Favuto1. Scope and responsible operator
This policy describes the Favuto app and this website. Favuto includes personal finance, planning, journal, AI and messaging features. The data involved depends on the features you use. This draft is based on app version 0.21.35 and AI-server version 0.3.3.
2. Data on your device
The app can store financial accounts, balances, transactions, currencies, budgets, debts, goals, recurring-payment records and receipt information. Other app areas can store journal entries, moods, tasks, habits, calendar entries, profile details and private files. Android storage uses an encrypted vault backed by Android Keystore. Exported files and copies you share need separate protection; not every export is encrypted.
3. Accounts and messaging
The AI pilot uses an invitation or device-linking code and session tokens. The separate Matrix messaging service uses its own account credentials, profile and message data; its server receives connection metadata, including IP addresses. Logging out only ends access. No Google Sign-In implementation was found in the inspected app or AI backend. Google authentication used by the server for Firebase is not a user sign-in method.
4. AI, voice, files and receipts
When you use online AI, Favuto sends your message and relevant enabled context to OpenAI. Context can include permitted conversation history, saved memory, profile information and enabled app sources such as finance, journal, moods, tasks, habits and calendar. After accepting the connection agreement, memory, permitted sources and check-ins can start enabled; review these settings in the app. Voice is processed for transcription, and transcripts are stored by the service. Receipt recognition sends the complete selected image for processing; check the image for unrelated personal information before uploading. Files and images can also be processed as chat attachments.
5. Optional financial synchronization
If you enable financial synchronization, Favuto uploads supported financial records to its server and shares them with linked devices. This can include accounts, transactions, budgets, debts, goals, plans, notes, preferences and recognized receipt data. Original local receipt files are excluded. The server retains up to ten financial revisions. Pausing synchronization does not delete copies already stored. Server payload encryption is not end-to-end encryption.
6. Services and network requests
OpenAI processes online AI input, voice and receipts. Optional Android notifications use Google Firebase Cloud Messaging; the notification payload uses technical routing identifiers rather than conversation text or financial amounts. Reference-price features can contact Coinbase, the Currency API via jsDelivr or Cloudflare Pages, Kraken, Bitfinex, Bitstamp and Gemini. These public-price requests do not attach financial records in the inspected code, but providers receive network metadata. Messaging uses a Matrix server and the Matrix Rust SDK. Bundled Google ML Kit text recognition is used for seed scanning, not as evidence that receipt recognition happens locally.
7. Storage and retention
Sensitive AI-server payloads are encrypted at rest, while some identifiers, timestamps, status and usage metadata remain readable by the server. This is not end-to-end encryption. Dedicated receipt-extraction results become eligible for clearing after 24 hours, with checks on requests and an hourly cleanup; request metadata can remain. Information copied into conversations or financial records has a separate lifecycle. Transcripts, conversations, memory and sync records do not have a complete general deletion schedule established by this audit. OpenAI response requests use store:false; that setting alone does not establish zero provider retention.
8. Analytics, diagnostics and payments
The inspected source does not include a dedicated advertising, product analytics or payment SDK. Firebase analytics collection is disabled in the Android manifest, and the Matrix SDK is configured without Sentry. The AI server does keep operational token counts, request duration, timestamps and quota information. SDK behavior, infrastructure access logs and production monitoring still require review. Recurring subscriptions in the finance area are personal tracking records, not paid Favuto plans.
9. This website and support
This website uses locally hosted fonts and images and does not add advertising trackers, analytics scripts or a contact-form backend. Language versions have separate URLs. Hosting providers may process technical access data. Email links open your email application; nothing is submitted until you send the message. Support emails and their contents are handled by the configured email services and the support operator. Do not send passwords, recovery phrases or session tokens.
10. Your choices and deletion
You can review AI source permissions, turn off optional features and use the app’s available controls for individual conversations and memory. Those actions do not automatically delete the entire account, old conversations, server copies or backups. Use the account and data deletion page to contact support for a broader request. Your available legal rights and the verification process depend on the operator and applicable law and must be completed below.
11. Changes and contact
The update date appears at the top of this policy. Contact support with questions about data handling or to request a correction. Material changes to processing should be reflected here and in the app’s disclosures before the changed processing begins.
TODO before public launch: Responsible operator’s legal name.
TODO before public launch: Operator contact address.
TODO before public launch: Production hosting, regions, email providers and infrastructure logs.
TODO before public launch: Processor terms, provider retention, transfers and safeguards.
TODO before public launch: Retention periods for chats, transcripts, memory, metadata, support mail and backups.
TODO before public launch: Verified response and completion timeframe for deletion.
TODO before public launch: Actual deletion process and data removed across AI, Matrix, sync, devices and processors.
TODO before public launch: Any retained data, exact reason and retention period.
TODO before public launch: Applicable legal bases, privacy rights and request process.
TODO before public launch: Minimum age and treatment of children’s data.
TODO before public launch: Production SDK data declarations, including Firebase and ML Kit.