This Privacy Policy explains how MyMascada ("we", "us", "our") collects, uses, shares, and protects your information when you use the MyMascada hosted service at app.mymascada.com and the MyMascada mobile apps for iOS and Android (together, the "Service").

MyMascada is also available as open-source software that you can self-host. If you use a self-hosted instance, the operator of that instance is the data controller and this policy does not apply — see the self-hosting privacy notes.

1. Data We Collect

Information you provide

Account information: email address, username, name, password (stored as a salted hash), preferred currency, time zone, and language.
Financial data: bank accounts, balances, transactions, categories, budgets, goals, and rules you create or import (including CSV/OFX files you upload).
AI chat messages: messages you exchange with the in-app AI assistant.
Support communications: the contents of emails or messages you send us.

Information collected automatically

Bank data via Akahu: if you connect a New Zealand bank account, account details and transactions are synced through Akahu (see Third-Party Services below).
Authentication data: session and refresh tokens, login timestamps, and security audit logs.
Device data for push notifications: a device push token if you enable notifications in the mobile app.

The Service does not use third-party advertising SDKs and does not sell your personal information.

2. How We Use Your Data

To provide the Service: track spending, categorize transactions, manage budgets, and show analytics.
To authenticate you and keep your account secure.
To sync transactions from your bank when you connect one through Akahu.
To suggest transaction categories using AI (see OpenAI below).
To send transactional emails (password resets, email verification, notifications you opt into).
To send push notifications you have enabled.
To respond to support requests.

We do not use your financial data for advertising, profiling unrelated to the Service, or training our own machine-learning models.

3. Third-Party Services

We share data with the following processors only to the extent needed to provide the feature you use:

Akahu (bank syncing — New Zealand): when you connect a bank account, account information and transaction data are retrieved through Akahu's API. You can disconnect at any time, which revokes and deletes the connection credentials. Akahu Privacy Policy.
Google (Sign in with Google): if you choose Google sign-in, Google provides us your email address and profile name for authentication. Email/password sign-in is always available instead. Google Privacy Policy.
OpenAI (AI categorization and assistant): transaction descriptions and amounts are sent to the OpenAI API to generate categorization suggestions, and AI assistant messages are processed by OpenAI. Rule-based and manual categorization are available if you prefer not to use AI features. OpenAI Privacy Policy.
Email provider (Postmark/SMTP): your email address and notification content pass through our email delivery provider for password resets, verification, and notification emails.
Firebase Cloud Messaging (Google): if you enable push notifications in the mobile app, your device push token and notification payloads are processed by Firebase Cloud Messaging to deliver notifications. Firebase Privacy.

The Service does not include third-party analytics or telemetry inside the app; the marketing website at mymascada.com uses self-hosted, privacy-respecting analytics (Umami) that do not track you across sites.

4. Data Retention

Data class	Retention period
Financial transactions, balances, categories, budgets, rules	Retained while your account is active; deleted when you delete your account
AI chat messages	Automatically deleted after 90 days
Authentication tokens (refresh/password-reset)	Deleted 7 days after expiry or revocation
Akahu bank connection credentials	Retained while connected; revoked and deleted on disconnect or account deletion
Settings, preferences, and notifications	Retained while your account is active; deleted on account deletion
Security audit logs	Up to 2 years
Encrypted database backups	Up to 30 days

Automated daily cleanup jobs enforce the AI chat and token retention periods. Deleted data may persist in backups for up to 30 days before backups are rotated out.

5. Your Rights and Choices

Access and export: you can export your financial data at any time from within the app (CSV export).
Correction: you can edit your profile, transactions, and other data directly in the app.
Account deletion: you can delete your account from within the app (Settings → Account). Deletion removes your transactions, balances, categories, budgets, goals, rules, AI chat messages, notifications, preferences, and bank connection credentials.
Disconnect bank syncing: you can disconnect Akahu at any time; credentials are revoked and deleted.
Notifications: push and email notifications can be turned off in Settings or at the device level.

Depending on where you live, you may have additional rights under local data protection law (such as the New Zealand Privacy Act 2020 or the GDPR), including the right to complain to a supervisory authority. To exercise any right you cannot complete in-app, contact us at the address below.

6. Security

All traffic to the Service is encrypted with HTTPS/TLS. Passwords are stored as salted hashes, bank connection credentials are stored encrypted, and access to production systems is restricted. No method of transmission or storage is 100% secure, but we work to protect your data using industry-standard measures.

7. Children

The Service is not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from them.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page with a new effective date, and for material changes we will notify you in the app or by email.

9. Contact

Questions or requests about this policy or your data: support@mymascada.com.