Monetary Mind

Privacy Policy

Last updated: 2026-06-14

Data Controller

Gunnar Maschke, c/o COCENTER, Koppoldstr. 1, 86551 Aichach, Germany. Email: support@monetarymind.app

Purpose of Data Processing

Monetary Mind processes personal data solely to operate the personal finance software — including bank account synchronisation via GoCardless (PSD2) and the provision of rule-based coach insights. No data is sold and no external AI models are trained on your data.

Legal Basis

Processing is based on Art. 6(1)(b) GDPR (performance of a contract) for account management and bank connectivity, Art. 6(1)(c) (legal obligation) for statutory retention requirements, and Art. 6(1)(f) (legitimate interests) for the secure operation of infrastructure and fraud prevention.

Categories of Data Processed

Account data: email address, password hash (scrypt, via Better-Auth — the plaintext password is never stored). If you enable optional two-factor authentication, we additionally store a TOTP secret and backup codes. Transaction data: amount, date, category, description, and — for connected accounts — account transactions imported via GoCardless. Bank connection tokens: AES-256-GCM encrypted; plaintext never stored in the database or logs. Technical data: IP address, browser information, session identifier. Security log (audit log): security-relevant events such as sign-ins and sign-outs, with timestamp, IP address, and user agent, for fraud prevention (Art. 6(1)(f) GDPR).

Hosting and Infrastructure

The application runs on Vercel (server location Frankfurt, EU). The database runs on Neon Database (server location Frankfurt, EU). No data is transferred to third countries outside the EU. Sensitive bank connection tokens are secured with app-layer encryption (AES-256-GCM) before being stored in the database.

App-Layer Encryption

Bank connection tokens are encrypted with AES-256-GCM before being stored in the database. The encryption key is held exclusively as an environment variable and never appears in the database or logs. Neither Vercel nor Neon has access to the plaintext.

Third-Party Processors

GoCardless Ltd. (PSD2 bank data aggregation): Required for connecting bank accounts via Open Banking. GoCardless operates within the EU/UK regulatory framework and processes data in accordance with PSD2.

Matomo Analytics (Matomo Cloud EU): Used for anonymised usage analytics. IP anonymisation is active. No tracking cookies are set without explicit consent. No data sharing with third parties.

Web Push Notifications: When you enable push notifications, a subscription endpoint is transmitted to your device's browser push service (Google FCM for Chrome/Android, Apple Push Notification Service for Safari/iOS, Mozilla Push Service for Firefox). The endpoint is stored encrypted in our database and used solely to deliver Monetary Mind notifications. You can disable push notifications at any time in Settings.

Lemon Squeezy (payment processing): Paid subscriptions are processed via Lemon Squeezy LLC (Merchant of Record). Your payment data is transmitted exclusively to Lemon Squeezy, not to Monetary Mind. Lemon Squeezy is PCI-DSS compliant. As a US provider, the transfer is based on the EU Standard Contractual Clauses (Art. 46 GDPR). More information: lemonsqueezy.com/privacy.

Mailjet (transactional email): For security-relevant system emails — confirming your email address and resetting your password — your email address is transmitted to Mailjet (Sinch group, server location EU/France) as a processor under Art. 28 GDPR. Only such system emails are sent; no advertising and no newsletters.

Market and price data: For securities, crypto, and exchange rates, Monetary Mind queries public price services (including Yahoo Finance, Frankfurter/ECB, DIA, Binance). These lookups are performed server-side using only security or currency symbols — no personal data and not your IP address are transmitted to these services.

Data Retention

  • Account data: You request deletion of your account yourself in the settings (re-authentication with your password required). After the request, a 30-day window applies during which you can cancel the deletion at any time; thereafter your account data is irreversibly erased. Merely cancelling a subscription without requesting deletion only downgrades your account to the free tier — your data is retained in that case.
  • Transaction data: retained until manually deleted by the user or until account deletion.
  • Technical logs: maximum 30 days, then automatically deleted.
  • Security log (audit log): security-relevant events are retained for a maximum of 30 days. The deletion records of an account deletion (requested, cancelled, executed) deliberately survive the account deletion for up to 30 days as an accountability record under Art. 5(2) GDPR.
  • Consent record (ConsentLog): the timestamp, consent type, and policy version are stored separately as proof of consent under Art. 7(1) GDPR, retained longer than the 30-day technical-log window. This record is deliberately preserved after account deletion, as it documents the legal basis of the original processing.

Your Rights

Under the GDPR, you have the following rights:

  • Art. 15 — Right of access to your personal data
  • Art. 16 — Right to rectification of inaccurate data
  • Art. 17 — Right to erasure ("right to be forgotten")
  • Art. 18 — Right to restriction of processing
  • Art. 20 — Right to data portability (export all personal data as JSON/CSV directly in the app)
  • Art. 21 — Right to object to certain processing
  • Art. 77 — Right to lodge a complaint with the supervisory authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach, Germany

For access requests or erasure requests: support@monetarymind.app

Data Portability

You can export all your personal data at any time as JSON or CSV directly in the app (Art. 20 GDPR). No support ticket required, no waiting time. The export function is available in the app's settings.

Cookies

Monetary Mind uses only technically necessary session cookies for authentication and anonymised analytics cookies via Matomo (only after explicit consent). No advertising tracking. See the Cookie Policy for details.

Privacy Contact

For privacy-related inquiries, contact: support@monetarymind.app

← Back to home