Privacy policy

Who is responsible

The data controller for smpl.money and for the hosted application at app.smpl.money is Gavin Johnson, who can be reached at info@smpl.money.

For a copy of Simple Balance that somebody else runs, the controller is whoever runs it. That is the whole point of self-hosting, and it means this policy does not describe their deployment and we have no access to it.

The short version

This website keeps nothing about you and loads nothing from any other origin. It has no analytics, no tracking pixel, no third-party script and no cookie at all, and nothing of its own is saved in your browser. Its host, Netlify, keeps the request logs any web server keeps, for a short time, as What the website collects says.

The application holds the ledger you put into it, the account you signed in with, and the operational records needed to run a service. It shares them with nobody except the providers that run the service: the host, Oracle Cloud Infrastructure; the payment processor, Stripe; the advertising network on the free plan, Google; and the email service, Gmail, which Google also runs. Each is described below. An AI assistant sees your ledger only if you connect one.

You can export every transaction as CSV at any time, and deleting your account deletes your data. Some of it outlasts a deleted account: it stays in the database’s nightly backups for about two weeks, and in the server logs for the short time they’re kept; Stripe keeps its own record of any payments you made, as tax law requires; and a copy of each email the application sent you stays in the Gmail mailbox it was sent from until we delete it.

What the website collects

Nothing of its own. smpl.money has no analytics, no tracking pixel and no sign-in. It sets no cookie and saves nothing in your browser: the light or dark theme you see follows the setting your browser already has, so there’s nothing to save.

It loads nothing from anywhere else. Every page, script, style, font and picture on smpl.money comes from smpl.money itself, and the site tells your browser to refuse to load anything from another origin. There’s no advertising on it, no third-party script and nothing embedded from another company. Signing up or signing in takes you to the application at app.smpl.money, which is covered below, and which carries advertising on its free plan.

Our hosting provider, Netlify, processes the technical information any web server receives in order to serve a page (your IP address, the page requested, your browser and the time) and retains it briefly for operational and security purposes. We do not analyze it, and we cannot identify you from it.

What the application collects

What you give it. Your name and email address, and everything you enter into the ledger: accounts, balances, transactions, payees, categories, budgets, notes and any file you import. This is the substance of the service and it is stored because the service cannot work otherwise.

How you sign in. A password you set, stored only as a hash that cannot be reversed, or a Google account you chose to connect. Sessions are kept as a signed cookie which is strictly necessary to keep you signed in, and each one records the IP address and browser it was started from.

Operational records. Server logs, which include IP addresses and request paths, kept briefly for security and debugging. Sign-up and sign-in attempts are counted per IP address, so nobody can guess at passwords one after another.

A history of changes. The application records the changes made to your ledger, by you, by an assistant you connected or by its own schedule, and keeps a copy of what each change touched, as it was before and after. You can read the list on the Activity page. Nothing in it is rewritten, so whatever you edit or delete keeps its earlier version there until your account is deleted.

If you subscribe. The identifiers Stripe gives your customer record and your subscription, and your subscription’s status and dates. We never see or store your card details: they go directly to Stripe.

Why we are allowed to hold it

Where the UK GDPR and the EU GDPR apply, the lawful bases are: performance of a contract, for your account and the ledger itself, without which there is no service to provide; legitimate interests, for security logging and fraud prevention, balanced against your rights and kept to what is necessary; legal obligation, for the payment records tax law requires to be kept; and consent, for personalized advertising and for optional emails, which you may withdraw at any time.

In the EEA, the UK and Switzerland, Google’s message in the application asks for that consent before an advertising cookie is set, and Cookies says how to change your answer.

Advertising, on the free plan

Advertising is in the hosted application only. This website shows none and loads no advertising script, whatever plan you’re on, so everything below is about the application.

The hosted application shows advertising to accounts on the free plan, supplied by Google AdSense. Paid accounts are shown no advertising, and a paid account doesn’t load Google’s script in the application at all, because the server decides and the browser is never told the rule.

Google and its partners use cookies and similar technologies to serve ads, and through the cookies it sets for advertising, Google may collect information about what you do over time and across other websites. In the application, an ad can be personalized: chosen partly from a profile Google keeps of your browsing. An ad that isn’t personalized is chosen from the page and your rough location instead. Neither kind is chosen from the figures in your ledger.

Where you are decides how you’re asked. In the EEA, the UK and Switzerland, Google shows a message asking for your consent before any advertising cookie is set or any ad is personalized. In the US states whose privacy laws give you the right to opt out of the sale or sharing of your personal information, it shows a link to do that instead, and an ad there can be personalized until you use it. Anywhere else there’s no message, an ad can be personalized, and the controls further down are how to stop it. The messages are published from the advertising account and shown by Google’s script in the application, not by the application’s own code.

Non-personalized is not the same as cookie-free. Even an ad that isn’t personalized sets cookies, for frequency capping and fraud prevention, which is why consent is required in the EEA, the UK and Switzerland before any advertising cookie, not only before personalization. If you decline there, or opt out in the US, that doesn’t remove the ads. It keeps them from being personalized, and in Europe it keeps Google from setting the advertising cookies that need your consent, though Google may still show what it calls a limited ad in the same place.

The application doesn’t force an ad to be non-personalized: it leaves that to Google’s message, by where you are, as set out above.

Your browser may tell Google what you’re interested in. Chrome and some other browsers keep a short list of topics inferred from the sites you visit, and offer it to advertisers through what Google calls the Topics API. The application doesn’t block that, so an ad shown there may be chosen partly from it. This website tells your browser not to offer the list to anything on its pages. The list is your browser’s rather than ours: we never see it, it’s built from the sites you visit and not from anything in your ledger, and your browser settings control it. In Chrome that’s Settings, then Privacy and security, then Ads.

What Google receives. What any site your browser loads something from receives: your IP address and your browser’s details, with Google’s own cookies where they’re allowed. From us, it receives our publisher id and the address of the page the ad sits on. That address is not nothing: pages in the application carry record identifiers in their paths, so a URL identifies a row in your ledger, though not a person, a name or an amount. No account name, no balance, no figure, no email address and no identifier of yours is sent as a targeting parameter, and the browser’s referrer is held to the application’s origin, so it doesn’t carry the page either.

Google’s own description of how it uses data from sites that use its services is at policies.google.com/technologies/partner-sites. You can control ad personalization across Google’s products in Google’s ad settings at myadcenter.google.com, and opt out of third-party vendor cookies at youradchoices.com, which is the industry opt-out run at aboutads.info, and at youronlinechoices.eu in Europe. Blocking third-party cookies in your browser does the same thing for every site at once.

In the application, advertising never appears on the billing page or the sign-in screen.

Payments

Payments are processed by Stripe. When you subscribe, your card details are collected by Stripe’s own form and sent directly to Stripe; they do not pass through our servers and we never store them.

To create your customer record, we send Stripe your name, your email address and an internal identifier for your Simple Balance account, not for any account in your ledger. Nothing from your ledger is sent.

We store the identifiers Stripe gives your customer record and your subscription, the price you’re on, and your subscription’s status and dates, such as when the current period ends and whether it’s set to cancel then, because those are what decide what your account may do. We also keep a record of each billing request you make, such as subscribing, changing or canceling your plan, or replacing your card, and how it ended, so a request retried after a timeout is carried out once rather than twice, and, if we ever give you a plan ourselves rather than through Stripe, a note of why and for how long. None of it includes your card details. Stripe’s privacy policy is at stripe.com/privacy.

Email

Email you asked for. Confirming your address, resetting a password, and the reminders you turn on for a recurring transaction or a template. These stop when you stop asking for them.

Email about the service itself: planned maintenance, a change that affects your data, a feature being retired, a security matter. These are part of running the service rather than marketing, so they are sent to every account and there is no unsubscribe from them. We keep them rare and we keep them factual.

Occasional email about the product, such as a significant new capability. None is sent today. If that changes, every one will carry an unsubscribe link that works immediately and without signing in, and unsubscribing from these won’t affect the two kinds above. You can opt out in advance at any time by writing to info@smpl.money.

There is no newsletter, nothing is sold to a mailing-list broker, and your address is never shared for anybody else’s marketing.

The application sends the email you asked for through Gmail. What Google receives that way is under Who else sees your data, and how long Gmail keeps a copy is under Where it is held.

Who else sees your data

Nobody, other than the providers needed to run the service, and an AI assistant if you connect one yourself. Simple Balance doesn’t sell your data or rent it to anyone, though under the California Consumer Privacy Act and similar laws in other states, letting Google’s advertising cookies personalize the ads on a free account can count as selling or sharing personal information, which Opting out of sale or sharing, under Your rights, tells you how to stop. What leaves for advertising is what Google receives to show an ad to a free account in the application, set out under Advertising. This website sends Google nothing about you.

Those providers are: Oracle Cloud Infrastructure, which hosts the application and stores its database; Stripe, for payments; Google, for advertising to a free account in the application, for Google sign-in if you use it, and through Gmail, which carries the email the application sends; and Cloudflare, which receives the mail you send to info@smpl.money and forwards it to us. For advertising and for sign-in, Google decides for itself how it uses what it receives, under its own privacy policy at policies.google.com/privacy.

What Google receives through Gmail. The application sends four kinds of email, each to the address on your account: one asking you to confirm that address, a password reset when you ask for one, a notice that a recurring transaction has proposed new entries for you to review, if you turned that on, and a reminder you set on a template. So Google receives your email address and each message. A confirmation or reset holds a link that stops working within an hour. A recurring transaction’s notice holds the name you gave it, how many entries it proposed and the date of each, and a template’s reminder holds the template’s name and the date it’s for. Both put that name in the subject line. Each also holds a link back to the application. The application adds nothing else: none of them holds your name, an amount, a balance, a payee or the name of an account, unless you put one into the name you gave the recurring transaction or the template.

An AI assistant you connect sees what you grant it when you approve the connection, and what its provider does with that is governed by the provider’s own terms, not by this policy. Nothing reaches an assistant unless you connect one, and you can disconnect it from the settings page at any time.

We will disclose data if we are legally required to, and we will tell you unless we are prohibited from doing so.

Where it is held, and for how long

Data for the hosted application is stored by Oracle Cloud Infrastructure, on servers in the United States. Where you are in the UK or the EEA, transfers rely on the UK Addendum and the European Commission’s Standard Contractual Clauses. What Stripe, Google and Cloudflare receive, the copies in Gmail included, is held by them, in the United States and in other countries. Each of them takes part in the EU-U.S. Data Privacy Framework and its UK Extension.

Backups. The database is backed up every night, and the 14 most recent backups are kept, at Oracle, on the machine that runs the application. So what you delete, or everything once you delete your account, stays in the backups taken before then until 14 newer ones have replaced them, which is two weeks when every night’s backup runs.

Your ledger is kept until you delete your account. Deleting something in it doesn’t erase it before then: a deleted transaction stays where you can restore it, and the history of changes keeps a copy of anything you delete. Server logs are kept for a short operational period. Deleting your account deletes the billing records the application keeps and your customer record at Stripe. Those records are the ones listed under Payments, such as Stripe’s identifiers and your subscription’s status and dates, and none of them holds your card details. The payments themselves stay in Stripe’s records for as long as tax law requires, under Stripe’s own privacy policy.

The copies Gmail keeps. The application sends its email by signing in to one Gmail mailbox, the way a mail program does, and Gmail keeps a copy of each message sent that way in that mailbox’s Sent mail. A message that bounces, or that draws an automatic reply, can also come back to us with a copy of it inside. Those copies stay until we delete them, and a deleted message stays in Gmail’s trash for up to 30 days before it’s gone for good. Deleting your account doesn’t reach them. Write to us and we’ll delete every copy of the email sent to you.

Deleting your account

You can delete your account from the settings page. It removes your ledger, your account and every record the application keeps about you from its database in one operation, and it cancels any subscription at the same time. It cannot be undone, which is why exporting first is worth doing. The nightly backups taken before then still hold it until newer ones replace them, within about two weeks. The copies Gmail keeps of the email the application sent you aren’t part of it; we delete those when you ask.

Deletion is refused rather than partially completed if the payment processor cannot be reached to cancel a subscription, so that nobody is left being charged for an account that no longer exists.

Your rights

Where the UK or EU GDPR applies you have the right to access your data, to correct it, to have it erased, to restrict or object to how it is used, and to receive it in a portable form. The California Consumer Privacy Act gives California residents comparable rights, including the right not to be discriminated against for exercising them. What leaves for advertising is what Google receives, set out under What Google receives, to show an ad to a free account in the application. Premium takes the advertising out of the application, Google’s script with it, and this website sends Google nothing about you on any plan.

Opting out of sale or sharing. Under the California Consumer Privacy Act and similar laws in other states, letting Google’s advertising cookies collect information to personalize ads can count as selling or sharing personal information, even though no money changes hands for it and nothing from your ledger is involved. If you live in one of those states, Google’s message in the application carries a link to opt out, and using it keeps Google from personalizing ads for you there.

Most of these you can exercise yourself and immediately: the product has CSV export of your transactions for portability, editing for correction, and account deletion for erasure. For anything else, write to the address below and we will answer within one month.

If you are not satisfied, you may complain to your data protection authority: in the UK, the Information Commissioner’s Office at ico.org.uk.

Children

The service is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has created an account, write to us and we will delete it.

Cookies, all of them in the application

smpl.money sets no cookie, and loads nothing from anybody else that could. It has no sign-in, no analytics and no advertising, and the light or dark theme follows your browser’s own setting. Every cookie below is set in the application at app.smpl.money.

The application sets only the cookies it needs to sign you in. A session cookie keeps you signed in, and short-lived cookies hold a sign-in or an assistant’s authorization while it is in progress. None of them is used for anything else or shared, and none needs consent, because each is essential to something you asked for.

Your theme is not a cookie. Whether you chose the light or dark theme is saved on your account, and a copy is kept in your browser’s local storage so the page opens in the right colors. Signing out clears that copy.

On the plan page, Stripe sets its own cookies. That page, where you subscribe, is the only one that loads Stripe’s script, and Stripe sets cookies there to prevent fraud. They are covered by Stripe’s privacy policy.

On the free plan, Google sets cookies for advertising, and those are the ones that do require your consent. Who is asked first depends on where you are. In the EEA, the UK and Switzerland, Google’s message asks before any of them are set, and you can change or withdraw your answer from it later. In the US states whose privacy laws give you the right to opt out, nothing asks before they’re set, and the message offers a link to opt out of the sale or sharing of your information instead. Everywhere else, they’re set without asking.

How to keep them out. Blocking third-party cookies in your browser keeps out the ones Google sets from its own domains, and clearing your cookies removes them. The opt-outs under Advertising work on what Google already has: Google’s own ad settings at myadcenter.google.com, and the industry opt-outs at youradchoices.com and youronlinechoices.eu. On Premium the application doesn’t load Google’s script, so it sets none. Write to info@smpl.money about any of it.

If you decline, that doesn’t remove the ads. It keeps them from being personalized and keeps Google from setting the advertising cookies that need your consent, though Google may still show a limited ad. It doesn’t limit the product in any other way, and nothing about your account changes.

Do Not Track and Global Privacy Control. Neither smpl.money nor the application responds to a browser’s Do Not Track or Global Privacy Control signal, because neither one reads them. smpl.money loads no script from anybody else, so Google’s is only in the application, and what it makes of them is Google’s to say rather than ours.

Changes

If this policy changes materially we will say so on this page and, where the change affects how your data is used, by email before it takes effect.

Contact

Write to info@smpl.money about anything on this page, or anything else. There is a person at the other end.