Privacy Policy

1. Who is responsible

The controller for the Centamo app and the website centamo.donner.io under the General Data Protection Regulation (GDPR) is:

Dennis Donner
Eduard-v-Winterstein-Straße 11
14480 Potsdam
Germany
Email: app-support@donner.io

There is no data protection officer, as none is required by law. Send any privacy question or request to the email address above.

2. In short

3. Data stored on your device

Everything you enter in Centamo is stored in a local database on your iPhone: accounts and opening balances, bookings with title, merchant, amount, category, tags and notes, budgets, savings goals, fixed costs, contracts with provider, term and notes, debts and loans, household members and cost splits, planned events, exchange rates you enter, a local history of your changes and your settings. I have no copy of it and cannot see it.

The database is encrypted with SQLCipher. Its key is a random 256-bit key that is created on your iPhone and kept in the iOS Keychain, available only on this device after the first unlock and never synced. The data folder is additionally protected with the strongest iOS file protection class (only readable while the iPhone is unlocked) and is excluded from iCloud and computer backups. Use the encrypted backup described below to keep a copy.

The data can include information about other people, such as the names of household members you split costs with or the counterparty of a debt. It stays on your device as well.

Legal basis: performance of the contract for using the app (Art. 6(1)(b) GDPR).

4. Receipts, documents and text recognition

You can attach a receipt to a booking and documents to a contract, either by scanning them with the camera, choosing a photo or selecting a file. Each file is encrypted with AES-GCM using a separate key from the iOS Keychain before it is stored; files larger than 10 MB are rejected.

When you scan a receipt, Apple’s Vision framework recognises the text on your iPhone (German and English). Centamo then suggests the amount, date and merchant; nothing is applied until you save the booking. Temporary scan files are protected by iOS and deleted at the next app start at the latest. No image or text is sent anywhere.

When you remove a receipt from a booking, its encrypted file is deleted at the next app start. A booking you delete is marked as deleted and hidden; its receipt file stays encrypted on your iPhone until you delete the app.

5. Widgets

Centamo’s widgets run in a separate extension. To show your figures, the app writes a small summary file into a storage area that only Centamo and its widgets share (App Group). It contains the date, the free amount until payday or month end, the amount per day, the days remaining and up to three upcoming fixed costs with their title, due date and amount. iOS protects this file from the first unlock of the iPhone after a restart.

Hide amount in Settings → Widgets is on by default. Then the file contains no amounts: Home Screen widgets show only titles and due dates of upcoming payments, and Lock Screen widgets show only a neutral hint. Tapping a widget opens Centamo; the link carries no data.

6. App lock and privacy cover

If you turn on the app lock, Centamo asks iOS to confirm your identity with Face ID, Touch ID or your device passcode. The check is done by iOS; Centamo never receives biometric data. The privacy cover, on by default, hides your figures in the app switcher.

7. Reminders

Reminders are off until you allow them in the app and iOS asks for permission. They are local notifications scheduled on your iPhone for fixed costs, notice periods, budgets, payday and savings goals. Their text is neutral and contains no amounts, merchants or provider names. To avoid duplicate reminders, Centamo keeps a short list of already delivered reminders in its local settings.

8. Exports and backups

• CSV export of bookings: date, type, title, merchant, category, account, amount, currency, note, tags and an internal ID of every booking that is not deleted.
• Reports: as CSV or PDF for the period you choose.
• Encrypted backup: all data including receipts and documents, encrypted with a password you choose (at least 8 characters). The key is derived from the password with PBKDF2-HMAC-SHA256 (600,000 iterations) and the content is encrypted with AES-256-GCM. Without the password the file cannot be opened, not even by me, and a forgotten password cannot be recovered.

CSV and PDF files are not encrypted, so Centamo asks before creating them. All exports are only created when you ask for them and saved where you choose, for example in the Files app or in iCloud Drive. From then on the file is under your control, and the terms of the storage you chose apply. Restoring a backup checks the file first and then replaces all data on the device.

9. Feature requests

The feature request form in the app only creates a draft from the text you type. You can copy it or open it in your mail app, where you choose the recipient and decide whether to send it. Centamo sends nothing itself and attaches no financial data or diagnostics.

10. No analytics, tracking or advertising

Centamo contains no third-party SDKs for analytics, crash reporting, advertising or attribution, and it does not track you across apps or websites. The only libraries are GRDB and SQLCipher for the encrypted database, which run on your device. Centamo has no in-app purchases.

Apple distributes the app through the App Store. If you have turned on sharing with app developers in iOS (Settings → Privacy & Security → Analytics & Improvements), Apple may provide me with aggregated, non-identifying crash and usage statistics. This is controlled by Apple and your iOS settings, not by Centamo.

11. Contact and support

If you email me at app-support@donner.io, I process your address, your message and whatever you include (for example device and iOS version) to answer you. Legal basis: Art. 6(1)(b) GDPR for questions about the app you use, otherwise my legitimate interest in answering (Art. 6(1)(f) GDPR). Please do not send exports, backups or screenshots with amounts unless I ask for them.

12. This website

centamo.donner.io is a static website. It sets no cookies, uses no analytics or tracking, has no forms or embedded content and loads fonts, images and scripts only from its own server. No cookie banner is needed for that reason.

When you click EN or DE, the site stores your choice under the key centamo-lang in your browser’s local storage, and the English start page reads it (or your browser language) to show the German version. The value never leaves your browser; you can delete it with your browser data.

To deliver the pages, the web server processes your IP address, date and time, the requested address, the referring page and your browser’s user agent. Such server logs serve operation and security only and are deleted by the hosting configuration. Legal basis: my legitimate interest in a secure website (Art. 6(1)(f) GDPR).

13. Recipients

The app itself passes no personal data to me or to anyone else. Recipients are only involved around it:

The hosting and email providers act as processors under data processing agreements where the GDPR requires one. Apple acts under its own responsibility. Personal data is not sold.

14. Transfers outside the EU

Apple is or belongs to a US company, so access from the USA cannot be ruled out. Transfers rely on the EU–U.S. Data Privacy Framework where the company is certified, and otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR). The data you enter in Centamo is not transferred anywhere.

15. How long data is kept

• On your device: until you delete it in the app or remove the app. Deleting the app removes the database, receipts and documents. Exports and backups you saved elsewhere stay there until you delete them.
• Support emails: deleted when your request is closed, unless commercial or tax law requires them to be kept longer.
• Server logs: only as long as needed for operation and security.

16. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw a consent at any time with effect for the future (Art. 7(3)).

Because there is no account and your records stay on your device, I hold no data from the app about you. You exercise these rights for your records directly in the app, for example by editing, exporting or deleting them. You can also lodge a complaint with a supervisory authority, for example the one responsible for me:

Brandenburg Commissioner for Data Protection and Access to Information (Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg)
Stahnsdorfer Damm 77
14532 Kleinmachnow
Germany

17. Children

Centamo is a tool for personal finances and is not directed at children under 16. I do not knowingly process personal data of children.

18. Permissions and how to revoke them

• Camera (scanning receipts and contract documents): iOS Settings → Centamo → Camera.
• Face ID (app lock): iOS Settings → Centamo → Face ID, or turn off the app lock in Centamo.
• Notifications (reminders): iOS Settings → Centamo → Notifications, or turn off reminders in Centamo.

Choosing a photo or a file needs no permission: iOS only hands over the item you select. Centamo does not use location, contacts, calendars, health data or your photo library as a whole. Revoking a permission only switches off the feature that needs it; your records are not affected.

19. Security

Your records are encrypted as described above and additionally protected by the data protection of iOS when your iPhone has a passcode. Because the data is not on a server, it cannot leak from one. Keep unencrypted CSV and PDF exports as safe as the records themselves, and choose a strong password for backups.

20. Changes to this policy

I update this policy when the app or the website changes. The current version is always available at centamo.donner.io/privacy/.