Numio
Numio Privacy Policy
Last updated: 15 November 2026
Numio is a personal finance app. This policy explains what data it handles, why, who else sees it, and what you can do about it. The short version: Numio keeps the data you type in so the app can show it back to you. It has no ads, no analytics and no tracking, and it does not sell your data.
Who is responsible
The data controller is Guillem Alba Payà, Barcelona, Spain. Contact: numio@gxlm.dev.
What data Numio handles
Your account
- Email address, display name, base currency (EUR or USD) and app language.
- Your password. It is never stored as typed: the server keeps only a salted Argon2id hash.
The financial data you enter
- Your accounts: name, type, opening balance and, optionally, the bank name.
- Your transactions and transfers: amount, date, category and, optionally, a note.
- Your budgets: the amount you plan to spend per category and month.
Numio does not connect to your bank and never asks for your bank credentials.
Technical data
- Our hosting provider (Google Cloud) keeps standard request logs: time, request path, response status and the IP address of the device. They are used only for security and to keep the service running. Numio's own logs record only the method, path, status and duration of a request; they do not contain request bodies, passwords, tokens or amounts.
On your device
- Your session tokens, encrypted with a key held in the Android Keystore.
- A cached copy of your accounts, transactions and budgets so the app works with a poor connection.
- Your language choice.
Android's automatic app backup is turned off for Numio, so this cache is not copied to Google Drive.
What Numio does not collect: your location, contacts, photos, microphone, camera, advertising ID or other device identifiers. This version contains no analytics, advertising or crash-reporting libraries.
Why the data is used, and the legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Create your account and sign you in | Email, password hash, display name | Performance of the contract (art. 6.1.b) |
| Store and show your finances | Accounts, transactions, budgets, currency, language | Performance of the contract (art. 6.1.b) |
| Keep the service secure and working | Request logs, rate-limit counters | Legitimate interest (art. 6.1.f) |
Your data is not used for advertising, profiling or automated decisions, and it is not used to train any model.
Who else handles your data
Numio uses two service providers that process data on its behalf, under data processing agreements. They may not use your data for their own purposes.
- Google Cloud (Google LLC) runs the Numio server in Belgium (region europe-west1) and keeps the request logs.
- Neon (Neon, Inc.) hosts the database in Frankfurt, Germany, on Amazon Web Services infrastructure.
Your data is stored in the European Union. Both providers are United States companies, so their staff or sub-processors may access it from outside the European Economic Area, for example for support or maintenance. Those transfers are covered by the EU-U.S. Data Privacy Framework, to which both companies are certified, and by the European Commission's Standard Contractual Clauses included in their data processing agreements.
Numio does not sell your data and does not share it with advertisers or data brokers. It may be disclosed if a law or a court order requires it.
How long it is kept
Your data is kept while your account exists. When you delete the account, your account, accounts, transactions and budgets are removed from the database immediately. Two technical copies expire on their own afterwards:
- The database provider keeps a rolling change history so the database can be restored after an incident. It currently covers 6 hours.
- Request logs are kept for 30 days. They do not contain your financial data.
After those periods no copy remains.
Your rights
Under the GDPR you can ask to access, correct, delete or restrict your data, to receive a copy of it in a portable format, and to object to its processing.
- Delete your account and data: in the app, Settings, Delete account. See https://numio.gxlm.dev/delete-account.
- Anything else (a copy of your data, a correction, a question): write to numio@gxlm.dev. The app does not have a data export yet, so a copy is prepared manually. We answer within one month.
- Complaints: you can complain to your data protection authority. In Spain that is the Agencia Española de Protección de Datos (https://www.aepd.es).
Security
- Traffic between the app and the server is encrypted (HTTPS only).
- Passwords are hashed with Argon2id. Session tokens are short-lived and rotate on use; a reused token ends all sessions.
- Each user's data is isolated: the server only returns rows that belong to the signed-in account.
- Deleting an account needs your password, and failed attempts are rate limited.
No system is perfectly secure. If a breach affects your data we will notify you and the authority as the law requires.
Minimum age
You must be at least 14 years old to use Numio. We do not knowingly collect data from younger people; if you believe a child under 14 has created an account, write to us and we will delete it.
Changes
If this policy changes in a way that matters, we will update the date above and tell you in the app.
Contact
Guillem Alba Payà, Barcelona, Spain. numio@gxlm.dev.