Privacy Policy
Effective 1 October 2026
Summary
- Your amounts, notes, receipts and income are encrypted before they are stored. People with access to our database cannot read them.
- We do not look at any individual's financial information. Support can see your data only if you turn on access in the app, and every view is recorded.
- We use statistics across all users, which never identify anyone, to improve Bricks, fix problems and promote the app.
- We do not sell your personal information, and we never use it to target advertising at you.
- You can export or delete your data at any time from the app.
1. Who we are
Bricks is a personal budgeting app for tracking spending, setting budgets and sharing costs with others (the “Service”). In this policy, “Bricks”, “we” and “us” mean the operator of the Service, who is the controller of your personal information. Bricks is developed and operated by an independent developer. If a company is formed to run the Service, this policy will be updated to name it.
This policy applies to the Bricks apps for iPhone and Android and to usebricks.app. Where the EU General Data Protection Regulation (GDPR) or a similar law applies to you, you have the rights described in section 10.
2. Information we collect
Information you give us
- Account information: an account identifier and, if you save your account, your email address or the Apple or Google account you sign in with.
- Profile: your name, currency, country and app language.
- Financial information: expenses, income, budgets, subscriptions and other regular payments, categories, notes, merchants, receipt photos, and your setup answers such as approximate income, housing costs and savings rate.
- Optional details about you: age range, town or city, type of work, and how you found Bricks.
- Groups: the groups you create or join, the names of the people in them, shared expenses and settlements.
- Communications: feedback you send in the app and messages you send to support.
Information created when you use Bricks
- Device and technical information: a notification token for your device, the app version, platform and language, and server records of requests (time, address requested, response code). Server records never contain amounts or what you wrote.
- Usage counts: how many times a day you use the AI features, so we can apply fair limits.
Information from others
- A member of a group may add your name to a shared group and record expenses you are part of.
- If you sign in with Apple or Google, they share your account identifier and, where you allow it, your email address and name.
3. How we protect your financial information
Before your financial information is saved, our server encrypts each amount, title, note, merchant, receipt photo, income figure and split share using AES-256-GCM. The key that decrypts it is itself protected by a separate key management service. Only our server is permitted to use that key, and every use is recorded in an audit log.
As a result, anyone who reads our database directly, including our own team and our hosting provider, sees only encrypted text. Your financial information is decrypted only to show it to you in the app, to send you the notifications you turn on, and to prepare your budget plan.
Some information stays readable because the Service needs it to work: identifiers, dates, the categories you choose, who belongs to which group, and your optional details. None of it reveals amounts.
4. How we use information, and our legal bases
| Purpose | Legal basis |
|---|---|
| Provide the Service: keep your account, show your budgets and history, work out group balances, and keep your data in sync across your devices. | Performance of our contract with you |
| Read the receipts you scan and the text of what you say with voice input, and suggest a budget plan from your setup answers. | Performance of our contract with you |
| Use your age range, town and type of work to make your plan fit your circumstances. | Your consent, which you give by providing them and can withdraw by clearing them |
| Send the reminders and alerts you turn on. | Your consent |
| Let support look at your data to resolve a problem you report. | Your consent, given in the app for each period of access |
| Produce statistics across all users to improve the Service and to find and fix problems. | Our legitimate interests in running and improving the Service |
| Use those statistics, which identify no one, in our marketing and advertising. | Our legitimate interests in promoting the Service |
| Keep the Service secure, prevent abuse and apply fair usage limits. | Our legitimate interests in protecting the Service and its users |
| Comply with the law and respond to lawful requests. | Legal obligation |
Where we rely on legitimate interests, you may object at any time (see section 10).
5. Aggregated statistics
To understand how Bricks is used and where it fails, our systems calculate figures across all users, for example how many people stay within their grocery budget in a month, or which features help people save. These figures are combined across many users and do not identify anyone. We may use them in our marketing and advertising, for example to say how much Bricks users save on average, and we may share them with partners. Because they do not show which user they come from, they cannot be used to identify you or to target advertising at you. You can leave your data out of these figures at any time by turning off Include me in totals in Profile, Privacy and security.
6. Support access
We do not look at an individual's financial information. If you want our help with a problem, you can turn on Let support see my data in Profile, Privacy and security. While it is on, our support team may view your data for the sole purpose of resolving your problem. Access ends automatically after 7 days, and you can end it sooner. Each time support views your data, the access is recorded.
7. Who we share information with
Service providers
We use the providers below to run the Service. Each processes personal information only on our instructions and only to provide its part of the Service, under a data processing agreement that meets the requirements of Article 28 of the GDPR. Where information leaves the European Union, the agreement includes the European Commission's Standard Contractual Clauses.
| Provider | What it does for Bricks | Where | Data protection terms |
|---|---|---|---|
| Supabase, Inc. | Stores your data, encrypted as described in section 3, and handles sign-in. | European Union (Ireland) | Supabase Data Processing Addendum, with the Standard Contractual Clauses |
| Google Cloud | Runs our servers and the key management service that holds the encryption key, and keeps server records. | European Union (Spain) | Google Cloud Data Processing Addendum, with the Standard Contractual Clauses |
| Upstash, Inc. | A short-term cache for usage counts and automatic answers. It never holds financial information. | European Union (Ireland) | Upstash Data Processing Addendum, with its European annex |
| OpenAI | Reads the receipts you scan and the text of your voice input, and helps prepare your budget plan. It does not use this information to train its models. | United States | OpenAI Data Processing Addendum, with the Standard Contractual Clauses |
| Google Firebase | Delivers the notifications you turn on, and hosts usebricks.app. | Worldwide | Firebase Data Processing and Security Terms, with the Standard Contractual Clauses |
| Apple | Delivers notifications to iPhone through the Apple Push Notification service. | Worldwide | Apple Developer Program License Agreement |
Some alerts include an amount, such as what is left in a budget, so that text passes through the notification services of Google and Apple to reach your device.
Others
- Apple or Google, when you choose to sign in with them. They act under their own privacy policies.
- Members of your groups, who see what is shared in the groups you belong to.
- Authorities, where the law requires it.
- A successor, if Bricks is sold, merged or reorganised. Your information would pass to the new operator only under this policy: your financial information stays encrypted, nobody looks at an individual's financial information, and it is not used for a new purpose without your consent. We will take reasonable steps to let you know, so you can export or delete your data.
We do not sell personal information, we do not share it with advertising networks, and we never use it to target advertising at you.
8. International transfers
Your data is stored in the European Union (Ireland), and our servers and key management service run in the European Union (Spain). OpenAI processes the information it receives in the United States, and the notification services of Google and Apple operate worldwide. Each of these transfers is protected by the Standard Contractual Clauses adopted by the European Commission, as set out in section 7.
9. How long we keep information
| Information | How long |
|---|---|
| Your account and everything you enter | Until you delete your account, unless we must keep some of it longer to meet a legal obligation. Backups are replaced on a regular cycle. |
| Shared group expenses | Kept with the group after you leave or delete your account, without your account, so the balances of the other members stay correct. |
| Receipt photos | Until you remove them or delete your account. |
| Optional details about you | Until you clear them or delete your account. |
| Feedback and support access records | Until you delete your account. |
| Notification tokens | Until you sign out, delete your account, or your device stops accepting notifications. |
| Server records and key audit logs | Up to 30 days. |
| Requests to OpenAI | Up to 30 days, kept by the provider to detect abuse. The provider does not use them to train its models. |
10. Your rights
Depending on where you live, you may have the right to:
- access your personal information and receive a copy of it;
- correct information that is wrong or incomplete;
- delete your information;
- take your data with you in a common format;
- object to or ask us to restrict how we use it;
- withdraw your consent at any time, without affecting what was done before;
- complain to the data protection authority where you live.
Objecting and restricting. To object to your data being counted in statistics, turn off Include me in totals in Profile, Privacy and security. Each of the other optional uses has its own setting: clear your optional details, turn notifications off, or leave support access off. To ask us to restrict how we use your data, for example while you dispute its accuracy, write to us. While a restriction is in place, we keep your data but do not use it: no AI features, no notifications, no statistics, and no support access. We record each restriction and when it is lifted.
You can do most of this yourself in the app: Export data in Profile gives you a copy of everything, your details can be edited in Profile, and Delete my account in Privacy and security removes your account and data. For anything else, write to support@usebricks.app. We will respond within the time required by applicable law, and may ask you to confirm that the account is yours.
11. Security
Besides encrypting your financial information (section 3), we protect your data with encrypted connections, access controls that limit each part of the system to what it needs, audit logs of every use of the encryption key, and an optional app lock with Face ID, fingerprint or passcode. No method of storing or sending data is completely secure, so we cannot guarantee absolute security. If a breach affects your personal information, we will act as the law requires.
12. Automated suggestions
Bricks suggests budgets and reads receipts and voice input automatically. These suggestions help you organise your money. They do not produce legal or similarly significant effects on you, and you can change or ignore every one of them.
13. Our website
usebricks.app does not set cookies and does not use analytics or advertising trackers. It loads its fonts from a font service, which receives your device's address to deliver them.
14. Children
Bricks is intended for people aged 18 and over. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.
15. Changes to this policy
We may update this policy from time to time. We will change the effective date above and let you know of any material change.
16. Contact
For any question about this policy or your personal information, write to support@usebricks.app.