Privacy, stated plainly.

The short version

• No account needed. On your own, Fluid Budget works offline, for as long as you like. Your budget stays on your phone and we never receive it.
• Sharing needs an account. If you share a budget as a family, a copy of it is kept on our server so everyone’s phone stays in step. Each phone still keeps its own full copy.
• No tracking, no analytics. No advertising identifiers, no analytics or crash-reporting kit in the app, no cookies on this site.
• No AI. Nothing you enter is sent to an AI service or used to train one.
• No notifications. The app never asks to send them.
• Nothing is sold. Not your data, not insights about it, to nobody.
• You can leave. Delete your account in the app at any time. What happens to a shared family budget is explained below.

Who we are

Fluid Budget is a family budgeting app for iPhone, developed and published by Ruben Bristian, an individual developer in Romania. “We” on this page means him. For data-protection law, he is the controller of the personal data described here.

Fluid Budget is a tool for keeping track of your own money. It is not a bank, a lender, a payment service or a financial adviser, and it never connects to your bank.

Questions about privacy, and any request about your data: hello@fluidbudget.io.

What stays on your phone

Without an account, this is everything. We have no copy, so we cannot see it, recover it or delete it for you. Deleting the app deletes it.

• Your budget and everything in it: money added and its automatic amounts, expenses (amount, currency, date, category, tags, note), recurring expenses, categories and their plans (with the dates a plan changed), tags, funds, projects, trips and their exchange rates, and any pocket money you keep for your children (see Children).
• Your name and, if you choose one, a profile photo.
• Settings: currency, time zone, language, appearance, Home layout and the like. Language and appearance belong to the phone and are never shared, even in a shared family budget.
• The shop names the app has learned: which category a shop usually means, so the next expense there comes with its category already chosen (see Apple Pay and Shortcuts).
• The start and end dates of your free period, and which of the app’s reminders about it you have already seen. The app also keeps these in the iOS Keychain so they survive reinstalling. They are dates, nothing more.

Your phone’s own backups (iCloud or a computer) include the app’s data the way they include any app’s. That is between you and Apple.

What reaches our server

Only once you make an account, which you need only to share a budget. From then on the family’s budget is copied to our server, and each phone syncs with it whenever it has a connection.

• Your account: email address, how you sign in (Apple, Google or an emailed code) and the language of your app, so the emails we send you are in your language.
• Your profile: your display name and optional photo, so the others can see who added what.
• The family: who is in it and who created it (the Admin), the monthly budget and its automatic amounts, currency, time zone, travel tags, and what happens to money left at the end of a month.
• The shared ledger: everything listed under your phone that belongs to the family: expenses and their notes, money added, recurring expenses, categories, plans and the dates they changed, tags, funds, projects, fund entries and trips, each with who added it and when.
• Learned shop names: for each shop, its name as the app writes it down, the category it usually means, how often and when it was last used, and who taught it. They are shared so that both phones learn from each other’s payments.
• Pocket money: for each child a parent adds, the name, colour, illustration or optional photo, the automatic pocket money if one is set, and the money in and out with its notes. See Children.
• Sync records: identifiers, timestamps and a log of deletions, so that something deleted on one phone also disappears from the other.
• Invitations, connected children’s devices, subscription records and, if you sign in with Apple, an Apple credential: each explained in its own section below.

We use all of this only to run Fluid Budget for you: to sign you in, keep your family’s phones in step, show who added what, deliver invitations, know whether the family is subscribed, keep the service secure, and answer you when you write to us. We do not build profiles, show ads, score anyone or share your budget with anybody outside your family.

Signing in

You can make an account with Sign in with Apple, with Google, or with your email address and a six-digit code. There are no Fluid Budget passwords.

• Apple: Apple tells us your email address (or a private relay address, if you choose to hide yours) and, the first time, your name. We also keep a token from Apple so we can revoke Fluid Budget’s access when you delete your account. It is readable only by our server functions.
• Google: Google tells us your email address and name.
• Email code: you type your address and we email you a six-digit code to type back into the app. The email is written in the language of your app and sent through our email provider, Resend. We keep the address, as for the other two ways in.

Your session is kept in the iOS Keychain on your phone. If you delete the app and install it again, it starts signed out. Fluid Budget never receives your Apple or Google password.

Invitations

The Admin, the person who created the family’s budget, can invite someone in three ways.

• By email address. We store the address and the inviter’s name, and send one email saying who invited them. It is written in the inviter’s app language and sent through our email provider, Resend. The invitation expires after 14 days.
• By a link sent in a message. The app makes the link and your phone’s share sheet sends it, through whichever app you choose; we do not send it. It holds a one-time key that expires after 24 hours.
• By QR code, scanned across the table. The code holds a one-time key that expires after 30 minutes. Scanning uses the camera, and only when you ask it to.

A link or a QR code lets exactly one person in, and a family has only one open at a time: making a new one cancels the last. Our server keeps only a scrambled (hashed) form of the key. Anyone holding an open link can see the inviter’s first name before signing in, and nothing else about the family.

Please invite only people who expect to hear from you.

Profile photos

A profile photo is optional. The app asks for access to your photos only when you choose one, and you can say no and use everything else. In a shared family budget the photo is stored in a private storage area that only members of your family can read. You can remove it in Settings → Profile.

A child’s photo for pocket money is optional too. With an account it is kept in a separate private storage area that, again, only members of your family can read; without one it never leaves your phone. See Children.

Apple Pay and Shortcuts

If you set up the optional Apple Pay → Fluid Budget shortcut, iOS passes the amount and merchant of a Wallet payment to the app on your phone. Fluid Budget opens a new expense for you to check, and saves nothing unless you confirm.

• It needs no account, no key and no network, and it cannot read your Wallet or Apple Pay history.
• The merchant is not shown, but it is saved with the expense. In a shared family budget it is synced with that expense like any other detail.
• The app learns which category a shop usually means. On your own, what it has learned stays on your phone. In a shared family budget it is kept on our server too, so the other phone learns it as well (see What reaches our server).

You can turn the automation off in the Shortcuts app at any time. (Early test versions of the app used a server key for this. That is retired; any old key is deleted with your account.)

Travel exchange rates

When you start a trip in another currency, the app fetches the day’s exchange rates from ExchangeRate-API, or from Frankfurter (which publishes European Central Bank rates) if the first does not answer. The request contains only your family’s currency code, such as “EUR”. Like any request on the internet, it also shows those services your IP address. It never includes your budget or your account.

Rates are fetched when you open the trip sheet and when you return to the app during a trip, never in the background. They are cached on your phone, so Travel mode works offline, and you can always type a rate by hand. This works the same with or without an account.

Subscription and purchases

Fluid Budget is free for two calendar months from the moment you finish setting it up, with no card; the app shows the date they end. (A family budget set up before 10 November 2026 keeps the 90 days it started with.) After that it is one yearly subscription for the whole family, bought through the App Store. Without one, the budget becomes read-only: everything stays there to read, and nothing is charged unless you subscribe.

• Apple handles the payment. We never see your card or payment details.
• Without an account, the App Store answers the app directly on your phone and we receive nothing.
• With an account, the app sends us the App Store’s signed record of your subscription. Our server checks it with Apple’s App Store Server API, which it asks for the subscription’s current state by its transaction identifier, and Apple tells our server when it renews, ends or is refunded. We keep: the transaction identifier, the product, the start, expiry, grace-period and refund dates, whether it renews, and whether it was a test purchase. When you subscribe with an account, the app also gives Apple your account’s internal identifier, so the purchase can be matched to your account. We use this only to know whether your family is covered, so the other phones can say so too.
• We also keep the dates your family’s free period starts and ends, the date your own first free period began (so that starting a new family budget does not start a new one), and, if we have given you the subscription as a gift, a record of that gift.

Deleting your account deletes your subscription records, gifts and first free-period date; the family’s own free-period dates go when the family’s budget does. Deleting your account does not cancel an App Store subscription; cancel that in the App Store.

The web demo

The demo inside the phone on our home page is the real app running in your browser, with a made-up family. It has no server and no account. What you change is saved in your browser’s session storage for that tab only, and is gone when the session ends. Your browser also caches the demo’s own files (through a service worker) so it opens faster next time; that cache holds the app, not anything you typed.

One exception: if you start a trip in the demo, your browser asks the exchange-rate services above for the day’s rates, exactly as the app does.

This website

fluidbudget.io has no analytics, no advertising, no cookies and no forms. Its fonts are served from this site, so visiting it makes no requests to Google or any other third party. If your browser’s language differs from the page’s, the page may offer a version in your language; that choice, if you close the offer, is remembered in your browser’s own storage and never sent to us. The site is hosted on GitHub Pages; GitHub receives the technical information any web server receives, such as your IP address, browser and the page requested, and may keep it in logs for security under its own privacy statement.

Who helps us, and where

A few companies process data on our behalf, each only for the job described and under its own terms:

• Supabase: our server, for accounts, the shared family database, profile and children’s photos, and the functions that send sign-in codes and run invitations, children’s devices, purchases and account deletion. Our project is hosted in the European Union, in Ireland (AWS eu-west-1).
• Resend: sends our emails, which are sign-in codes and family invitations, from noreply@fluidbudget.io, so it receives the recipient’s address and the message.
• Apple: Sign in with Apple, the App Store and subscriptions (including the App Store Server API our server asks about a subscription), and the distribution of the app.
• Google: Google Sign-In, if you choose it, and Google Workspace, which hosts our mailbox, hello@fluidbudget.io, so it holds the messages you send us.
• ExchangeRate-API and Frankfurter: exchange rates, as described above.
• GitHub: hosts this website.

Some of these companies are based outside the European Economic Area, mainly in the United States. Each describes in its own terms how it protects data that leaves the EEA, for example through the European Commission’s standard contractual clauses or certification under the EU–US Data Privacy Framework.

If you have allowed it in iOS (Settings → Privacy & Security → Analytics & Improvements → Share with App Developers), Apple may share crash reports and usage statistics about the app with us. That is Apple’s feature and Apple’s choice to offer; the app itself contains no analytics.

We disclose data to anyone else only if the law requires it.

Leaving and deleting

A shared family budget is several people’s record of the same money. So leaving, or deleting your account, does not undo spending the family has already recorded. It does remove you.

Leaving a family

A member can leave in Settings → Members → Leave family. Anything their phone has not sent yet goes up first (if it cannot, the app asks them to connect and try again), then the phone is emptied of the family’s budget; what they added stays in it, because it is the family’s money.

Removing a family’s budget

Only the Admin, who created the family’s budget, can remove it, in Settings → Delete family data. That deletes it from our server for everyone in it, children’s photos included, disconnects any child’s device and ends the sharing.

Deleting your account

In the app: Settings → Account → Delete account. It needs a connection, and it asks twice. What happens next depends on your role.

• If you are the Admin, the family’s budget is deleted from our server along with your account, for every member, children’s photos included, and any connected child’s device stops showing it.
• If you joined someone else’s family, the budget stays with its Admin, including the expenses, transfers and balances you helped record, so their history still adds up. Your access ends, and your name and photo are removed. The notes, merchant names and receipt links on expenses you added, and the notes on money movements you added, are cleared, and the shop names the app learned from you are deleted. What remains is a bare internal identifier with a “deleted” mark wherever a shared record still points to you. It carries no name.

That is pseudonymisation, not a promise of anonymity: in a family of two, dates and amounts can still make it obvious who entered something. Categories, tags and names of recurring expenses belong to the family and are not erased automatically; they may mention you. If you want more removed or corrected, write to us. We will weigh the request under the law, including the interests of the people who share the budget; a shared record is not exempt just because it is shared.

If you signed in with Apple, we try to revoke Fluid Budget’s access with Apple before deleting the account. If Apple is unreachable, the deletion goes ahead anyway; you can also remove the app in your Apple Account settings. We try to delete your stored photo in the same way.

Phones

• If you are the Admin, your own phone keeps its copy, signed out, and the app carries on without an account, as it did before there was one. The other members’ phones are told at their next sync that the family’s budget is no longer there, and offered a fresh start, which clears it from them.
• If you joined someone else’s family, your phone is cleared, as when you leave: anything it has not sent yet goes up first if it can get through within a few seconds, then the family’s budget is removed from the phone and the app goes back to its first screen. Other members’ phones remove your name, photo and the cleared text the next time they sync.

A phone that never comes online again, an old app version, or a copy someone saved elsewhere may keep earlier information, and we cannot reach those. Our server refuses any attempt by an old phone to put cleared text back.

How long we keep things

• Without an account, we keep nothing, because we have nothing.
• Account and family data stay on our server while the account and the family’s budget exist, and are deleted as described in Leaving and deleting.
• Invitations expire after 14 days (email), 24 hours (a link sent in a message) or 30 minutes (QR code). An invitation for a child’s device expires after 24 hours (link) or 30 minutes (QR code).
• A connected child’s device: the scrambled form of its key and when it last looked are kept with the child’s record, and deleted with the family’s budget. Once disconnected, the key reads nothing.
• Subscription records are deleted with the account; a family’s free-period dates, with the family’s budget.
• Emails are kept by Resend for a limited period under its own policy.
• Backups and provider logs are kept for limited periods under each provider’s own policy. Data you delete can remain in a backup until that backup ages out.

Security

Connections between the app and our server are encrypted. On the server, every table is protected by rules that let only members of a family read or change its data, and the Admin’s settings are guarded by the database itself. Profile and children’s photos sit in private storage. Sign-in sessions, and a child’s device’s key, are kept in the iOS Keychain.

No system is perfectly secure, and we will not pretend otherwise. Keep your phone locked and your email, Apple and Google accounts protected. If you think someone has got into your account or your family’s budget, write to us straight away.

Why we may use it

Under the GDPR we rely on:

• Providing the service you asked for: your account, a shared family budget, invitations, exchange rates and your subscription.
• Legitimate interests: keeping the service secure and free of abuse, and keeping a shared family budget’s financial history accurate for the people who remain in it after someone leaves or deletes their account. You can object to this; see Your rights.
• Legal obligations, where a law requires us to keep or disclose something.

Children

Fluid Budget is made for adults running a family budget, and is not directed at children. A child never gets an account and never enters anything. What we hold about a child is what a parent chooses to enter for pocket money.

Pocket money

A parent can add a child to keep track of their pocket money. What the parent enters belongs to the family, like a fund does: the child’s name, a colour, an illustration or an optional photo, the automatic pocket money if one is set (an amount, weekly or monthly, and its day), and every amount in and out, with its date, a label such as “Birthday” and any note. The app asks for no age, birthday or other detail about the child.

• Without an account, all of it stays on the phone, the photo included, like the rest of your budget.
• With an account, it is copied to our server with the rest of the family’s budget, and every adult in the family can see it. The photo is kept in a private storage area that only members of your family can read (see Profile photos).

A child’s own device

A parent with an account can connect a child’s phone or tablet, so the child can see their own pocket money. The parent shows a QR code or sends a link; it works once and expires after 30 minutes (QR code) or 24 hours (link). No account is made for the child, and the device is not asked for a name, an address or anything else.

• The device keeps a key, in its Keychain, that lets it read one child’s pocket money and nothing else: the child’s name, colour and picture, the balance, when the next pocket money comes, and the last fifty entries with their notes. It sees no other child, no fund, no member and no budget, and it cannot add or change anything.
• Our server keeps only a scrambled (hashed) form of that key, and when the device last looked, which the parent sees as “seen 2 minutes ago”. The child’s photo reaches the device through a link that works for ten minutes, and the device keeps the last answer, photo included, so it can show it offline.
• If Fluid Budget is deleted from the device and installed again, it forgets the key and needs a new link.

Removing it

• A device: on the child’s page, tap the pencil. The child’s devices are listed under Their own device; tap the × beside one and confirm Disconnect. The next time the device looks, it is refused and clears what it kept.
• A child: the bin beside the title in the same place, then Remove from list, once the child’s balance is zero. The photo is deleted from the phone and from our server (as soon as the phone has a connection), and the child’s devices are disconnected. A child who never had any money is deleted outright. If money did pass through, the child’s name and entries stay in the family’s history, because they are the family’s record of that money.
• Everything: removing the family’s budget, or the Admin deleting their account, deletes it all from our server, photos included (see Leaving and deleting). If you want more removed, write to us.

Apart from this, we do not knowingly hold personal data about children under 16. If you believe a child has given us personal data, write to us and we will delete it.

Your rights

Wherever you live, you can ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct it;
• delete it, or limit how we use it;
• give it to you in a portable format;
• stop using it on the basis of legitimate interests.

Much of this you can do yourself: change your name or photo in Settings → Profile, sign out without losing what is on your phone, leave a family, or delete your account. For anything else, email hello@fluidbudget.io, in any of the app’s languages. We answer within one month, and may need to confirm the request comes from the account holder.

You can also complain to a data-protection authority. In Romania that is the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro); elsewhere in the EU, the authority in your country.

Changes

When Fluid Budget changes how it handles data, this page changes first, with a new date at the top. If a change matters to how an account’s data is used, we will also say so in the app or by email.

This policy is written in English and translated into the app’s other languages. If a translation and the English version differ, the English version prevails.

Contact

Help with the app itself is on the support page.