Privacy Policy

Cuanest is a personal and family budgeting app run by an individual developer in Indonesia. For anything about your data, write to hello@codebynizar.dev. This policy follows Indonesia's Personal Data Protection Law (UU No. 27 Tahun 2022).

• Your account: name, email address, and a hashed password. If you sign in with Google, we also get the name, email and photo on your Google account.
• What you enter: wallets and their balances, transactions, notes, merchants, pockets, goals, subscriptions, split bills and the workspaces you create or join.
• Receipt photos: only when a workspace owner turns on receipt scanning and you scan a receipt. The photo is sent to be read and is not stored by Cuanest.
• Push notifications: if you turn them on, the address your browser gives us for delivering them to that device.
• Feedback: what you write in Send feedback, with the app version, the page and workspace you sent it from, and your browser details, so a problem can be found and fixed.
• Security data: your IP address and browser details, used for sign-in sessions and to block repeated guessing of passwords.

• To run Cuanest: show your balances, split income, and keep shared workspaces in sync.
• To keep accounts safe: sessions, email verification, password resets and rate limits.
• To send you emails and notifications you can control: invitations, reminders before a subscription is due, and a recap when a budget period ends. You can turn reminders and recaps off in Notifications.

We process your data because you agree to it when you create an account, and because we need it to provide the service you asked for. You can withdraw that agreement by asking us to delete your account.

We use a few services to run Cuanest. Each only gets what it needs:

• Vercel hosts the app. Its servers for Cuanest run in Singapore.
• Neon stores the database, in Singapore.
• Resend delivers our emails.
• GitHub keeps encrypted nightly backups for 14 days.
• Google handles sign-in if you choose Continue with Google.
• Google Gemini reads receipt photos when receipt scanning is on. On its free tier Google may use those photos to improve its models, which is why an owner must agree before turning it on.
• Apple, Google and Mozilla deliver push notifications to your browser if you turn them on.

Some of these services are outside Indonesia. We do not sell or rent your data to anyone.

Everyone in a shared workspace can see its wallets, transactions, bills and history, and the name, email and avatar of the other members. No other member can see your Personal workspace.

The developer who runs Cuanest can reach the data on every account. We only look at yours to answer a request from you (a copy, a correction or deletion), to fix a problem you reported, or when the law requires it. Every copy we export and every account we delete through our admin tools is logged.

Cuanest only uses what it needs to work: a cookie that keeps you signed in, a cookie that remembers whether you hid your balances, and the browser's storage for pages saved for offline use and for whether you dismissed the install tip. There are no analytics, advertising or tracking cookies, so there is nothing to opt out of.

We keep your data while your account exists. Deleted transactions stay as voided records so balances and history add up. When you ask us to delete your account, we remove your data within 30 days, and it drops out of backups 14 days after that. Your Personal workspace and any workspace only you are in are deleted. In shared workspaces, the bills, comments and transactions you added stay so the others' balances still add up, but they show Deleted user instead of your name, and your email is removed.

• See and get a copy of your data. History can be exported as CSV at any time, and on request we send a file with your account, your Personal workspace, and what you added or are part of in shared workspaces.
• Correct anything that is wrong. Most of it you can edit in the app.
• Have your account and data deleted.
• Withdraw your consent, and complain to the data protection authority in Indonesia.

Write to hello@codebynizar.dev from the email on your account and we reply within 14 days.

Connections are encrypted, passwords are hashed, backups are encrypted, and every request is checked against the workspaces you belong to. No system is perfectly secure; if a breach affects your data, we tell you without undue delay.

Cuanest is for people aged 18 and over. Younger people may use it with a parent or guardian who agrees to this policy.

If this policy changes in a way that matters, we update the date at the top and email you before it takes effect.