Privacy policy

Summary

• Your financial records stay on your device. Without an account, gluvyn does not send them to any server.
• With an account, a copy is synced so you can use it on other devices.
• Crash reports help us fix errors and do not include your financial records.
• We do not show ads, do not sell data and do not track you across other apps or websites.

Data you enter

Bills, payments, income, salary, savings and investment goals, subscriptions and exchange rates you enter. This data is written to the app’s storage on your device. gluvyn does not connect to banks and does not read data from other apps.

Language and currency preferences stay on your device only.

The system’s own backups (iCloud on iPhone, Google backup on Android) may include the app’s data, depending on your device settings. These backups are made by Apple or Google, not by gluvyn.

Account and sync (optional)

When you sign in with Google or Apple, sign-in is handled by Clerk (Clerk, Inc., United States), which receives your name, email, profile picture and the account identifier provided by Google or Apple, plus technical session data, such as IP address and device type, used for security. With Apple, you can hide your email.

While signed in, the app sends a copy of your financial records to Supabase (Supabase, Inc.), on servers located in São Paulo, Brazil. The copy is linked to your account identifier and can only be read with your sign-in. We keep the ten most recent versions and technical receipts of each upload, to prevent data loss and duplicate uploads.

AI agents (optional)

If you connect an AI agent to the gluvyn MCP server (mcp.gluvyn.app), the agent asks for access through Clerk and you approve it with the same account you use in the app. The agent gets an access token, which gives no access to your Google or Apple account.

The agent's requests go through that server, which runs on Cloudflare (Cloudflare, Inc., United States) and reads or changes the synced copy in Supabase. The server does not store the content of the requests; Cloudflare keeps technical access logs, such as IP address, time and result, for a few days.

What the agent reads or records is also processed by the agent provider you chose (for example Anthropic, OpenAI, Cursor or GitHub), under its own privacy policy. gluvyn does not send your data to these providers on its own.

Crash reports

The app uses Firebase Crashlytics (Google LLC) to record crashes and errors. Each report includes the technical error trace, device model, system and app version, date and time and a random installation identifier. The app does not send your name, email, account identifier or financial records in these reports. Reports are kept for up to 90 days.

App updates

When it opens, the app checks the Expo update service (650 Industries, Inc., United States) to download fixes. The check includes the system, the app version and a technical installation identifier, and the service receives your IP address.

What we don’t do

• We do not show ads or use data for advertising.
• We do not sell or rent personal data.
• We do not use usage analytics or tracking tools.
• We do not access your bank account, cards or contacts.

Why we process data

Account, sync and AI agents: to provide the service you asked for (Brazilian LGPD, art. 7, V). Crash reports, sign-in security and updates: legitimate interest in keeping the app working and secure (art. 7, IX).

Sharing and international transfers

Data is processed only by the providers listed above, acting on our behalf, and when required by law. Clerk, Google and Expo may process data outside Brazil, under the safeguards in their contracts and policies.

How long we keep data

• Data on your device: until you delete it, clear the app’s data or uninstall it. Signing out does not erase the copy on the device. System backups follow Apple’s or Google’s rules.
• Account and synced copy: while the account exists. After a deletion request, they are erased within 30 days.
• Crash reports: up to 90 days.
• Backups kept by providers are erased in their own retention cycles.

Security

All communication uses an encrypted connection (HTTPS). In the cloud, each copy can only be read by the account that owns it. The app does not add its own password, biometrics or encryption to data on the device: protect your device with a screen lock.

Your rights

You can ask us to confirm processing, access, correct, port, anonymize or erase your data, ask with whom it is shared and withdraw consent. Write to support@gluvyn.app; we reply within 15 days. In Brazil, you can also file a complaint with the National Data Protection Authority (ANPD).

Age

gluvyn is intended for people 18 and older and does not knowingly collect data from children or teenagers.

This website

The gluvyn.app website does not use cookies, forms or analytics. It only stores your chosen language and theme in your browser. The site is served by Cloudflare, which processes your IP address to deliver the pages and protect them from attacks.

Changes

When this policy changes, the new version will be published on this page with its effective date.