Privacy Policy
Last updated: 23 August 2026
What we collect
Your account: an email address, a password (stored only as a hash; we cannot read it), and an optional display name. Your records: the expenses, budgets, subscriptions, debts, contacts, keywords and feedback you create in Gestilo, including the original text you typed or spoke when capturing an expense. Contacts in Gestilo are names you type in yourself. We never read your phone’s address book.
AI processing
When you capture an expense with AI, by typing a sentence or recording your voice, that text or audio is sent to our server and passed to OpenRouter, a third-party AI service, to be turned into a transcript and structured expense records. We keep the resulting records and the original text; we do not keep the audio after it has been transcribed. We also record per-account usage counts (requests and tokens) to manage cost and abuse. AI providers process this data under their own policies; we send them only what you said, never your email or identity. Manual entry involves no AI and works entirely offline.
What stays on your device
Your VietQR payout details (bank and account number) are stored only in your phone’s secure storage and are never sent to our servers. QR codes are generated on the device. Reminders and notifications are scheduled locally on your phone; we run no push-notification service. A local copy of your records lives on your device so the app works offline.
How we use your data
To run Gestilo: syncing your records between your devices and the web app, showing your budgets and summaries, and posting your subscriptions on schedule. That is the whole list. We do not sell your data, we do not show ads, and the apps contain no advertising or analytics trackers.
Storage, security and sharing
Records sync to our server and are stored in a managed database hosted on Railway. Traffic between the app and our servers is encrypted with HTTPS. We use Sentry for server error monitoring, which may process technical request metadata (such as IP addresses) when something breaks. These providers, Railway (hosting), OpenRouter (AI), Sentry (error monitoring), are the only third parties that touch your data, and only to provide the service.
Deleting your account
You can delete your account at any time from the Me screen in the app or on the web. Deletion is immediate and permanent: your account and every record attached to it (expenses, budgets, debts, subscriptions, keywords and feedback) are erased from our servers, and the app erases its copy on the device you delete from. There is no recovery period. Export your data first if you want to keep a copy. If you are signed in on another device, that device is signed out the next time it reaches us, and its saved sign-in and payment details are removed, but the records already downloaded to it stay on that device until you delete the app from it.
Your choices
You can use manual entry only and never send anything to the AI. You can export your data from the app before deleting. You can correct or delete any individual record at any time. If you want a copy of the personal data we hold about you, or want it corrected or erased, email us and we will do it.
Changes to this policy
If we change what we collect or how we use it, we will update this page and change the date above before the change takes effect.
Contact
Questions about your data: [email protected]. We answer.