Privacy Policy — $mart (Web Beta)

Version 7 · Last updated: September 30, 2026.

1. We Don't Touch Your Financial Data

We do not collect it or see it. It lives only in your browser's storage (not tracking cookies), encrypted with a key created on your own device that never leaves it.

Your browser also stores, encrypted, your language, theme, which accounts (email and first name) have signed in on it and which version of the Terms each accepted, and your email if you check "Remember my email on this device." In addition, Firebase keeps your sign-in session (your account identifier and email) in your browser until you sign out. If you share the device, sign out and leave the remember-email option unchecked.

2. Your Account

For your account we keep your email and first name, to create your account, let you sign in and greet you, along with technical data: sign-up and last sign-in dates, language, platform (web), the name of the document where your browser stores your data (never its contents), and the history of the versions of these Terms you accepted or declined, with the date and time, language and method (at sign-up or on the Terms screen). We use it only to provide the service, send you the sign-in code, keep proof of your acceptance or refusal and, if needed, send you important notices about the service. Never for advertising, and we never sell it.

To prevent abuse (for example, someone requesting codes in bulk), we keep request counters identified by an irreversible keyed hash (HMAC) of your email and IP address, not the email or IP itself; they expire after 2 hours and are deleted automatically, usually within a day. For the sign-in code we email to you, we keep only an irreversible hash of the same kind, never the code itself; it can be used once, expires after 10 minutes and is deleted the same way.

Our server (Google Cloud) automatically logs each request, with your IP address, browser type and time, for security and troubleshooting; these logs are deleted after 90 days.

3. Third Parties

We use Google Firebase (Google Cloud) to host the Beta and for accounts (Firebase Authentication stores your email), and Resend to send the email with the sign-in code. The page loads libraries from Google (gstatic) and, only if you import an old backup, from cdnjs (Cloudflare). These services may receive your IP address and basic technical data (such as your browser type) and keep technical logs (Google, of requests; Resend, of the emails sent) for security and operation, under their own policies — never your budget data. Our providers may process this data in the United States. We do not use Analytics, we do not sell data, and we do not use advertising cookies. Because we do not track you across other sites, we do not respond differently to your browser's "Do Not Track" signals.

4. Retention and Deletion

We keep your account data for as long as the account exists, until you delete it or ask us to. If you decline the Terms without ever having accepted them, we keep your email and the record of your refusal only as proof and to prevent abuse, and we delete them automatically after 30 days unless you accept the Terms before then; if you sign in again and accept them, your account continues normally.

From Settings → Data & backup → Delete data you can delete your entries (income, budgets and transactions, and also your cards if you choose all months) from this browser. If you clear this site's data in your browser, everything the app stores there is deleted.

You can delete your account from Settings → Account → Delete my account, or by writing to support@bistecgroup.com (within 30 days). This removes your email, first name, account record and acceptance history, including your Firebase Authentication record. Before deleting it you can export a copy of your data or also delete the data stored in this browser. Technical logs are deleted within the periods stated above, and our providers' logs on their own schedules. You control any backups you exported.

5. Your Rights and Security

Bistec Group LLC (Guaynabo, PR 00969) is responsible for this data. We process it to provide the service you request and to protect the service against abuse. You may ask us for access to, correction, a copy or deletion of your data, or object to its use, by writing to support@bistecgroup.com; we will respond within 30 days. We do not use your data for automated decision-making. If a security incident affects your data, we will notify you as required by law. No system is completely secure.

6. Changes to This Policy

If we change this Policy, we will update its version and date, and show it to you when you sign in so you can accept it.

Bistec Group LLC · Guaynabo, PR 00969 · support@bistecgroup.com