Honest summary (TL;DR)
Zaimu runs entirely on your device. We have no servers storing your financial data in the clear, there are no user accounts, and we never sell or share anything. Your expenses are yours and never leave your device unless you make a backup or, only if you subscribe to Pro, turn on sync: then they are uploaded encrypted on your device with your secret passphrase, so we cannot read them.
1. Who is responsible
This application ("Zaimu", "the app") is developed and maintained by Inversiones F. Martínez Requena, S.L. (Sociedad Unipersonal), based in Spain. For any privacy question, contact contacto@zaimuapp.es.
2. What data we process
Financial data you enter (amounts, pillars, categories, notes, budgets, reflections) is stored only in a local database on your device. It is never transmitted to us or to third parties. We cannot see it. In addition, sensitive text fields (notes, categories, reflections, descriptions and goal names) are encrypted at rest with XChaCha20-Poly1305; the encryption key lives only in the system secure keychain.
Sync (Pro option): if you enable device sync, your data is packaged into a file that is end-to-end encrypted with a password only you know (derived via PBKDF2) and stored in your own iCloud Drive / Google Drive. We never see your password or your data.
Bank accounts: Zaimu does not connect to your bank, does not import transactions, and never asks for banking credentials.
User accounts: Zaimu has no sign-up or login. We do not collect your name, email, phone, or account identifiers.
3. Backups
The app lets you create a backup of your data. That file is generated by you and stored wherever you choose: your own iCloud Drive, Google Drive, email, or local storage. It does not pass through our servers. With the Advanced tier the app also keeps one automatic backup a month on your own device (the last 12); those copies never leave the device and are deleted if you uninstall the app or clear the site's data.
Encrypted sync (Pro only, optional). If you turn it on, the app encrypts your database on your device with a key derived from your secret passphrase and uploads that encrypted file to our service (api.zaimuapp.es, hosted on Cloudflare). We store only that unreadable file and an identifier derived (hash) from your licence key so we know whose it is; we do not store your passphrase or your IP. Without your passphrase nobody, including us, can read it. To check that your licence is Pro we send the licence key to Lemon Squeezy.
4. In-app purchases
In the web version, purchases (Base, Advanced and Pro) are processed by Lemon Squeezy as merchant of record. They process your email, country and payment details as an independent controller; we never see or store your card and only receive what is needed to deliver your licence key and handle refunds. See their privacy policy. If the app is later published in the stores, payments there are processed by Apple or Google, who give us aggregated, anonymous sales information.
Exchange rates (Pro only). If you record an expense in another currency, the app fetches European Central Bank exchange rates through Frankfurter (api.frankfurter.dev). The request contains only the currencies; the service can see your IP address, as with any internet request.
5. Crash reports and analytics
Zaimu includes no crash-reporting or analytics tools. We receive no data about how you use the app.
6. Device permissions
- Storage / files: only when you export or import a backup.
- Notifications: for local reminders (e.g. the impulse filter). Generated on-device; we use no server push.
The app does not access your location, contacts, camera, microphone, or photos.
7. Children
Zaimu is not directed at children under 14 and does not knowingly collect their data. Since we collect no personal data at all, this is informational.
8. Your rights (GDPR)
Because we store none of your personal data on any server, there is nothing to request, rectify, or delete on our side: you are in full control. To erase all your data, delete the app or use the in-app wipe option. You may lodge a complaint with the Spanish Data Protection Agency (AEPD).
9. Website and waitlist
This website uses no cookies and no analytics tools and loads its typefaces from our own server, with no requests to third parties. The kakeibo calculator runs entirely in your browser: we do not send what you type.
If you join the waitlist we process your email solely to tell you when Zaimu launches. The legal basis is your consent (GDPR art. 6.1.a). It is stored on Cloudflare, Inc. infrastructure, which acts as our processor (under standard contractual clauses for transfers outside the EEA), and we do not store your IP address. We keep your email until the launch is announced and for at most 24 months, or until you unsubscribe. You can withdraw consent and exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to contacto@zaimuapp.es. If you believe we have mishandled your data you may complain to the Spanish Data Protection Agency (aepd.es).
Web version of the app (app.zaimuapp.es)
The expenses, budgets and reflections you enter in the web version are stored only in your browser (IndexedDB); we neither receive nor send them. If you clear site data or switch device without a backup they are lost: you can export a backup file from Settings. If you buy a plan, Lemon Squeezy processes the payment as the seller and passes us the billing data needed; when you activate or check your licence key, the app sends that key to their licence service, without sending any of your financial data.
10. Changes
If we update this policy, we will change the header date and publish the new version at this same URL. Material changes will be announced inside the app.