Privacy & Cookie Policy

1. Our Privacy Commitment

At BucketBudget, we believe that your financial planning data is private. This application is designed as a secure, personal wealth stewardship environment. We are committed to protecting your privacy in full compliance with the European General Data Protection Regulation (GDPR) and the ePrivacy Directive.

2. Information We Collect

We only collect the minimum amount of data required to provide you with secure personal finance services:

• Account details: Your name and email address. If you register with a password, it is stored only as a secure bcrypt hash.
• Google sign-in: If you sign in with Google, we receive your name, email address, and profile picture from your Google account.
• Financial Records: Budgets, subcategory structures, spending logs, asset portfolios, and snapshots manually provided by you. We claim no ownership over this data; it remains exclusively yours.

3. Google User Data

When you sign in with Google, we request only the basic openid, email, and profile scopes. We do not access your Gmail, contacts, Drive, calendar, or any other Google data.

• We use your Google name, email address, and profile picture only to create your BucketBudget account, sign you in, and show your name and picture inside the app.
• We do not sell Google user data, share it with third parties, or use it for advertising, and we do not use it to train artificial intelligence or machine learning models.
• BucketBudget's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• You can revoke BucketBudget's access at any time from your Google Account permissions page.

4. How We Use Cookies

This website does not use any non-essential cookies, analytics, marketing pixels, or tracking technologies. We only deploy strictly necessary, functional cookies exempt from consent:

• Session Cookie (authjs.session-token): An essential session identifier to securely authenticate your account as you navigate the dashboard.
• Security Cookie (authjs.csrf-token): A strictly necessary cookie to defend against Cross-Site Request Forgery (CSRF) attacks.
• Locale Cookie (NEXT_LOCALE): A functional preference cookie used to store and apply your selected language preference (English, French, or Italian).
• Preference Cookies (selectedYear, sidebar_state): Functional cookies that remember the budget year you are viewing and whether the sidebar is open.

5. Data Sharing & Selling

We do not share, rent, sell, trade, or distribute your personal details or financial records to third-party marketing networks, commercial agencies, or analytics brokers. We rely only on the service providers needed to run the app: our hosting and database infrastructure, and an email delivery provider used to send verification codes and account emails. They process data on our behalf and only for that purpose.

6. Data Security

We use industry-standard security protocols to protect your credentials and data. All communication is encrypted over secure HTTPS, database passwords are cryptographically hashed, and user sessions are governed by secure JWT authentication.

7. Your Rights & Control

As a European resident or mindful privacy steward, you possess full GDPR-backed rights over your data. At any time inside your dashboard, you can:

• Access, modify, or export your full transaction ledger and portfolios.
• Delete individual entries, budgets, or snapshots.
• Request permanent, irrevocable deletion of your account and all associated records.

8. Contact

For any privacy question or to exercise your rights, write to us at support@bucketbudget.me.