Privacy Policy
Effective date: 24 October 2026
The short version
- You give us an email address, a password and a name of your choosing, which can be a nickname. That is all we ask for to open an account.
- Everything else in Valunto is what you type in yourself, or what you choose to import from a file of your own. Valunto never connects to a bank, a card, a broker or any other account of yours, and never asks for their credentials.
- We do not run analytics, advertising or tracking pixels. The only third-party code we embed is our error-reporting service's, and it only speaks when something breaks. We do not sell data, and we do not use your data to train anything.
- Your data lives on our own servers in Finland, in the European Union. Five companies help us run the service: our hosting provider, the network that carries and protects our traffic, our email provider, our error-reporting service and, only when a file you import needs AI to be read, the AI provider that reads it. Nobody else receives your data, except what a payment needs (next point), what the law forces us to give, or what you share with your own household.
- When you subscribe on the website, you pay Link, a Stripe company that sells Valunto plans as merchant of record. Link collects your card and billing details under its own privacy policy; we never see your card, and we send Link only your email address, your language and an identifier of your account. In the iPhone app you can subscribe through the App Store instead: Apple takes the payment under its own privacy policy, the app gives Apple only an identifier of your account, and Apple tells us the plan and its status.
- You can export or delete everything, at any time, from Settings. Deleting your account removes your data from our live systems immediately.
The rest of this page is the long version, written to be read.
1. Who we are
Valunto OÜAhtri tn 1215551 Tallinn, EstoniaEmail: contact@valunto.comValunto is provided by Valunto OÜ, a private limited company registered in the Estonian Commercial Register under registry code 17624319. We are the "controller" of your personal data under data protection law, including the EU General Data Protection Regulation (GDPR). This means we decide why and how the data described here is used, and we are responsible for it. For questions about this policy or your data, write to contact@valunto.com.
2. What data we hold, and where it comes from
2.1 What you give us
Your account. The name you chose, your email address and your password. The name is only how the people in your household see you: any name or nickname will do, and we never verify it. We store the password only as a one-way hash, which means we cannot read it and cannot recover it. We also record when your email address was verified and when your password was last changed, so the security page can show you facts rather than guesses. We also record when a confirmation email to your address could not be delivered.
Your financial records. Everything you enter to use Valunto: assets and debts, transactions and categories, budgets, goals, purchase lists, the currencies you track, and your preferences (language, primary currency, notification settings). This is financial information, and it is the reason the service exists. It is entered by you, by hand or from a file you choose to import, and only you and the household members you choose can see it. Any record you mark as private is seen by you alone, whatever your household members' roles. Valunto has no bank connections, so nothing arrives that you did not type or import.
Files you import. If you choose to import a file (a spreadsheet, an export from your bank or card, or a PDF statement), our server reads it to find your assets and debts, or your transactions. Whenever it can, Valunto reads the file on its own and nothing leaves Valunto: an OFX file, an export from a bank Valunto already knows, a table whose columns you confirm, or a file read by the saved layout of one you imported before. A PDF, or a spreadsheet that can only be read with AI, is read with AI at Anthropic, and the import page says so next to that file before anything is sent. For such a file we send its contents, together with the currencies you use and today's date, to Anthropic, whose model returns what it found for you to review. Nothing else goes with it: not your name, not your email address, not the file's name, not your household members. Anthropic does not train on the file and deletes it within 30 days. Valunto never stores the file; what was read from it is kept for one day so you can review it, and only the rows you confirm are added to your account. When you confirm a table's columns, or add what AI read from the spreadsheet where you track what you own and owe, we keep that file's layout so the same kind of file is read without AI next time: the names of its columns, what each one holds and how its dates and numbers are written, and, for that spreadsheet, which of its rows are which of your assets and debts. A layout is never a copy of the file, and it belongs to your household. When a file's row of column names is not one we know, we keep only a one-way hash of that row, which we cannot read, and how often we have seen it, so we learn which banks to support next; the hash identifies no person or household. You choose this for each file by uploading it; nothing is read without that.
Your household. If you invite someone to your household, we store the email address you enter and send them an invitation. Once they join, we store their role (owner, member or viewer) and share with them, according to that role, the records you have not marked as private. By inviting someone you confirm that you may share their email address with us.
Your plan. If you subscribe on the website, you pay at Link's checkout, which asks for your card and billing details; we never see them. We send Link your email address, your language and an identifier of your account, and Link tells us your plan, its billing period and currency, its status and renewal date, the identifiers of your customer and subscription at Stripe, and the invoice of your first payment. We keep these, with the date of your first payment and whether you used the money back, to know which plan covers your account. A plan given at no cost records why it was given. If no plan covers your account, we record when it was locked and when we emailed you about it.
A plan bought in the iPhone app. If you subscribe in the iPhone app, you pay Apple through the App Store, with the payment method of your Apple Account; we never see it. The app gives Apple an identifier of your account with the purchase, so the plan reaches the right account. Apple tells us the plan and its billing period, its status, whether it renews and when the period ends, the identifier Apple gives the subscription, and whether it was a test purchase. We keep these, as we keep a plan bought on the website, to know which plan covers your account.
Your messages. If you write to the people in your household in Messages, we store what you wrote, when, and which conversation it belongs to, and we email it to the other people in that conversation. You can edit or remove your own messages at any time; removing one deletes its words from our systems, though a copy may already be in the recipients' mailboxes. When you delete your account, your messages are deleted with it, and what the other people in those conversations wrote stays with them.
Support requests. If you contact support from inside the app, we store what you write, the category you choose, and the diagnostics you agree to send. Diagnostics may include: the page you were on, the size of your window, your browser or device model, your language and time zone, the app version, the last few pages you visited, the last few requests the app made to our server (with their identifiers, never their contents), and any error messages. You can also attach a screenshot. Every number on the page, money amounts and dates included, and the names of items you marked private are masked before capture; everything else appears as it did on your screen, including the names of shared goals, accounts and transactions, the names of your household members, and your email address if the page showed it. You see exactly what will be sent and can remove the screenshot before you send it. Each request also creates an email notification to us so that we notice it.
Contact form. If you write to us through the form on our contact page, we store your name, your email address, the language of the page, the topic you chose and what you write, so that we can answer you. The form does not confirm the address, so a message is not linked to any account. Each message also creates an email notification to us so that we notice it. Nothing is sent to the address you give until we reply.
Requesting access. If you ask for access to Valunto, we store your name, your email address, what you tell us brings you to Valunto, how you want to start (a 30-minute onboarding call or just a link) and, if you choose the call, the language you want it in. We also record the language of the page you used, whether you tried the demo first, and when you made the request, when we invited you or renewed your invitation, when you created your account, or when we declined the request. We use this to decide whom to invite and to get in touch with you: to confirm we received your request, to send your invitation, which is valid for 24 hours, and to arrange the call if you asked for one. Each request also creates an email notification to us so that we notice it.
2.2 What our systems record on their own
Access logs. Each request to our server writes one log line with the request time, the path requested, the response status, the duration, an anonymous request identifier, and the IP address it came from. We use this to keep the service running and to investigate abuse. Logs are kept for 30 days and then deleted.
Rate limiting. To slow down password guessing and other abuse, our server counts requests per IP address in memory. Nothing is written to disk and the count disappears within minutes.
Country of a request. Cloudflare, which carries the traffic between you and our servers, tells our server which country each request comes from, worked out from its IP address. We use it only to choose the currency a page shows prices in, and we do not store it.
Sessions. When you sign in, we store the browser or app identifier ("user agent") of that sign-in, so you can see and revoke your active sessions. Sessions expire after 7 days at the latest.
Error reports. When something fails on our server, a page crashes in your browser or the mobile app crashes on your phone, a report goes to our error-reporting service so we can fix it. A report says what failed and where in our code, with the request identifier, the method and path of the request, and the app version. Reports from the browser also include the browser and device type and the page address; reports from the mobile app include the phone's model, its operating system, language and time zone, its state at the time (memory, storage, battery, network, orientation), the screen you were on, and a random identifier the error-reporting service gives the app when it is installed, which is not linked to your account and changes if you reinstall the app. Email addresses and the codes in email links are removed before a report is sent, and IP addresses are not stored.
2.3 What we do not collect
No analytics, no advertising identifiers, no location beyond the country a request comes from (see 2.2), no contacts, no device fingerprinting, no third-party scripts beyond the error reporting described in 2.2, no session recording. We do not read your data to build a profile of you, and we make no automated decisions about you.
3. Why we use your data, and on what legal basis
| What we do | Data involved | Legal basis |
|---|---|---|
| Provide the service you signed up for: your account, your records, your household, exports | Account, financial records, household | Performance of a contract — GDPR art. 6(1)(b) |
| Know which plan covers your account and apply its rules: who it covers, the money back, the lock and the deletion | Your plan | Performance of a contract — GDPR art. 6(1)(b) |
| Read a file you choose to import, so you do not retype your assets and debts, or your transactions, and keep its layout so the same kind of file is read without AI next time | The file's contents, the currencies you use, the file's layout | Performance of a contract — GDPR art. 6(1)(b), at your request for each file |
| Send the emails the service needs: email verification, password reset, email change, household invitations, the notices about your account's confirmation status, the notices about a locked account (the day it is locked, 30 and 7 days before it is deleted, and once it has been), and the confirmation of a withdrawal | Email address, name | Performance of a contract — GDPR art. 6(1)(b) |
| Keep the service secure: access logs, rate limiting, session list, abuse investigation | IP address, user agent, timestamps | Our legitimate interest in running a secure service — GDPR art. 6(1)(f) |
| Show prices in the currency of the country you are in | The country a request comes from | Our legitimate interest in showing prices in the currency the purchase is charged in — GDPR art. 6(1)(f) |
| Find and fix errors | Error reports | Our legitimate interest in a service that works — GDPR art. 6(1)(f) |
| Answer your support requests | What you send us | Performance of a contract — GDPR art. 6(1)(b) |
| Answer messages sent through the contact form | What you send us | Our legitimate interest in answering the people who write to us — GDPR art. 6(1)(f) |
| Handle your request for access: decide whom to invite and get in touch with you | Your access request | Steps taken at your request before entering into a contract — GDPR art. 6(1)(b) |
| Comply with a legal order | Whatever the order names | Legal obligation — GDPR art. 6(1)(c) |
We do not send marketing emails. If that ever changes, we will ask for your consent first and you will be able to withdraw it at any time.
4. Cookies and device storage
Valunto uses only the cookies it needs to work. There is no cookie banner because there is nothing to choose: none of these cookies track you. All but the last are ours; the last is set by Cloudflare, and only when it asks your browser to pass a security check.
| Name | Purpose | Lifetime |
|---|---|---|
| fi_session | Keeps you signed in on the website | Until you sign out or the session expires (7 days at most) |
| fi_refresh | Renews your session without asking for your password again | Same as above |
| fi_user | Lets the website show your name and settings without a round trip to the server | Same as above |
| cf_clearance | Set by Cloudflare only after your browser passes a security check, so it is not asked again | 30 minutes |
The mobile app stores your session in the device's secure storage (the Keychain on iPhone) and your language and display preferences in the app's private storage. Nothing is stored anywhere else on your device. On Android the app excludes itself from the system's backups and device-to-device transfers, so nothing it stores is copied to Google's servers or to another phone. On iPhone the session is marked as belonging to that device only, so it is left out of backups and never moves to another phone; the app's private storage is included in your phone's encrypted iCloud or computer backup.
5. Who we share your data with
We share your data with nobody, except:
Your household. Members and viewers of your household see the records you share with it, according to their role; records you mark as private are never shared with them. You control who is in your household and what you share with it. What you write in Messages is read by the people in that conversation, in the app and by email.
Companies that work for us (processors). They act only on our instructions, under a contract that binds them to protect your data at least as this policy does, and only to provide the service:
| Provider | What they do | Where |
|---|---|---|
| Hetzner Online GmbH | Hosts our servers and database | Finland |
| Cloudflare, Inc. | Carries the traffic between you and our servers, protects it from attacks, and tells our server which country a request comes from | United States; each request is handled at the data centre nearest you |
| Resend, Inc. | Delivers the emails the service sends | United States |
| Functional Software, Inc. (Sentry) | Receives error reports | Germany |
| Anthropic, PBC | Reads the files you choose to import that need AI, such as PDFs, and returns what it found | United States |
The seller of your plan. If you subscribe on the website, Link (Sold through Link, LLC, a Stripe company) sells you the plan as merchant of record. Link collects and uses your payment details as a controller in its own right, under its own privacy policy (https://link.com/privacy), not on our instructions. We give it only what a purchase needs: your email address, your language and an identifier of your account.
The seller of a plan bought in the iPhone app. If you subscribe in the iPhone app, Apple sells you the plan through the App Store. Apple collects and uses your payment details as a controller in its own right, under its own privacy policy (https://www.apple.com/legal/privacy/), not on our instructions. We give it only an identifier of your account, which the app sends with the purchase.
Public data sources we call. Exchange rates come from Frankfurter (European Central Bank reference rates) and, for digital assets, CoinGecko. Our server fetches these rates on its own schedule; the requests carry nothing about you.
The stores that distribute the app. The Android app is distributed by Google Play, a Google service under Google's own privacy policy, and the iPhone app by the App Store, an Apple service under Apple's. Each store handles the download and updates and does not give us personal data about you: we see only aggregated statistics about installs and crashes, and the reviews you choose to post, under the name you post them with. Apple shares crash reports and usage statistics with us only from people who chose, in their iPhone's settings, to share them with developers.
When the law requires it. We will disclose data if a court or authority with jurisdiction over us orders it. We will tell you when we are allowed to.
We never sell personal data and never share it for advertising.
6. Where your data is stored and transfers outside the EU
Your data is stored on servers in Finland, in the European Union. Cloudflare, Resend, Sentry and Anthropic are United States companies; Cloudflare handles each request at its data centre nearest you, and Sentry keeps our error reports in its European Union region. Where a provider processes data outside the European Union, we rely on the safeguards the law provides: the EU–US Data Privacy Framework where the provider is certified, and otherwise the European Commission's standard contractual clauses (GDPR art. 46). Link and Apple, which sell you a plan, handle their own transfers under their privacy policies.
7. How long we keep your data
| Data | Kept for |
|---|---|
| Your account and everything in it | As long as your account exists |
| Your plan (plan, period, currency, status, renewal date, Stripe or App Store identifiers, first payment, money back used) | As long as your account exists. Link keeps its own records of your purchases as the seller, for as long as tax law requires it to; Apple does the same for a plan bought in the iPhone app |
| Accounts no plan covers | Locked when the plan ends (at the end of a cancelled period, 14 days after a renewal payment fails and is not fixed (16 for a plan bought in the iPhone app), or when the payment is refunded), deleted with their data 90 days after the lock |
| Messages you wrote to your household | Until you remove them or delete your account; the words of a removed message are deleted at once |
| Files you import | Never stored by us. What we read from a file is kept for one day so you can review it, then removed; Anthropic deletes a file read with AI within 30 days |
| Import records (file name, size, date and outcome) | 30 days |
| Saved file layouts (column names and what each column holds, never a copy of the file) | As long as your household exists; without a household, as long as your account exists |
| One-way hashes of rows of column names we did not know, with how often each was seen | No set period; they identify no person or household, so they are not deleted with your account |
| Accounts that never verified their email, have no active session and hold nothing you entered | Deleted automatically after 7 days |
| Accounts that never confirmed their email | Paused after 7 days, deleted 30 days after the pause unless the account is a member of a household with other members |
| Sign-in sessions | Deleted when you sign out, when you revoke them, or after 7 days |
| Verification, password-reset and invitation links | Until used or expired (a few days), then deleted |
| Access logs | 30 days |
| Error reports | Up to 90 days |
| Support requests | Until you delete your account |
| Support screenshots | 90 days after the request is closed, or until you delete your account, whichever comes first |
| Access requests that did not lead to an account | 12 months, then deleted |
| Access requests that led to an account | Deleted with the account |
| Messages sent through the contact form | 12 months, then deleted |
| Backups | Deleted data may survive in our backups for up to 8 days before those backups are rotated |
When you delete your account, everything you own is removed from our live systems immediately, including support screenshots. Data you shared with a household is reassigned or removed according to the household rules explained in the app at deletion time. Messages you wrote are deleted with your account; the other members' messages in the same conversations stay with them.
8. How we protect your data
- All traffic between you and Valunto is encrypted (TLS), from your device to Cloudflare and from Cloudflare to our servers.
- Passwords, session tokens and email links are stored only as one-way hashes.
- The database is not reachable from the internet, only from our application.
- Every number, money amounts included, and the names of private items are masked in support screenshots, and amounts are never included in diagnostics. Screenshots are deleted 90 days after a request is closed.
- Sessions expire, and you can see and revoke them from the security page.
No system is perfectly secure. If we ever learn of a breach that affects you, we will tell you and the relevant authority as the law requires.
9. Your rights
You have the right to access, correct, export, delete and object to the use of your data, and to ask us to restrict its use. Most of these you can do yourself, right now, from the app:
| Right | How |
|---|---|
| See the data we hold about you | Settings → Privacy & data, or ask us |
| Correct your name or email | Profile → edit; other data you edit directly |
| Export your data | Settings → Privacy & data → Export (CSV for transactions, JSON for everything) |
| Delete your account and all its data | Settings → Danger zone → Delete account. On the mobile app: Settings → Delete account |
| Object to processing based on our legitimate interests | Settings → Privacy & data, or ask us; we record the objection |
| Restrict processing, or anything else | Write to contact@valunto.com |
If you uninstalled the mobile app, you can still delete your account by signing in at https://valunto.com and using Settings → Danger zone, or by emailing contact@valunto.com from the address on the account. We answer within one month (GDPR art. 12(3)).
You also have the right to complain to the data protection authority of the country you live in, or to the authority responsible for us: the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, https://www.aki.ee). We would prefer you write to us first so we can fix the problem.
10. Children
Valunto is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has opened an account, write to contact@valunto.com and we will delete it.
11. Changes to this policy
When we change this policy we will update the date at the top. If a change affects how we use your data, we will tell you by email or inside the app before it takes effect. Past versions are available on request.