Privacy policy

Controller

The controller within the meaning of the GDPR — for the website as well as for the application — is:

kreativ-anders | Manuel Steinberg
Imprint · Contact

Part A — The website finanzgecko.app

Applies to the pages under finanzgecko.app. They set no cookies and create no user accounts; every integration named below can be verified in the page source.

A1 · Hosting (GitHub Pages)

This website is served as a static page via GitHub Pages, a service of GitHub, Inc. (88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA). When a page is requested, GitHub processes technically necessary access data (IP address, timestamp, requested file, user agent, among others) in order to deliver the page at all and to protect the infrastructure. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and reliable operation of the website). We have no influence over the scope or retention period of those server logs; details are set out in GitHub's privacy statement.

A2 · Analytics with Pirsch Analytics

We use Pirsch Analytics for audience measurement. Pirsch Analytics is cookie-free analytics software developed on the privacy-by-design principle. To analyse visitor flows, it generates a 16-digit number as a visitor ID from a hashing algorithm on receiving the page view; the inputs are the IP address, the user agent, the date and a salt.

The visitor's IP address is not persisted, neither in full nor in part, and is irreversibly anonymised by the hash. Because the date is part of the input and a per-site salt is used, visitors cannot be recognised for longer than 24 hours and cannot be tracked across several websites. A coarse location (country/city) is derived from a locally embedded database.

The provider is Emvi Software GmbH, Nickelstraße 1b, 33378 Rheda-Wiedenbrück, Germany. Processing takes place on servers in Germany, so no third-country transfer occurs. The legal basis is Art. 6(1)(f) GDPR — the legitimate interest in understanding which content of this website is found and read. As no cookies are set and no device information beyond what is technically necessary is read, no consent under § 25 TDDDG is required. Further information: privacy at Pirsch Analytics.

A3 · Calls to the public GitHub API

Two pages query the public GitHub API (api.github.com) as they load: the start page for the project's GitHub star count, and the download page, to link its buttons directly to the latest release file and to show version and file size. The browser's IP address is transmitted to GitHub, Inc. in the process. No cookies are set and no personal data is stored by us. Both pages remain usable without that request — the download buttons then lead to the release overview. The legal basis is Art. 6(1)(f) GDPR.

A4 · Voluntary support via Stripe

Anyone wishing to support further development is forwarded by a button to a payment page hosted by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland). Data is transmitted to Stripe only once that button is clicked; this website itself embeds no Stripe script. Payment is handled exclusively at Stripe — payment details such as card numbers never reach us. Stripe's privacy policy applies. The legal basis is Art. 6(1)(b) GDPR (carrying out the payment you initiated).

This concerns the website only. The application knows nothing of payments: no in-app purchases, no subscription, no payment data (see B3).

A5 · External links and downloads

The download buttons point to GitHub Releases. Clicking one takes you off this website; from that moment the respective provider's privacy policy applies. The operators of linked pages are solely responsible for their content.

Part B — The FinanzGecko application

Applies to the FinanzGecko desktop application for Windows, macOS and Linux, however it was obtained. Nothing from Part A applies here: the application embeds neither Pirsch nor Stripe and does not call the website.

B1 · What data the application holds

Only what the user enters: their accounts (label, bank, type, currency), the balances they enter each month, their assets and their recurring income and expenses.

The application does not read bank accounts — no online banking, no registration, no user account. It does not ask for an IBAN, account number, card number or credentials, nor for a name, address or e-mail address. Individual transactions and spending categories are deliberately not recorded: FinanzGecko is a net-worth tracker, not a household ledger.

B2 · Where the data lives

On the user's own computer, AES-encrypted. The key is held by the operating system and is tied to that device: a copy of the file — in a cloud folder, say — cannot be opened on another computer. We run no server on which anything of the user's could sit, and therefore cannot see their data.

For a backup that can be restored elsewhere there is Export backup. The user picks the location and can protect the file with a password of their own choosing. Without a password the file is readable plaintext — as is the CSV export, which is meant for the user's own analysis and does not replace a backup. Exported files are entirely in the user's hands.

B3 · What leaves the device

On its own: nothing. No telemetry, no crash reports, no usage statistics, no advertising identifiers, no sharing with third parties — and no in-app purchases or payment data. There are exactly two cases in which the application goes online at all, both only on the user's decision and neither transmitting financial data:

• Exchange rates — only after the user agrees does the application fetch public reference rates (api.frankfurter.dev). Only the currency pair and the date are transmitted.
• Update check — only when the user clicks it in Settings does the application ask GitHub for the latest version (api.github.com). If they choose to download it, the file comes from GitHub — again only after a further click.

As with any request on the internet, the provider sees the user's IP address. Anyone wishing to avoid this declines the rate lookup and does not use the update check — the application then remains fully usable offline, and rates can be entered by hand.

B4 · What the user controls

• Consent for the rate lookup can be changed at any time under Settings → Exchange rates.
• The update check happens only when the user starts it.
• The data can be exported at any time (see B2).
• Entries, accounts and assets can be deleted inside the application. To delete everything, delete the data file; Settings shows where it is. Uninstalling leaves it in place, so that an update does not take years of records with it.

Your rights

You have the rights to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), as well as the right to lodge a complaint with a supervisory authority. For any such matter please use the contact details given in the imprint.

On the website: because the analytics data cannot be attributed to a person (no cookies, no stored IP addresses, recognition for at most 24 hours), attributing individual records to you is generally not technically possible.

On the application: because it transmits no data to us, we hold no personal data to which such a request could relate. The data is under your sole control on your own device; the export function in B2 satisfies data portability directly.