Privacy policy

Last changed November 11, 2026

Draft: the provider's details are still missing, so this text is not in force yet.

This is a translation for your convenience. The German version is the binding one.

1. Controller

Rialto Daphino Effendy (Rideff), [street and number], [postcode and town], Deutschland Email: hallo@rideff.com

Write to this address with any question about your data.

2. What we process

Account data: email address, display name, language, role in the household, passkeys or a password hash, sign-in times.

What you enter: income, spending, budgets, debts, subscriptions, shifts, goals, journal and training entries, uploaded files such as receipts and bank statements, and your messages to the assistant and what it remembers.

Payment data: the plan you chose, the billing status and a customer number at Stripe. We never see or store card or bank details; Stripe holds them.

Technical data: IP address, time, requested address and browser details in server logs and, if you turn on notifications, your device's push address.

3. Purposes and legal bases

Providing the app, your account and the paid features: performance of a contract (Art. 6 (1) (b) GDPR).

Security, protection against abuse and finding errors: legitimate interest (Art. 6 (1) (f) GDPR).

Voice assistant, Telegram link and push notifications: your consent, which you can withdraw in Settings at any time (Art. 6 (1) (a) GDPR).

If you choose to enter health details, for example in the journal or training log, we process them only to show them to you, based on your explicit consent (Art. 9 (2) (a) GDPR).

Invoices and payment records: legal retention duties (Art. 6 (1) (c) GDPR).

4. Recipients and processors

Supabase (database, sign-in, file storage): stored in Frankfurt am Main, EU.

Vercel (hosting and delivery of the app): server functions run in Frankfurt am Main; the company is based in the USA.

Stripe Payments Europe, Ireland (payments).

Anthropic, USA (AI assistant): receives your question, the part of your data needed to answer it, and files you ask it to read.

OpenAI, Ireland/USA (voice assistant): receives the audio of your conversation while it runs, and only when you start voice mode.

Telegram (only if you link your account): receives the messages the bot sends you.

Push services by Apple, Google or Mozilla (only with notifications on): receive encrypted notifications.

We have data processing agreements with providers that work on our behalf. We do not sell data and show no advertising.

5. Transfers outside the EU

Some providers are based in the USA or process data there. Transfers rely on the adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses.

6. AI assistant

The assistant answers from your own entries. Under the AI providers' terms, content sent through their interface is not used to train their models.

No automated decision with legal effect within the meaning of Art. 22 GDPR takes place. The assistant proposes changes to your data; you confirm them.

7. Cookies and storage on your device

We only use what the app technically needs (§ 25 (2) TDDDG): a cookie for the language, your sign-in, the offline copy of your data, your display settings and, if you turn it on, the hash of your PIN. There are no tracking or advertising cookies and no analytics services.

8. Retention and deletion

We keep your data for as long as your account exists. Under Settings → Data you can export a copy, delete your entries or delete your account completely. Deleting the account removes your entries and files at once; our providers' backups expire after their fixed periods.

Invoice and payment data stays with Stripe and with us for as long as the law requires. Server logs are deleted after a short time.

9. Shared households

If you join a household, its members see the entries marked “Family” and what the owner shares with you. Private entries stay visible to you alone.

10. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). You can withdraw consent at any time with effect for the future.

You can complain to a data protection authority, for example the one where you live (Art. 77 GDPR).

Your email address is required for the account. Everything else you enter is voluntary.