Privacy policy

1. Controller

Leon Benedict Bansbach & Vivienne Pezic GbR, Birkheckenstr. 76A, 70599 Stuttgart, Germany, represented by its partners Leon Benedict Bansbach and Vivienne Pezic.
Email: hallo@shaboo.app
A data protection officer is not legally required. For any privacy questions, contact us at hallo@shaboo.app.

2. In short

• We only process what Shaboo needs to calculate and share.
• No selling of data. Free accounts show ads – personalised only with your consent; ad partners never get financial data.
• Your data is stored in the EU (Frankfurt) and transmitted encrypted.
• You can export your data and delete your account at any time.

3. What data we process

• Account data: email address, name, language, currency, time of your consent to the terms and privacy policy.
• Sign-in and security data: password (only as an encrypted check value), two-factor settings, backup email, recovery codes (only as check values).
• Financial details: income, expenses, savings plans, household book, month closings, savings goals, type of health insurance and premium.
• Project data: projects, members, items, payments, confirmations; depending on your privacy level, your income share or settlement net.
• Feedback you send us in the app (with app version, device type and language) and emails to hallo@shaboo.app.

4. Purposes and legal bases

• Providing the app, calculations, projects and your account: performance of contract (Art. 6(1)(b) GDPR).
• Security (sign-in, two-factor, abuse prevention) and answering your requests: legitimate interest in secure operation and good support (Art. 6(1)(f) GDPR).
• Retention obligations, if any: legal obligation (Art. 6(1)(c) GDPR).

We only use health insurance details to deduct your premium from your net pay; we do not collect health data in the narrower sense.

5. Hosting and service providers

• Supabase Inc. (database, sign-in, server functions) – data centre in Frankfurt am Main (EU).
• Cloudflare Inc. (name resolution for the domain shaboo.app, delivery of the website shaboo.app – without cookies and without tracking; only short-lived technical access data such as the IP address is processed – and forwarding of emails to hallo@shaboo.app).
• Google (sign-in with Google if you choose it; sending of emails with codes during the test phase via Google Mail).
• INWX GmbH, Berlin (domain registration; no user data).

Data processing agreements are in place with the service providers, or they act as independent controllers under their own privacy notices (sign-in with Google).

6. Transfers to third countries

Supabase, Cloudflare and Google are companies based in the USA. We store your app data in the EU; access from the USA cannot be ruled out entirely. The basis is the EU Commission's adequacy decision for the EU-US Data Privacy Framework (the providers are certified) or EU standard contractual clauses (Art. 45, 46 GDPR).

7. On your device

• The app stores your sign-in encrypted in your device's secure storage, as well as settings (language, appearance, notices seen).
• Camera: only when you scan an invite QR code; images are neither stored nor transmitted.
• App lock with fingerprint, face or device PIN: the check is done by your device; we receive no biometric data.
• Your device's advertising ID: only when ads are shown and only within your ad consent (see section “Advertising”). No other tracking or analytics services.

8. Advertising

Free accounts show ads to fund Shaboo. We use an ad service for this (planned: Google AdMob, Google Ireland Ltd.); we name the active partner in the app under Settings → Legal.

• Without consent: only non-personalised ads. The ad partner receives technical data such as IP address, device type, language and approximate location to deliver ads, prevent fraud and count impressions (legitimate interest in funding the free app, Art. 6(1)(f) GDPR; access to your device only where strictly necessary, Section 25(2) TDDDG).
• With consent: personalised ads based on your advertising ID and usage (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). We ask you before ads appear for the first time; you can withdraw consent at any time in the settings.
• Never shared with ad partners: your financial data, project data, name or email address.
• Ad-free: with Premium (once available).

9. Sharing

With other users only within shared projects and only within your privacy level. With ad partners only the technical data listed in the section “Advertising”. With authorities only if we are legally obliged to. We never sell data.

10. Retention

• Account and financial data: as long as your account exists. If you delete your account, all data is deleted; “Reset everything” deletes your financial data and keeps only the account.
• Deleted entries: 30 days in the trash, then deleted permanently.
• Abandoned sign-ups (without password): deleted after 7 days.
• Emails to hallo@shaboo.app: copy in our database for 180 days; in the support mailbox as long as needed to handle them.
• Technical logs of service providers: according to their short periods (usually a few days).

11. Security

Encrypted transmission only (HTTPS/TLS), access rules in the database (each person only sees their own data or shared project data), optional two-factor sign-in, app lock and regular security reviews.

12. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and to withdraw any consent given. You can export your data yourself at any time (Settings → Account & data → Export my data) and delete your account. You can lodge a complaint with a data protection supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

13. Minimum age

Shaboo is intended for people aged 16 and over.

14. Changes

We update this policy when features or service providers change. In case of significant changes we will ask for your consent again in the app. Last updated: October 2026.