Privacy Policy
As of: July 2026
1. Controller
Pascal Mielke
Almastraße 73, 45886 Gelsenkirchen, Germany
Email: kontakt@flobudget.eu
FloBudget is operated under the brand name Adam Grand.
2. Data Collected and Purpose
- Registration: Email address and password (bcrypt-hashed). Purpose: account access and authentication. Legal basis: Art. 6(1)(b) GDPR.
- Financial data: Transactions, categories, savings goals and imported bank statements you enter. Purpose: provision of the service. This data is assigned exclusively to your account and is not analysed or shared. Legal basis: Art. 6(1)(b) GDPR.
- Technical data: IP address and access time in the server log (max. 14 days). Purpose: security and error diagnosis. Legal basis: Art. 6(1)(f) GDPR.
- Two-factor authentication (optional): TOTP secret and passkey credentials. Purpose: enhanced account security. Legal basis: Art. 6(1)(b) GDPR.
- Google login (optional): If you sign in with your Google account, FloBudget receives your name, email address and a unique Google user ID (Google Account ID). This data is used exclusively to create and manage your account. No further Google profile data is retrieved. Legal basis: Art. 6(1)(b) GDPR.
- Payment data (Pro plan): When taking out a paid subscription, payment data (e.g. credit card details) is transmitted directly to the payment service provider Stripe and processed there. FloBudget does not store complete payment data; only anonymised payment references (Stripe Customer ID) are stored. Legal basis: Art. 6(1)(b) GDPR.
- Email verification: After registration, a confirmation email with a verification link is sent. Purpose: ensuring the validity of the email address provided. The link is valid for 24 hours. Legal basis: Art. 6(1)(b) GDPR.
- Support requests (in the app): Username, email address, subject and message text. Purpose: processing your support request by administrators. The data is deleted after processing in accordance with statutory retention obligations.
- Contact requests (flobudget.eu/kontakt): Name, email address, subject and message text. Purpose: processing your enquiry. The transmission is encrypted via HTTPS. The data is forwarded by email, not permanently stored in a database, and deleted after processing in accordance with statutory retention obligations.
3. Legal Bases
Data processing is carried out on the following legal bases:
- Art. 6(1)(b) GDPR (performance of contract): account, login, provision of service, payment processing, Google login.
- Art. 6(1)(c) GDPR (legal obligation): retention obligations under commercial and tax law, insofar as invoices or tax-relevant data are concerned.
- Art. 6(1)(f) GDPR (legitimate interests): server logs, security measures and error diagnosis to protect the service.
4. Hosting, Storage Location and Security
FloBudget is operated on a self-administered server in Germany. The domain flobudget.eu is registered with netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany.
All data is stored exclusively on servers within the European Union. Transmission is encrypted via HTTPS (TLS). Passwords are stored exclusively as bcrypt hashes, never in plain text.
5. Retention Period
User accounts and all financial data entered by the user (transactions, categories, savings goals, imported data) are stored until the account is deleted. After account deletion, this data is removed from the production systems immediately. Complete removal from encrypted backup copies takes place as part of the regular backup rotation. Server logs are automatically deleted after a maximum of 14 days.
Invoice data is stored for the legally prescribed period of up to 10 years due to statutory retention obligations (§ 147 AO, § 257 HGB).
6. External Services
FloBudget uses the following external services. Fonts are delivered locally – no connection to Google Fonts is established.
| Service | Provider | Purpose & Notes | Privacy |
|---|---|---|---|
| Stripe | Stripe Payments Europe, Ltd., Ireland | Payment processing for Pro subscriptions. Credit card and billing data is transmitted directly to Stripe upon payment. Stripe may transfer this data to the USA (standard contractual clauses pursuant to Art. 46 GDPR). | Link |
| Google OAuth | Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | Optional login with Google account. When you click "Sign in with Google" you are redirected to Google; Google processes authentication data according to its own privacy policy and may transfer data to the USA (standard contractual clauses). No data transfer occurs without clicking this button. | Link |
| CoinGecko API | Gecko Labs Pte. Ltd., Singapore | Bitcoin price data (retrieved and cached server-side – your IP address is not transmitted to CoinGecko). | Link |
No tracking, no analytics, no advertising.
7. Cookies and Sessions
- Session cookie: For login. Deleted when the browser is closed. Legal basis: Art. 6(1)(b) GDPR.
- Theme cookie (
lk_theme): Stores your colour scheme for 1 year. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a consistent user experience).
Since only technically necessary cookies are used, no cookie consent is required (§ 25(2) TDDDG).
8. Data Sharing
Your data is not sold to third parties or shared for advertising purposes. Data is only shared in the following cases:
- Stripe: When paying for the Pro plan, the data required for payment processing is transmitted to Stripe Payments Europe, Ltd. (Ireland). Stripe acts as an independent data controller. Legal basis: Art. 6(1)(b) GDPR.
- Google (when using Google login): If you sign in via Google, FloBudget exchanges authentication data with Google. Google acts as an independent data controller in accordance with its own privacy policies. Use of this feature is entirely voluntary. Legal basis: Art. 6(1)(b) GDPR.
- Legal obligation: If required by law or ordered by authorities (Art. 6(1)(c) GDPR).
9. Deletion
You can irreversibly delete your account and all associated data at any time via Settings → Delete account. After account deletion, your data is removed from the production systems immediately. Complete removal from encrypted backup copies takes place as part of the regular backup rotation (cf. § 5 Retention Period). Server logs are automatically deleted after a maximum of 14 days. Invoice data is subject to statutory retention periods and cannot be deleted early.
10. Your Rights
You have the following rights under the GDPR:
- Access (Art. 15): Which data we store about you.
- Rectification (Art. 16): Correction of inaccurate data.
- Erasure (Art. 17): Deletion of your data – possible at any time yourself via Settings → Delete account.
- Restriction (Art. 18): Restriction of processing.
- Data portability (Art. 20): You can download a complete data export in machine-readable format at any time via Settings → GDPR export.
- Objection (Art. 21): Objection to processing based on Art. 6(1)(f) GDPR.
No automated decision-making or profiling pursuant to Art. 22 GDPR takes place.
Contact for enquiries: kontakt@flobudget.eu
11. Right to Lodge a Complaint
Competent supervisory authority: Landesbeauftragte für Datenschutz und Informationsfreiheit NRW (LDI NRW), P.O. Box 20 04 44, 40102 Düsseldorf, www.ldi.nrw.de.