Privacy Policy
Last updated: 2026-07-20
Halvy is built and operated by Alessandro Nicoli, Switzerland (the “Operator,” “we”). This policy explains what data we collect, why, and your rights under GDPR (EU) and the Swiss FADP.
1. Summary
- We store the expense data you create in the app. That's the product.
- We collect anonymous crash reports so we can fix bugs.
- We do not sell data, run ad trackers, or send your data to brokers.
- Your data lives on EU servers and you can delete it at any time.
2. Data Controller
Alessandro Nicoli
Zürcherstrasse 53b
8104 Weiningen, Switzerland
Email: info@halvyapp.com
3. What we collect & why
Account data
When you sign up we store your email address and a hashed password. We use this to authenticate you and to recover your account. Lawful basis: Contract (GDPR Art. 6(1)(b)).
Expense data
Every expense, split, group, and settlement you create is stored so the app can show it back to you and to your group members. Lawful basis: Contract.
Receipt scanning (planned Pro feature)
Receipt OCR is a planned Pro feature and is not yet available— today the app collects no receipt images and performs no OCR. We'll update this policy to describe exactly how any receipt images and extracted data are processed and stored before the feature is switched on.
Crash reports
When the app crashes we send an anonymous report (stack trace, device model, OS version, app version) to Sentry. We scrub identifying fields before the event leaves the device: your email, username, and any Authorization headers never reach Sentry. Sentry is hosted in the EU. Lawful basis: Legitimate interest in fixing bugs (GDPR Art. 6(1)(f)). You can opt out by uninstalling the app.
Website analytics
Our marketing website (halvyapp.com) uses Umami, a privacy-focused, cookieless analytics tool, to count page views and referrers in aggregate. Umami sets no cookies, does not collect data that identifies you personally, and does not track you across other websites. The Halvy app itself contains no analytics. Lawful basis: Legitimate interest in understanding site traffic (GDPR Art. 6(1)(f)).
What we don't collect
- No advertising identifiers (IDFA / GAID).
- No third-party analytics SDKs in the app (no Mixpanel, no Amplitude, no GA).
- No precise location.
- No address book / contacts.
- No microphone or camera access.
4. Where the data is stored
Your account and expense data are stored on our PocketBase instance hosted on a VPS in Germany. Backups are encrypted at rest and never leave the EU.
5. Sub-processors
| Provider | Purpose | Region |
|---|---|---|
| Hetzner Online GmbH | Server hosting (database, API) | EU (Germany) |
| Sentry GmbH | Anonymized crash reports | EU |
| Apple Inc. | App Store purchases | Apple's applicable region (see Apple privacy policy) |
| Cloudflare, Inc. | DNS & static asset delivery for halvyapp.com | Global edge |
| Umami (self-hosted) | Cookieless website analytics (halvyapp.com) | EU (Germany) |
6. How long we keep your data
Account and expense data are kept until you delete your account or request deletion. Crash reports are auto-deleted after 90 days. Backups are kept up to 30 days.
7. Your rights (GDPR / FADP)
- Access: request a copy of all data we hold about you.
- Rectification: correct anything inaccurate.
- Erasure: delete your account in-app, or email us. We will delete within 30 days.
- Portability: request your expense data as JSON.
- Objection / withdrawal: opt out of crash reports by uninstalling the app.
- Complaint: lodge a complaint with the Swiss FDPIC (Switzerland) or your national EU data protection authority.
To exercise any of these: info@halvyapp.com.
8. Children
Halvy is not directed at children under 13 and we do not knowingly collect their data. If you believe a child has signed up, email us and we'll delete the account.
9. Changes
We'll post material changes on this page and, where required, notify you in-app. Continued use after a change means you accept the updated policy.
10. Contact
Questions? info@halvyapp.com