Privacy policy
Last updated · October 16, 2026
Tosaki is an app for organizing your personal finances. This policy explains what data it uses, why, who processes it and what control you have over it. We wrote it so you can understand it without being a lawyer.
Data controller
The controller of your personal data is Juan José Vizhñay Agudo, based in Ecuador. For any privacy matter, write to support@tosaki.app.
What data we use
Your account data. Your email address, to sign in with a one-time code, and your preferences: language and main currency.
The financial data you enter. Accounts (name, type, currency, institution and, if you wish, only the last four digits), transactions, categories, recurring payments and income, debts, goals and investments. Tosaki does not connect to your bank and never asks for banking credentials or full card numbers.
Minimal technical data. To maintain your session and protect your account, our authentication provider logs sign-in events and the IP address they come from.
What we do not collect. No contacts, location, photos or advertising identifiers. We use no analytics, advertising or tracking tools, either in the app or on this site.
Why we use it
- To provide the service: store and sync your records and calculate how much you can spend.
- To email you your sign-in code.
- To protect the service and your account, and to recover data in the event of a failure.
We do not sell your data, share it for advertising or use it to train artificial intelligence models.
The legal basis is the performance of the contract you accept when using Tosaki (Article 6(1)(b) of the GDPR and its equivalent in Ecuador’s Ley Orgánica de Protección de Datos Personales). Backups and security logs are based on our legitimate interest in keeping the service secure and available (Article 6(1)(f) of the GDPR).
Artificial intelligence
When you type a phrase such as “paid $200 rent”, Tosaki interprets it on your iPhone, first using its own rules and, if your device has Apple Intelligence, using Apple’s models that run on the device itself. Your phrases are not sent to any external artificial intelligence service.
If we offer cloud AI features in the future, they will be optional. We will ask for your explicit consent before sending any data.
Who processes your data
We use these providers, which act as data processors under data protection agreements:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database and authentication | United States (AWS, us-east-1) |
| Resend | Sending emails with your sign-in code | United States |
| Cloudflare | Storage of encrypted backups and hosting of this site | Global network |
| GitHub | Automated backup execution, with data encrypted before it leaves | United States |
When data leaves the European Economic Area or Ecuador, the transfer is protected by the standard contractual clauses approved by the European Commission, included in each provider’s agreements.
How we protect your data
- All communication is encrypted (TLS).
- The database applies rules for each user: no one else can read or change your records.
- The app contains only a public key. Privileged keys never leave the server.
- Your session is stored in the iOS Keychain, and you can lock the app with Face ID or your passcode.
- The local copy on your iPhone uses iOS file protection, is excluded from iCloud backups and is deleted when you sign out.
- Payment reminders are local notifications and do not show amounts.
- We make a daily backup, encrypted with a key held only by the controller. Each backup is deleted after 30 days.
How long we keep it
For as long as you have an account. If you delete it from Settings → Delete account, we remove your data from the database immediately. Backups that still contain it are deleted within 30 days and are only used to restore the service after a failure.
Your rights
You can access, correct and delete your data, object to or restrict its processing, and request a copy in a structured format (portability). You can exercise most of these rights within the app: edit or delete records, or delete your account. For anything else, write to support@tosaki.app and we will reply within the legal time limits.
If you believe we have not handled your data properly, you can lodge a complaint with Ecuador’s Superintendencia de Protección de Datos Personales or the data protection authority in your country.
Minors
Tosaki is not intended for anyone under 16, and we do not knowingly collect their data.
Cookies
This site does not use cookies or analytics.
Changes
If we make significant changes to this policy, we will notify you in the app before they take effect. The date of the last update appears at the top of this page.