Privacy Policy

1. DATA CONTROLLER

Deco is the data controller for personal data processed through the App. For privacy inquiries, contact us at:

Email: usedecoapp@outlook.com

2. WHAT DATA WE COLLECT

2.1 Account data

• •Email address (required for all accounts)
• •Name (if provided via OAuth provider)
• •Profile picture (if provided via OAuth provider)
• •Authentication tokens and session identifiers

2.2 Financial data

• •Bank account metadata (account names, institution names, currency)
• •Transaction history (merchant names, amounts, dates, categories)
• •Account balances and balance history
• •Investment holdings and portfolio data (if broker accounts are linked)

2.3 User-generated content

• •Goals and savings targets you create
• •Debt records you add
• •Budget preferences and spending categories
• •Notes and custom labels you apply to transactions

2.4 App preferences & settings

• •Theme, currency, lifestyle, and notification preferences
• •Onboarding responses
• •Feature toggles

2.5 Technical & usage data

• •Device type, operating system, and app version
• •App interactions and feature usage (anonymized)
• •Crash reports and error logs
• •IP address (collected by Supabase at authentication)

3. HOW WE USE YOUR DATA

We process your data for the following purposes and legal bases:

• •Providing the Service — We need your account and financial data to operate Deco. (Legal basis: contract performance)
• •Personalization — We use your preferences to customize the App. (Legal basis: contract performance)
• •Transaction categorization — We analyze transaction descriptions to assign spending categories. (Legal basis: contract performance)
• •Security & fraud prevention — We monitor for suspicious activity to protect your account. (Legal basis: legitimate interest)
• •Service improvement — We use anonymized, aggregated usage data to improve features. (Legal basis: legitimate interest)
• •Legal compliance — We may process data to comply with legal obligations. (Legal basis: legal obligation)

We do NOT use your data for advertising. We do NOT sell your data to any third party.

4. DATA STORAGE & RETENTION

4.1 Cloud storage. Your account data, financial data, and preferences are stored securely on Supabase-hosted infrastructure (PostgreSQL databases). Data is stored in the EU/EEA region by default.

4.2 Local storage. Deco caches data locally on your device using AsyncStorage to enable offline access and improve performance. This data mirrors what is stored in the cloud.

4.3 Retention. We retain your data for as long as your account is active. Upon account deletion, personal data is deleted from our systems immediately, except where retention is required by law.

4.4 Financial transaction data. Transaction data you upload or enter is stored only for the purpose of powering your dashboard and history views. We do not use this data beyond providing the Service to you.

5. THIRD-PARTY SERVICES

Deco integrates the following third-party services. Each has its own privacy policy.

• •Supabase — Authentication, database, and cloud storage (supabase.com/privacy)
• •Apple Sign In — Authentication only, on iOS; we receive email and name if you consent
• •Google Sign In — Authentication only; we receive email and name
• •Market data providers — Live and historical stock price lookups for the holdings you add manually
• •Expo / React Native — App framework
• •App Store / Google Play — Payment processing for subscriptions

We do not grant third parties access to your individual financial data. Data shared with the above services is limited to what is strictly necessary for each integration to function.

6. DATA SECURITY

We implement industry-standard security measures to protect your data, including:

• •TLS/HTTPS encryption for all data in transit
• •AES-256 encryption for data at rest (Supabase)
• •Row-level security policies to ensure users can only access their own data
• •Secure token-based authentication with short-lived sessions

Optional on-device encryption ("Maximum Privacy"). If you enable Maximum Privacy in the app, we generate an encryption key that is stored only on your device and never sent to us. With this mode on, your goals, debts, budget preferences, and manually-entered account and transaction details are encrypted before they leave your device, so we cannot read their contents. This does not apply retroactively to data already stored before you turn the setting on, and it does not apply to transactions imported from a bank statement file, which are categorized and stored as with Standard privacy.

No method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that affects your rights and freedoms, we will notify you as required by applicable law.

7. YOUR PRIVACY RIGHTS

Depending on where you live, you have rights over your personal data. We honor these requests regardless of your location.

7.1 U.S. residents (CCPA/CPRA and other state privacy laws)

If you are a resident of California or another U.S. state with a comprehensive privacy law, you have the right to:

• •Know / access — Request the categories and specific pieces of personal data we have collected about you
• •Delete — Request deletion of the personal data we hold about you
• •Correct — Request correction of inaccurate personal data
• •Data portability — Receive your data in a portable, machine-readable format
• •Opt out of sale or sharing — Deco does NOT sell or share your personal data, so there is nothing to opt out of
• •Non-discrimination — We will not discriminate against you for exercising any of these rights

You may also use an authorized agent to submit a request on your behalf.

7.2 EU/EEA & UK residents (GDPR / UK GDPR)

If you are located in the EU/EEA or the UK, you additionally have the right to:

• •Right of access — Request a copy of the personal data we hold about you
• •Right to rectification — Request correction of inaccurate data
• •Right to erasure — Request deletion of your data ("right to be forgotten")
• •Right to restriction — Request that we limit processing of your data
• •Right to data portability — Receive your data in a machine-readable format
• •Right to object — Object to processing based on legitimate interest
• •Right to withdraw consent — Where processing is based on consent, you may withdraw at any time

To exercise any of these rights, email us at usedecoapp@outlook.com. We will respond within the timeframe required by applicable law — generally within 45 days for U.S. state privacy requests and within 30 days for GDPR requests. If you are in the EU/EEA or UK, you have the right to lodge a complaint with your local data protection authority; California residents may contact the California Privacy Protection Agency or the California Attorney General.

8. ACCOUNT DELETION

To delete your account, email us at usedecoapp@outlook.com and we will process the deletion. Deletion is permanent and irreversible. Upon deletion:

• •Your profile and preferences are immediately removed
• •Financial data and transaction history are permanently deleted immediately
• •Data stored locally on your device is cleared

9. COOKIES & TRACKING

Deco is a native mobile application and does not use browser cookies. We use AsyncStorage (local device storage) to persist session data and preferences. We do not use cross-app tracking or advertising identifiers. We do not share device identifiers with advertising networks.

10. CHILDREN'S PRIVACY

Deco is not intended for users under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a minor, we will delete it promptly. If you believe a minor has created an account, please contact us at usedecoapp@outlook.com.

11. INTERNATIONAL DATA TRANSFERS

Deco serves a primarily U.S.-based audience, but our cloud infrastructure (Supabase) is hosted in the EU/EEA. This means that when you use Deco, your personal data is transferred to and stored on servers located in the EU/EEA. Where personal data is transferred internationally — including from the United States to the EU/EEA, or onward to any third-party service — we rely on appropriate safeguards, such as Standard Contractual Clauses, to protect it. By using Deco, you understand that your data will be processed in the EU/EEA as described in this policy.

12. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes through the App or by email at least 14 days before they take effect. The "Last updated" date at the top of this policy reflects the most recent revision. Continued use of the App after the effective date constitutes acceptance of the updated policy.

13. CONTACT & DATA PROTECTION INQUIRIES

For any questions, requests, or concerns about this Privacy Policy or how we handle your data:

Email: usedecoapp@outlook.com

We take all privacy inquiries seriously and aim to respond within 5 business days.