Privacy Policy

1. Introduction

Shapital ("we", "our", or "us") is a personal finance and budget management application that helps you track expenses, manage budgets, set financial goals, and collaborate with family and friends on shared budgets. This Privacy Policy applies to all users of our mobile application available on iOS and Android platforms.

By using Shapital, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our application.

2. Information We Collect

2.1 Personal Information

We collect the following personal information when you create an account and use our services:

• Account Information: Email address, name, and password (stored only as a bcrypt hash, never in readable form)
• Profile Information: Profile picture, display name, and user preferences
• Contact Information: Email address for account recovery and important notifications

2.2 Financial Information

To provide budget management services, we collect:

• Budget Data: Budget names, categories, amounts, periods, and status
• Transaction Data: Income and expense entries, category assignments, dates, and descriptions
• Financial Goals: Savings targets, goal descriptions, target dates, and progress tracking
• Category Information: Custom and system-provided budget categories with spending limits
• Historical Data: Budget trends, spending patterns, and financial analytics

2.3 Collaboration Data

When you use our budget sharing features:

• Collaboration Information: Shared budget relationships, collaborator permissions, and invitation tokens
• Activity Feed: Budget modifications, collaborator actions, and timestamps
• Communication Data: Real-time updates and notifications between collaborators

2.4 Usage and Analytics Data

We automatically collect certain information about how you use Shapital:

• App Usage: Features accessed, screens viewed, actions performed, and session duration
• Device Information: Device type, operating system version, unique device identifiers, and app version
• Performance Data: Crash reports, error logs, and app performance metrics
• Analytics: Feature usage statistics, user engagement patterns, and aggregated usage trends

2.5 Gamification Data

When you use our gamification features:

• Achievement Data: Earned badges, completed challenges, and milestones
• Streak Information: Daily usage streaks and consistency tracking
• Progress Tracking: Challenge participation and completion status

2.6 Notification Data

• Push Notification Tokens: Device tokens for sending notifications via Expo Push Notification service
• Notification Preferences: Your choices for notification types, frequency, and delivery times
• Notification History: Sent notifications and their status

2.7 Subscription and Payment Data

For premium subscriptions processed through RevenueCat:

• Subscription Status: Active/inactive status, subscription tier, and renewal dates
• Transaction Events: Purchase confirmations, renewals, cancellations, and refunds
• Payment Information: Handled exclusively by Apple App Store and Google Play Store; we do not collect or store credit card information

2.8 Local Device Storage

• Offline Data: We use SQLite and AsyncStorage on your device to enable offline functionality
• Cache Data: Temporary storage of app data for performance optimization
• User Preferences: App settings, theme preferences, and personalization choices

3. How We Use Your Information

3.1 To Provide Our Services

• Create and manage your account
• Enable budget creation, tracking, and management
• Facilitate budget collaboration and sharing
• Provide financial insights, analytics, and reports
• Generate PDF and Excel exports of your budget data
• Deliver gamification features like badges and challenges
• Sync your data across devices
• Provide help center articles and customer support

3.2 To Communicate With You

• Send account-related notifications (budget limits, goals achieved)
• Deliver collaboration invitations and activity updates
• Send subscription renewal reminders and payment confirmations
• Provide customer support responses
• Send important service updates and security alerts

3.3 To Improve Our Services

• Analyze usage patterns to enhance app features
• Monitor and analyze performance metrics
• Detect and fix bugs and technical issues
• Conduct research and development for new features
• Generate aggregated, anonymized analytics

3.4 For Security and Fraud Prevention

• Protect against unauthorized access to your account
• Detect and prevent fraudulent activities
• Verify subscription purchases and prevent abuse
• Maintain the security and integrity of our services

4. How We Share Your Information

4.1 With Your Consent

We share your budget data with other users only when you explicitly invite them to collaborate on a specific budget. Collaborators can only access budgets you've shared with them based on the permission level you grant (view or edit).

4.2 With Service Providers

We share information with trusted third-party service providers who help us operate our services:

4.3 For Legal Compliance

We may disclose your information if required to do so by law or in response to:

• Valid legal requests from law enforcement or government authorities
• Court orders, subpoenas, or other legal processes
• Protection of our legal rights or defense against legal claims
• Prevention of fraud, security threats, or illegal activities

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you via email and/or prominent notice in the app before your information becomes subject to a different privacy policy.

4.5 Aggregated and Anonymized Data

We may share aggregated, anonymized data that cannot identify you personally for research, marketing, or analytics purposes. This includes general trends like "average number of budgets per user" or "most popular budget categories."

5. Data Storage and Security

5.1 Where We Store Your Data

Your data is stored on secure servers. All data transmission between your device and our servers is encrypted using industry-standard SSL/TLS protocols (HTTPS). Data at rest is not currently encrypted at the database level; it is held on access-controlled servers. See the security measures below.

5.2 Security Measures

We implement multiple layers of security to protect your information:

• Encryption in transit: every connection between the app and our servers uses HTTPS/TLS
• Password storage: passwords are hashed with bcrypt and are never stored, logged or recoverable in readable form
• Two-factor authentication: available on your account, with recovery codes
• Rate limiting: sign-in and other sensitive endpoints are throttled to slow down automated attacks
• Access controls: access to production data is limited to the developer who operates the service
• Automated tests and error monitoring: the test suite runs on every change, and faults are reported to Sentry so they are noticed and fixed
• Encryption at rest: we do not currently apply database-level encryption at rest, and would rather say so than imply otherwise. Your data is held on access-controlled servers, and the app never asks for or receives bank logins, card numbers or account access — so the most sensitive thing we hold is the figures you enter yourself

5.3 Local Storage

Some data is stored locally on your device using SQLite and AsyncStorage for offline functionality and performance. This local data inherits the security protections of your device (such as device encryption and biometric locks if enabled).

5.4 Data Retention

We retain your data for as long as your account is active or as needed to provide services:

• Active Accounts: Data retained indefinitely while your account is active
• Deleted Accounts: Data deleted within 30 days of account deletion, except where retention is required by law
• Backup Data: Backup copies deleted within 90 days of account deletion
• Legal Requirements: Some data may be retained longer to comply with legal obligations

6. Your Rights and Choices

6.1 Access and Update

You can access and update your personal information at any time through the app:

• View and edit your profile information in Settings
• Manage your budgets, categories, and transactions
• Update notification preferences
• Modify collaboration settings

6.2 Data Export

You can export your budget data in PDF or Excel format at any time using our built-in export features. This allows you to maintain personal copies of your financial information.

6.3 Account Deletion

You can delete your account at any time through the app settings. When you delete your account:

• All your personal information will be permanently deleted
• Your budgets and financial data will be removed
• Shared budgets will remain accessible to other collaborators, but your association will be removed
• Subscriptions will be canceled (refunds subject to App Store/Play Store policies)
• Deletion is permanent and cannot be undone

6.4 Notification Preferences

You can control notification settings in the app, including:

• Budget limit alerts
• Collaboration notifications
• Goal achievement notifications
• Gamification updates
• Marketing communications (if applicable)

6.5 Your Legal Rights (POPIA, GDPR, CCPA)

We operate from South Africa, so the Protection of Personal Information Act (POPIA) applies to how we handle your data wherever you are. Depending on where you live you may also have rights under the GDPR or the CCPA. In practice we extend the following to everyone rather than tracking who is entitled to what:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate personal data
• Right to Erasure: Request deletion of your personal data
• Right to Restriction: Limit how we use your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing of your data
• Right to Opt-Out: Opt-out of sale of personal information (we do not sell your data)

7. Children's Privacy

Shapital is not intended for use by children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately, and we will delete such information from our systems.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. When we transfer your data internationally, we ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy.

9. Third-Party Links and Services

Our app may contain links to third-party websites or integrate with third-party services (such as help articles or external resources). This Privacy Policy does not apply to those third-party services. We are not responsible for the privacy practices of other websites or services. We encourage you to read their privacy policies before providing any information.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes:

• We will update the "Last Updated" date at the top of this policy
• For material changes, we will notify you via email or prominent in-app notification
• Continued use of the app after changes constitutes acceptance of the updated policy
• We encourage you to review this policy periodically

11. Data Breach Notification

In the unlikely event of a data breach that affects your personal information, we will:

• Notify you as soon as reasonably possible, and without undue delay where the breach is likely to put you at risk
• Notify the relevant authorities, including South Africa's Information Regulator, within the time limits the law requires
• Provide details about what information was affected
• Explain the steps we're taking to address the breach
• Provide guidance on how you can protect yourself

12. Contact Us

13. Consent

By using Shapital, you consent to the collection, use, and sharing of your information as described in this Privacy Policy. If you do not agree with this policy, please do not use our services.