Skip to main content

Data privacy

GrapeVest is manual-first — we don't link banks and we don't scrape your accounts. You enter data deliberately, and you decide where it's stored.

End-to-end encryption (zero-knowledge)​

Your plan is encrypted on your device before it reaches the cloud. The key is derived from your password and is never sent to the server — the database holds only ciphertext. In practice this means the app's author and the database administrator cannot read your financial data: they see only an unreadable string of characters.

When you share the plan with a partner (Duo), the key is shared securely with the invited person only. To us and to third parties, the data stays encrypted.

Recovery code​

Since the key comes from your password, we don't hold it in any form and can't recover it for you. When you create your account we show a one-time recovery code — store it somewhere safe. It lets you regain access if you forget your password. If you lose both your password and the code (and, in a Duo plan, your partner also loses access), the data can't be decrypted. That's the honest price of real privacy: since nobody but you holds the key, nobody — including us — can open your data through a back door.

Where your data lives​

  • Local mode — data only in your browser (localStorage). Nothing leaves the device, no account.
  • Cloud mode — the household's data goes to the database in encrypted form. Only members with the key can read the content; the operator sees only ciphertext.

Plan change log​

Notifications about changes in a couple's plan (country, account types, the 50/50 split, plan name, people, a deleted category, the app view, a holding's monthly plan) need nothing new on the server. A short log (up to 20 entries: kind of change, who, when, the value — e.g. a country code, a category name, or a holding's name and its monthly-plan amount) is part of the plan: locally in localStorage, in the cloud inside the same E2E-encrypted blob as holdings and entries. The operator can't see it and sends no notifications — the other person's device reads the log itself after decrypting the plan. The "seen" marker stays on the device and isn't synced.

Data minimisation​

  • Your email is kept only in the authentication layer (Supabase Auth); the app's tables link everything by user id.
  • We don't collect data that isn't needed to run the plan.

Beta feedback and problem reports​

The Beta · Your feedback panel is a plain channel: what you type reaches us readable (it is not end-to-end encrypted) — the panel says so, so please don't enter amounts or sensitive data. The entry is linked to your account, so we can reply without asking for your email.

A problem report attaches only technical details by default: app version, screen (path), browser and OS, window size, theme, language, view mode, investing country, "cloud / local / demo", connection state, PWA mode, time and time zone, and up to 5 recent app errors. Numbers and email addresses in error messages are masked. No amounts, position names or any other plan data are attached. You see the full list before sending and can untick it.

Analytics and cookies​

  • Essential cookies (session, theme, your consent choice) are always active.
  • Analytics loads only after you consent in the cookie banner; without consent no tracking scripts are loaded.
  • By creating an account you accept the Terms of Service and the Privacy Policy — this is stated (with links to both documents) directly in the sign-up form. There are no separate checkboxes; creating the account is the deliberate action.
  • Accounts are for adults (18+) only — the requirement is written into the Terms of Service (§ 4).
  • At sign-up we store the accepted Terms version and the moment of acceptance in the account metadata — proof of consent, nothing more; no financial data is tied to it.
  • The Terms, Privacy Policy and Security page are available in Polish, English and German (following the app language) — the Polish version is legally binding.

Your rights (GDPR)​

  • Deleting your account removes any household where you're the only member — we don't leave orphaned financial data behind.
  • Leaving a shared plan revokes your access to it.

Privacy contact​

contact@grapevest.pl