify you and the competent authority as the law requires.

11. Children

The Service is not directed at children under 16. We do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

12. Supervisory authorities

• Ukraine: the Ukrainian Parliament Commissioner for Human Rights (Уповноважений Верховної Ради України з прав людини), 21/8 Instytutska St., Kyiv 01008, ombudsman.gov.ua.
• EU/EEA: the data protection authority of the country where you live or work. A list is published by the European Data Protection Board at edpb.europa.eu.

We would appreciate the chance to resolve any concern first: support@degroshi.com.

13. Cookies and local storage

See the Cookie Policy. Our cookies and browser storage sign you in, recognise a browser you have signed in from before and remember your settings; the only other item is a session-only marker that stops one visit from being counted twice in our own product statistics. There are no advertising or analytics cookies. When you pay through Paddle, Paddle's checkout opens over our page under Paddle's own cookie and privacy notices.

14. Changes to this policy

We may update this policy as the Service changes. We announce changes in the app or by email; they take effect 3 days after the notice. Before we use your data for a new purpose, we tell you and, where the law requires it, ask for your consent. The version and date at the top show the current text. This policy is published in Ukrainian and English; if the two differ, the Ukrainian text prevails.

15. Contact

PE Koval Oleksii Andriiovych, support@degroshi.com.

All documents