This English translation is provided for convenience. Only the German version is legally binding.
Privacy policy
1. Controller
Christoph Kainzner
Lerchenfelderstraße 128/4/42
1080 Vienna
Austria
Email: christoph@kainzner.net
2. Principles
Moneytracker uses no tracking or analytics tools, no advertising, no cookies, and does not load any content from third parties (e.g. fonts or scripts). Your data is not sold or passed on to third parties.
3. What data we process
- User account: email address, password (stored only as a cryptographic hash), time of registration, time of consent to this policy, trial and subscription period, language and currency setting.
- Your financial data: accounts, transactions (amount, date, payee, note), categories, budgets, savings targets and monthly notes that you enter or import yourself.
- Optional details for transactions: time and location (GPS coordinates). The location is only stored if you explicitly add it to a transaction; your browser or device asks for permission beforehand. You can remove it at any time.
- Imported files: when importing (e.g. a YNAB export), the file content is only processed to transfer it into your account; the file itself is not stored.
- Sign-ins/devices: for each signed-in device a device name (e.g. “Web · iPhone”), creation and last-use time, and expiry date. The sign-in token is stored on the server only as a hash.
- Technically necessary data: the IP address is processed briefly in memory to limit abuse during registration and sign-in, and is not stored permanently. The application itself keeps no access logs. The upstream reverse proxy logs requests (including IP address, time, requested address, status code). These logs serve security and error analysis (legitimate interest, Art. 6(1)(f) GDPR) and are deleted after one month.
3a. Emails
We only send you emails that are necessary for your account: verification of your email address, password reset links, confirmation of an address change, security notices (e.g. password changed, account deleted) and reminders before the end of the trial. No newsletter, no advertising, no tracking pixels. Emails are sent via the mail server of our email provider netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany. Links in emails contain a one-time, time-limited token that is stored on the server only as a hash.
4. Purpose and legal basis
Processing takes place to provide Moneytracker in accordance with your registration (Art. 6(1)(b) GDPR) and to protect against abuse (Art. 6(1)(f) GDPR).
5. Storage location and retention period
All data is stored on a server operated by our hosting and infrastructure provider netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, in a data centre in Vienna (Austria); where required, a data processing agreement under Art. 28 GDPR is in place. The data remains stored until you delete your user account; it is then removed immediately and completely. To protect against data loss, automatic backups of the entire server are made. Deleted data may still be contained in them until the respective backup is overwritten in the regular cycle; it is not processed further during this time.
6. Local storage in the browser and app
After signing in, a sign-in token is stored in your browser's local storage (localStorage) so that you stay signed in; it is removed when you sign out. Your chosen language may also be stored there. The iOS app stores a copy of your data on your device so that it also works offline; it is removed when you sign out. Cookies are not used.
7. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You can carry out a complete data export (JSON/CSV) and the deletion of your account yourself at any time under “My account”. You can also lodge a complaint with a data protection supervisory authority; in Austria, the Austrian Data Protection Authority (Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at).
8. Payments
For web subscriptions we use the payment service provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland). When subscribing, you are redirected to a Stripe payment page; you enter your payment details (e.g. card number) only there – they are not stored on our server. We transmit your email address and an internal customer number to Stripe; from Stripe we receive the status of your subscription (plan, term, cancellation). The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). Stripe's privacy notice: https://stripe.com/privacy. Stripe processes payment data for payment processing as an independent controller. This may involve a transfer to Stripe, Inc. in the USA; this is safeguarded by the EU-US Data Privacy Framework (adequacy decision of the European Commission) and additionally by EU standard contractual clauses. In the iOS app, billing will be handled via Apple in future.
Last updated: 31 October 2026