1. Scope and who we are
This Privacy Policy explains how F1v3 Group LLC (“Stax Budget,” “we,” “us,” or “our”) handles personal information when you use the Stax Budget apps, this website, account services, support, and related services (together, the “Service”).
2. Information we process
Account and contact data
Your email address, an internal account ID, and whether your email is verified. We use it to create and run your account, send sign-up codes and security notices, and answer support requests.
Encrypted budget content
Encrypted records for your budgets: bills, payments, income, pay periods, categories, tags, notes, snapshots, budget names and settings. These are encrypted on your device before upload. We store and sync them at your direction but cannot read them.
Cryptographic and sign-in records
OPAQUE sign-in records (which let you sign in without sending us your password), encrypted key wrappers, public sharing keys, encrypted recovery records, key versions and key-derivation settings. These make sign-in, recovery and sharing work without our servers holding your readable keys.
Device and session data
A random device ID created by the app, a device name, platform, app version, and session and sign-in records. We use these to keep you signed in, show and revoke devices, and prevent abuse.
Sharing data
Who belongs to a shared budget, each member’s role (owner, editor or viewer), invitations, and the public keys needed to share access. We use this to carry out the sharing choices the budget owner makes.
Sync, security and operational data
Record IDs, versions, sync positions, encrypted sizes, timestamps, deletion markers, rate-limit counters, and request logs. Your IP address is used while a request runs and for rate limits. Our logs record the route, status and timing of a request; they do not record request bodies, passwords or tokens.
Subscription data
Your plan, subscription state, trial and renewal dates, store transaction references, and family-plan coverage. Apple or Google process your payment. We never receive your card number.
Communications
Messages you send us for support or privacy requests. Please don’t send us your password or recovery phrase; we will never ask for them.
Website data
IP address, browser user-agent, requested page, referrer and time, in ordinary server and security logs. This website does not use advertising pixels, cookies for tracking, or third-party analytics.
What we never receive
The Service is designed so our servers do not receive your password, your recovery phrase, your readable encryption keys, or any readable bill, amount, category, income entry or budget name. Biometric unlock (Face ID, Touch ID, or fingerprint) is performed by your device’s operating system; we never receive biometric data.
If you use Stax Budget without an account, your budget stays on that device and nothing is sent to our servers.
3. How we use information
We use personal information only as reasonably needed to:
- provide, sync, secure, maintain and support the Service;
- sign you in, verify your email, manage devices, recovery and encrypted sharing;
- provide free trials, subscriptions and family-plan access;
- detect and prevent fraud, abuse and unauthorized access;
- diagnose errors and improve reliability;
- contact you about your account, security, and changes to our terms or this Policy; and
- comply with law and enforce our agreements.
We do not use your budget content for advertising, do not train machine-learning models on it, and do not try to decrypt it.
4. When we disclose information
We do not sell personal information and do not share it for cross-context behavioral advertising. We may disclose limited information:
- At your direction. When you invite someone to a budget, the people you share with can see that budget. They may keep what they saw or copied while they had access.
- Service providers. Vendors that help us run the Service, including cloud hosting (Amazon Web Services) and transactional email (Postmark), under contracts that limit their use of the data.
- App stores. Apple and Google, as needed to verify and manage subscriptions. Their own privacy policies apply to data they collect.
- Legal and safety reasons. When we believe disclosure is required by valid legal process or needed to protect people or the Service. We cannot provide readable budget content, because we do not have it.
- Business changes. As part of a merger, financing, acquisition or sale of assets, subject to confidentiality protections.
5. Retention and deletion
We keep information only as long as reasonably needed for the purposes above:
- account, encrypted budget, device and sync records are kept while your account is active;
- sync history for a budget is pruned after about 90 days;
- a deleted shared budget’s encrypted records are kept for 30 days so every member’s device can see it was deleted, and then removed;
- sent emails are removed from our email queue after 30 days, and the message body is wiped once it is sent;
- expired sessions are removed about 30 days after they expire; and
- security, billing and legal records may be kept longer when needed for those purposes.
Deleting the app does not delete your account. Delete your account in the app under Settings › Account › Delete account, or see Delete account. Deleting your account removes your account and its encrypted budget data from our servers. A device that is offline keeps its local copy until it reconnects. Deleting your account does not cancel an App Store or Google Play subscription; cancel it in the store.
6. Your choices and privacy rights
In the app you can change your budget data, remove people from shared budgets, sign out devices, and delete your account. Depending on where you live, you may have rights to access, correct, delete, or get a copy of your personal information, and to appeal a denied request.
Email privacy@stax-budget.com from your account email and tell us what you’d like. We may need to confirm your identity first. We will not discriminate against you for using a privacy right.
California
California residents may have the right to know, access, correct and delete personal information. The categories we collect are listed in Section 2, and we disclose them only as described in Section 4. We do not sell or share personal information for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics about you.
Do Not Track and Global Privacy Control
This website does not use cross-site trackers, so Do Not Track does not change what we do. Where the law requires it, we treat a Global Privacy Control signal as a request to opt out of sale or sharing; we do neither.
7. Security
Stax Budget encrypts budget records on your device with XChaCha20-Poly1305, protects your keys with Argon2id, and signs you in with OPAQUE (RFC 9807) so your password never leaves your device. When a member is removed from a shared budget, the budget receives a new key and is re-encrypted.
No system is perfectly secure. Encryption cannot protect information after you unlock it on a compromised device, share it, or take a screenshot of it. If you lose both your password and your recovery phrase, your encrypted budget cannot be recovered, including by us. Keep your recovery phrase somewhere safe and separate from your devices.
To report a security issue, email support@stax-budget.com with “Security report” in the subject.
8. Children
Stax Budget is not directed to children under 13, and they may not create an account. If you are under the age of majority where you live, you may use the Service only with a parent or guardian’s permission. If we learn we collected personal information from a child under 13, we will delete it.
9. Processing in the United States
Stax Budget is operated from the United States, and our servers are in the United States. If you use the Service from another country, your information will be processed in the United States.
10. Changes to this Policy
We may update this Policy as the Service or the law changes. We will post the new version here and update the date above. If a change materially reduces your privacy, we will give additional notice.
11. Contact us
F1v3 Group LLC operates Stax Budget. For privacy questions or requests, email privacy@stax-budget.com. For anything else, email support@stax-budget.com.