Privacy Policy
Effective 30 September 2026
This policy explains what personal data Budget Buddy handles. The Service is run by an individual based in Sri Lanka, who is the controller of your data. We aim to follow the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka.
What we collect
- Account data: your email address and name, provided when you sign up with email or with your Google account.
- Financial records you enter: accounts, transactions, subscriptions, loans, categories, attachments and images you upload.
- Preferences: primary currency, theme and time zone.
- Technical data: standard server and security logs (such as IP address and request time) kept by our hosting providers.
We do not use advertising trackers or analytics scripts on this website or in the app.
Why we use it
- To provide the Service: sign-in, storing and showing your records, statistics and reports.
- To send the month-end email, only if you opt in. It says your report is ready and never contains amounts.
- To keep the Service secure and fix problems.
Where it is stored and who processes it
We use Amazon Web Services (AWS) to host the Service: Amazon Cognito for sign-in, DynamoDB and S3 for data and files, and Amazon SES to send email. AWS acts as our processor. Signing in with Google is handled by Google under its own privacy policy. Data is stored in AWS data centres in the United States (us-east-1), so it is transferred outside Sri Lanka.
Emails you send us
If you write to info@budgetbuddy.space, the message is received by Amazon SES, kept in a private store for 30 days, and forwarded to the operator's mailbox so we can reply. Do not send passwords or full account numbers by email.
Sharing
We do not sell your data or share it for advertising. We share it only with the processors above, when the law requires it, or when you choose to share something (for example a lending card).
Retention and deletion
We keep your data while your account is open. Email info@budgetbuddy.space from your account address to have your account and its data deleted. Backups and logs are removed on their normal cycle.
Your rights
You may ask to access, correct, export or delete your personal data, to withdraw consent, and to complain to the Data Protection Authority of Sri Lanka. Contact us to exercise these rights.
Cookies and local storage
This website sets no cookies. The app stores sign-in tokens and preferences in your browser so you stay signed in and keep your settings.
Security
Data is encrypted in transit and at rest and access is restricted. No system is perfectly secure, so please use a strong, unique password.
Changes
We will post updates here with a new effective date.