The data controller is Ingeniería Steve, NIT 78654565, Colombia. Privacy and support channel: zorvune@gmail.com.
Caudalia is a personal expense tracker. We are not a bank, a payment processor, a financial institution supervised by the Colombian Financial Superintendency, nor do we operate financial or credit databases under Law 1266 of 2008. We process only your account data — we never receive your financial records.
Your incomes, expenses, limits and corrections are stored inside your own browser, on your device. They are not sent to our servers to be stored, to calculate your balance, or to classify your spending.
| Data | Purpose | State |
|---|---|---|
| Email address | Identify your account, confirm it, write to you | Plain (needed to sign in) |
| Password | Protect your account | Only its scrypt derivation; never the password |
| Chosen language | Send emails in your language | Plain |
| Plan and trial/payment dates | Know whether your subscription is active | Plain |
| IP address, date/time, user agent | Rate limiting, anti-abuse, diagnostics | Technical logs, rotated at 50 MB |
| Payment events | Verify webhooks, prevent double activation | No financial data |
Never reaches us: your amounts, descriptions, categories, limits, your voice audio, your contacts, your location, account or card numbers, or the content of your emails.
By creating an account you authorise the processing described here under article 9 of Colombian Law 1581 of 2012 and Decree 1377 of 2013. You may withdraw it at any time (section 12); without an account we cannot maintain your licence or subscription.
No system is infallible. If an incident affects your account data, we will inform you and report to the authority where required.
| Third party | What it receives | Purpose | Location |
|---|---|---|---|
| Google Cloud (infrastructure) | Account data and technical logs | Hosting the server side | United States |
| Wompi (payment gateway) | Email, amount, payment reference | Processing your subscription | Colombia |
| Google (transactional email) | Your email and the message text | Sending confirmations and notices | United States |
They act as processors under our instructions and may not use the information for their own purposes. Wompi never receives your expenses, your balance or your backup.
It will let you restore your data on another device. It will be stored encrypted with your key, in a block we cannot read, and will be possible to disable from Settings; disabling it deletes the block from our servers. If you do not use it, your data lives only on your device and cannot be recovered if you lose it. Current status: not enabled for anyone.
Our infrastructure and transactional email are in the United States (Google Cloud, us-central1). This involves an international transfer from Colombia of the data in section 3 — never of your unencrypted financial information, because we do not hold it. By accepting this policy you authorise that transfer, informed of the destination, the processors and the fact that the sole purpose is hosting and operating the service. You may object by not using the app or by requesting deletion of your account.
| Data | Retention |
|---|---|
| Account (email, hash, plan) | While the account exists |
| Accounts created but never confirmed | Deleted after 7 days |
| Confirmation and reset links | Expire after 24 hours, single use |
| Session cookie | 30 days since last sign-in |
| Access logs | Rotated at 50 MB; 3 files kept |
| Payment records | As required by tax and accounting rules (minimum 5 years) |
No soft delete: what you delete on your device is deleted; what you delete in your account is deleted on our server.
At any time and free of charge you may:
In writing: zorvune@gmail.com, stating your account email and the right you are exercising. We answer requests within 10 business days and complaints within 15 business days (extendable by 8 business days with stated reasons), in line with articles 14 and 15 of Decree 1377 of 2013.
Because your data lives on your device, the first backup is yours. We recommend exporting monthly and storing the recovery code somewhere safe. We are not liable for loss caused by clearing your browser, using private mode, uninstalling the app or losing your device.
The app is available in Spanish and English, and this policy is published in both languages. For users in Colombia, the Spanish version prevails.
If you use Caudalia from another country, this policy and the Colombian rules that govern us apply. If you are in the European Union, you may also exercise the GDPR rights of access, rectification, erasure, portability and objection by writing to the channel in section 12; your financial data never leaves your device, so our exposure is limited to the data in section 3.
Caudalia is not intended for anyone under 18. We do not knowingly collect their data. If we detect an account belonging to a minor without parental authorisation, we delete it.
Descriptions are yours: writing "lent Juan 50" means you are entering someone else's information, and you are responsible for having authorisation. Recommendation: describe the expense, not the person ("loan to a relative" instead of a name).
If a change is substantial (new purposes, new third parties, a new hosting country, backup enabled by default), we publish the new version and email you before it takes effect. Minor changes only update the revision date.
Effective October 25, 2026 (version 1.2). Version 1.0 of the same date stored movements on the server; it was superseded the same day and its financial records were deleted on October 25, 2026 when the storage tables were removed. No user data was migrated.