iwantmoney

Privacy Policy

Last updated: 25.08.2026. This policy explains what personal data iwantmoney collects, why, and what rights you have over it under the EU General Data Protection Regulation (GDPR / DSGVO).

1. Who is responsible (Controller)

Jonathan Förste
Martiusstraße 5
jonathan.foerste@linque.eu
This is the data controller (Verantwortlicher) responsible for the personal data processed by this app, within the meaning of Art. 4(7) GDPR.

2. What data is collected

iwantmoney only collects what's needed to track and settle shared trip expenses:

• Account data: username, password (stored only as a salted bcrypt hash — never in plain text), and an optional email address.
• Trip data: trip names and home currency.
• Participant data: a display name for each person on a trip, and, if they've signed up, a link to their account.
• Expense data: descriptions, amounts, currencies, dates, who paid, and how each expense is split.
• Settlement data: who paid whom, how much, and an optional note.
• Session data: a random session token stored in an httpOnly cookie so you stay signed in (see "Cookies" below).
• Technical data: IP addresses are processed transiently by the server (e.g. to rate-limit login attempts) but are not stored in the database or logged long-term.

We don't collect analytics, don't use advertising or tracking technology, and don't sell or share data with advertisers.

3. Why we process it, and on what legal basis

All processing is necessary to provide the app's core functionality — creating an account, joining a trip, and tracking/settling shared expenses — and is therefore based on Art. 6(1)(b) GDPR (performance of a contract): you ask us to run the service, we need this data to do it. Where an email address is provided, it's used solely to identify your account, on the same legal basis.

4. Cookies

iwantmoney sets exactly one cookie: a session identifier, marked httpOnly, Secure, and SameSite, used only to keep you signed in. It is strictly necessary for the app to function and is not used for tracking, analytics, or advertising — so, per Art. 5(3) of the ePrivacy Directive, no cookie-consent banner is required for it.

5. Who else sees this data

Trip data is visible to the other members of that trip (that's the point — it's a shared expense tracker), and to admin accounts, which can access any trip for support/maintenance purposes.

When you record an expense in a currency other than a trip's home currency, the app queries the free Frankfurter exchange-rate API. Only currency codes (e.g. "EUR", "USD") are sent — no personal or trip data leaves the server for this.

The app is self-hosted on a server operated by Jonathan Förste at Netcup. No other third party has access to the database.

6. How long data is kept

Account, trip, and expense data is kept for as long as the account or trip exists. You can permanently delete your own account at any time from Account Settings (linked from your username in the top bar), no need to contact anyone. This removes your username, email, and password, and revokes your login entirely. Trips you shared with others keep their expense history — since it belongs to those trips' other participants too — but you're removed from it, appearing only as an unclaimed placeholder the way anyone not yet signed up would.

7. Security measures

• Passwords hashed with bcrypt — never stored or logged in plain text.
• Sessions are random server-side tokens, revoked immediately on logout.
• All traffic is encrypted in transit (HTTPS/TLS).
• State-changing requests are protected against cross-site request forgery (CSRF).
• Login attempts are rate-limited and accounts temporarily lock after repeated failures.

8. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you (Art. 15).
• Rectify inaccurate data (Art. 16).
• Erasure of your data ("right to be forgotten") (Art. 17) — self-service via Account Settings, see above.
• Restrict processing in certain circumstances (Art. 18).
• Data portability — receive your data in a structured, machine-readable format (Art. 20).
• Object to processing based on legitimate interests (Art. 21).
• Lodge a complaint with a supervisory authority — as the controller is a private individual based in Bavaria, the responsible authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach, Germany (Art. 77).

To exercise any of these rights, contact jonathan.foerste@linque.eu.

9. Children

iwantmoney is not directed at children and is not knowingly used to collect data from anyone under 16.

10. Changes to this policy

If this policy changes, the "Last updated" date above will change too. Continued use of the app after a change constitutes acceptance of the update.

This document is a starting template generated for a small, self-hosted trip-expense app — it is not legal advice. Review it (ideally with a lawyer) before relying on it, and fill in the bracketed placeholders with your actual details.