Privacy policy

Plan ahead. Stay in the black.

Last updated: 17 October 2026

1Introduction

Back to Black is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose and safeguard information when you use the Back to Black app and our website, backtoblack.app. By using the App or the Website you agree to this policy.

2Information we collect in the app

We collect information you provide directly:

  • Account information: your email address, password and optional name, managed by Supabase Auth, our authentication provider. Passwords are stored only as secure, one-way hashes, never in readable form. Older versions of the App used Clerk for sign-in, and accounts created there were moved to Supabase Auth.
  • Financial information you enter: receipts, spending entries, bank statement uploads, budgets, debts, savings goals, plans, money set aside, pay schedules and lists.
  • Photos and documents: receipt images and bank statements (images, PDF or CSV files) you upload for reading. These are processed by Anthropic's Claude AI to extract transaction details, and stored in our private cloud storage.
  • Device information: an Expo push notification token, if you allow notifications.

We do not connect to your bank, and we never ask for your internet banking login or password. You choose what you add.

We collect limited technical information automatically:

  • Diagnostic logs when the App starts or hits an error (app version, device model and a random device identifier), used only to keep the App working.

3Information we collect on the website

The Website does not need an account, and you don't have to give us any personal information to use it.

  • Website analytics: we use Google Analytics 4 to understand how people use the Website. It records the pages you view, how you arrived (for example from a search or LinkedIn), your general location (country and city), your device and browser type, and actions such as tapping "Get the app", opening a planner or downloading a template. Google says Google Analytics 4 does not log or store IP addresses. See section 5 for cookies and how to opt out.
  • Planners and calculators: the holiday and Christmas planners run in your browser. The amounts and dates you type are not sent to us or stored.
  • Server logs: our host, Hostinger, keeps standard web server logs (such as IP address, time, page requested and browser type) for security and to keep the Website running.
  • Fonts: the Website loads its fonts from Google Fonts, which means your browser connects to Google's servers and Google receives your IP address.

4How we use your information

We use information to:

  • Provide and operate the App's features, including plans, sharing and reminders.
  • Read receipt and bank statement uploads using AI (Anthropic's Claude) to extract transaction details.
  • Send you account emails, such as sign-up and password-reset codes.
  • Send you optional push notifications about plans, paydays, budgets, goals and shared items.
  • Understand how the Website is used so we can improve it.
  • Respond to support requests and keep our services secure.

We do not sell your personal information. We do not use your information for advertising, and we do not use advertising or remarketing features in Google Analytics.

5Cookies and website analytics

  • Google Analytics sets first-party cookies on the Website (such as _ga and _ga_4WCQS5TF6Q) to tell visits apart. They do not identify you by name.
  • Google Analytics data is kept for the retention period set in our account, no longer than 14 months.
  • You can block or delete cookies in your browser settings, or install Google's opt-out add-on: tools.google.com/dlpage/gaoptout. The Website works fully without them.
  • We also use Google Search Console and Bing Webmaster Tools to see how the Website appears in search results. They give us summary search data, such as search terms and clicks. They do not place cookies on the Website or track you on it.
  • The App does not use cookies or advertising identifiers.

6Third-party services

We rely on the following providers:

7Data storage and security

Your account and App data are stored in a PostgreSQL database and private file storage provided by Supabase, hosted in Sydney, Australia. Data is encrypted in transit (TLS) and at rest (AES-256). Uploaded images and documents are kept in private storage that is accessible only through our servers. We keep your App data while your account is active. When you delete your account, your personal data is permanently erased.

8Your rights

You have the right to:

  • Access the personal information we hold about you.
  • Correct inaccurate information.
  • Export your transactions (Spending, then Export, in the App).
  • Delete your account and all associated data.
  • Object to or restrict certain processing.

To exercise these rights, contact us at hello@backtoblack.app.

9Account deletion

You can delete your account at any time in the App (Settings, then Delete account), or by following the steps at backtoblack.app/delete-account. Deletion is permanent and cannot be undone. All your data, including receipts, transactions, budgets, plans, goals and lists, is erased from our servers. Database backups are kept for up to 7 days, then removed.

10Children's privacy

The App and the Website are not directed to children under 13 (or 16 in the EU). We do not knowingly collect personal information from children.

11International transfers

Your account and financial data are stored in Australia. Some of our providers process information overseas:

  • Receipt and bank statement uploads are sent to Anthropic, in the United States, to extract transaction details.
  • Account emails are sent through Resend, a United States-based provider.
  • Push notifications are delivered through Expo, a United States-based provider.
  • Our servers and the Website are hosted by Hostinger in the United States.
  • Website analytics and fonts are provided by Google, and search data by Google and Microsoft, which may process information in the United States and other countries.

By using the App or the Website you consent to these transfers. We use providers that apply appropriate safeguards consistent with applicable data protection laws.

12Changes to this policy

We may update this Privacy Policy from time to time. We will tell you about material changes in the App, on the Website or by email. Continued use after changes means you accept the updated policy.

13Governing law

This Privacy Policy is governed by the laws of New South Wales, Australia, and is designed to be compatible with the Australian Privacy Act 1988 and the EU General Data Protection Regulation (GDPR).

14Contact us

If you have any questions about this Privacy Policy, please contact us at:

Email: hello@backtoblack.app