Privacy policy
Last updated: 2 October 2026
Fiboka is a budgeting app for families. This page explains what data we keep, why, for how long and what rights you have. In short: your family’s data belongs to your family. We don’t show ads, we don’t sell data and we don’t use it for anything other than running the app.
Who is responsible
Pixel Ventures S.R.L.
contact@fiboka.com
For any question about your data, or to exercise your rights, write to us at contact@fiboka.com.
What we keep
- Parent accounts: email address, name, password (only as a fingerprint it cannot be rebuilt from) and the secret for the phone code (encrypted).
- Family members: their names, role (parent or kid) and, for kids, the password set by a parent (only as a fingerprint).
- What you enter: transactions, envelopes, budgets, goals, shopping lists, plans, wishes, family bank activity and the pictures you upload (such as receipts).
- Technical data: a session cookie, needed to keep you signed in, and your IP address, used only to stop repeated password guessing. We use no analytics or advertising cookies.
- Public wishlist links: someone who opens a wishlist link and reserves a gift may leave a name (optional). The reservation is remembered in their browser, not in an account.
Why we keep it
- To run the app for your family — the legal basis is our contract with you (Art. 6(1)(b) GDPR).
- To protect accounts and the service (attempt limits, security logs) — our legitimate interest (Art. 6(1)(f) GDPR).
Kids
Kids’ accounts are created and managed by a parent, who decides what data to enter about them. Kids see only their own money. We don’t ask kids for an email address and we never contact them.
Who else has access
- A hosting provider, whose servers run the app in the European Union. It does not use the data for anything else.
- Backups are made daily, encrypted, and also kept in the European Union.
- AI receipt reading is optional and only works if the family adds its own Google Gemini key. In that case the receipt photo is sent to Google through the family’s own account, under Google’s terms.
We don’t share data with anyone else, except where the law requires it.
How long we keep it
For as long as the family account is active. If you ask us to delete it, we delete it within 30 days. Encrypted backups rotate automatically and are gone within 12 months at most.
How we protect it
- All communication between your device and the server is encrypted (HTTPS).
- Parents sign in with a password and a code from their phone.
- Each family’s data is kept separately from everyone else’s.
- Backups are encrypted.
Your rights
You have the right to know what data we hold about you, to correct it, to delete it, to receive it in a format you can use elsewhere, to restrict processing and to object to it. Write to contact@fiboka.com and we’ll reply within one month.
If you believe we haven’t met our obligations, you can complain to the Romanian data protection authority, ANSPDCP (www.dataprotection.ro), or to the authority in your own country.
Changes
If we make an important change to how we use data, we’ll tell you in the app before it takes effect.