Privacy at PayRoutine

PayRoutine runs entirely in your browser. Your expenses, cards, subscriptions, goals, notes, and every other record you create are stored in your browser's IndexedDB — a database that lives only on the device you're using. If you never create an account, none of that data is ever transmitted to us or to anyone else. You can use the entire app offline, uninstall it, or clear your browser storage to wipe everything locally.

If you want the same data on your phone and laptop, you can sign in from Settings → Cloud sync. Signing in does two things:

• Supabase Auth stores your email address and a hashed password so we can identify your account.
• Your records — expenses, incomes, cards, subscriptions, installments, bills, goals, debts, holdings, notes, todos, habits, and every other tracked item — are copied to a single Supabase table (entities) as JSON, tied to your account with row-level security so only you can read or write them.

Sync is entirely optional. You can use PayRoutine forever without signing in. Signing out at any time stops sync; deleting your account (see §5) removes the cloud copy entirely.

PayRoutine never asks for and never stores real payment credentials. There is no card-number field, no CVV, no IBAN, no bank login. When you add a “card,” you're only saving:

• A nickname you choose (e.g., “Everyday debit”)
• Bank name (optional, free text)
• Type (credit / debit)
• Credit limit, statement day, due day
• A running balance you type in yourself

We're not integrated with any bank or open-banking API. Balances and expenses reflect only what you type. Even if the cloud database were breached, no attacker would find usable financial credentials there.

PayRoutine doesn't show ads or third-party ad content inside the app, and we don't run Meta Pixel, Mixpanel, Amplitude, Segment, PostHog, Sentry, or comparable SDKs.

We use Firebase Analytics and Apple's Search Ads Attribution (AdServices) solely to measure how many people who install PayRoutine from our own ad campaigns go on to try or purchase Premium. This is aggregate campaign performance data — it does not use your advertising identifier (IDFA), does not follow you across other apps or websites, and is never sold, rented, or shared with anyone outside of Google/Apple's own campaign-reporting dashboards.

The only other third-party service involved is Supabase, and only if you opted into cloud sync — Supabase acts as our storage provider under a data-processing agreement.

You can wipe everything at any time. Inside the app, Settings → Cloud sync → Sign out stops future sync. To permanently delete the cloud copy and your Supabase Auth account, email us (see contact below) from the address you used to sign in — we'll delete every row tied to your user_id within 30 days and confirm by return email. Local device data can be cleared at any time via your browser's site-data settings.