Privacy Policy

Last updated: 2026-10-29

This policy explains what Hello Budget does with data: the Telegram bot (@hello_budget_bot), its Mini App, the web app at https://hello-budget-app.gpm.name and the Android app. They are four doors to the same account, and what is written through one is there in the others.

The short version: inside Telegram there is no account and no password, because Telegram already knows who you are; the web app and the Android app sign you in with Telegram, with Google or with your email address. What you write down is stored on one server so that it can be shown back to you, and it is used for nothing else. There is no advertising, and no third party has a copy of it unless you connect an AI assistant, which then reads what you let it read: see Assistants. There is no analytics either, with one exception that asks first: the Android app from Google Play, below.

Who is responsible

Gabriele Proietti Mattia (https://gpm.name), reachable at apps@gpm.name, is the data controller. The server is in Germany.

What is stored

Everything below is stored because Hello Budget cannot do its job without it, and nothing is stored that it can do its job without.

Who you are on TelegramYour Telegram numeric id, first and last name, username and language code. The id is what ties your expenses to you; the name is what the bot greets you by; the username is how you can be found in the admin panel; the language sets which of the two translations you read.
How you sign in, outside TelegramThe email address you sign in with, and the language you chose. Signing in with Google adds the identifier Google gives your account and the first and last name on it. A sign-in code or link is stored only as a hash, and stops working within minutes.
Where you are signed inFor every browser and phone signed in to the web app or the Android app: a hash of its session token, the browser's or the app's user agent, and when it was created and last used. A session ends when you sign out, and on its own after a long time unused (90 days in the Android app).
What you write downExpenses with their amount, category, description and date. Income, budgets, subscriptions, instalments, investments and their price alerts. Categories, and the shared accounts you belong to.
Where you are in the conversationThe screen you are on and the message the bot last sent you, so a button pressed tomorrow still knows what it refers to.
The assistants you connectedFor each connection: the assistant's name and the addresses it declared (its client id URL and its redirect addresses), whether it is read only, and when it was connected, last used and disconnected. Tokens only as hashes. See Assistants.
Whether you are a subscriberWhether Pro is active and until when, and whether it renews. For Pro paid in the bot, the payment identifier Telegram gives it so that a refund is possible; for Pro bought in the Android app, the purchase token Google Play issues, so that the subscription can be checked.

What is never stored

No payment details. Pro is paid either in Telegram Stars or, in the Android app, through Google Play. Telegram or Google tells Hello Budget that a payment happened and gives it an identifier for it; a card number, a name on a card or a billing address never reach it, because neither ever sends them.
No location. Nothing asks for it and there is nowhere to put it.
No contacts, no files, no photos.
No analytics and no advertising identifiers in the bot, the Mini App, the web app or the F-Droid build of the Android app: there is no third-party SDK in any of them. The Android app from Google Play is the exception, and it asks before it sends anything: see Diagnostics.
No message history. The bot reads a message to act on it and keeps what that message was about — an expense, a budget — not the message.

Telegram’s part

You are talking to this bot through Telegram, and Telegram carries what you send. What Telegram does with that is covered by Telegram’s own privacy policy, not by this one.

Two consequences worth stating plainly:

Telegram knows you use this bot, and when.
A Telegram chat with a bot is not end-to-end encrypted. Telegram can read it, the same way it can read any cloud chat.

The Mini App

The Mini App is a page served from https://hello-budget-tg.gpm.name. It stores one thing in your browser: a note that you have seen the welcome screen. That note never leaves the device and is not readable by anyone else.

Every request it makes carries the session Telegram signs for it, which is what proves the request is yours. Without it the page shows a link back to the bot and nothing else: that is why it cannot be used from a browser.

The page loads its fonts from Google Fonts, which means Google sees the request for those files. Nothing about you is sent with it beyond what any browser sends when it fetches a file.

Signing in outside Telegram

The web app and the Android app can sign you in with nothing but an email address: they send it a link or a six-digit code, and whoever can read that inbox gets in. The message is sent through Mailjet, which therefore handles your address and the message; it has no other part in Hello Budget. See Mailjet’s privacy policy.

Signing in with Google means Google confirms who you are and hands over your address and the name on your Google account. Signing in with Telegram, in the Android app, goes through the bot, which already knows you.

The Android app

There are two builds of the Android app, and they are not the same.

The F-Droid build contains no Google code at all: no Firebase, no Google sign-in, no Google Play. It signs in with an email address or with Telegram, checks for new notices by asking the server from time to time, and Pro is bought in the bot.

The Google Play build adds four things, each of them Google’s:

Signing in with Google, through Android’s Credential Manager.
Notifications through Firebase Cloud Messaging. The phone registers a push token with the server, along with the app’s version, the build and the language. What travels through Google is only a nudge that something is waiting, never its content: the app then fetches the notice from the server itself. The token is deleted when you sign out, when it has not been seen for 60 days, or with the account; the notices themselves are kept for 30 days.
Pro through Google Play Billing. Google takes the payment. The purchase token Google Play issues is sent to the server, and from there, with your email address if it has been verified, to the licence service that every app by the same developer uses to check a Google Play subscription, run by the same person. That is how the subscription unlocks Pro wherever you sign in.
Diagnostics, below.

Diagnostics

The Google Play build contains Firebase Crashlytics and Firebase Analytics, and neither sends anything until you have answered. The last screen of the first launch asks, with one switch for each, both on; you can leave them or turn them off, and nothing is collected before that screen. You can change either at any time in Profile → Diagnostics, and it takes effect at once.

Crash reports (Crashlytics) send, when the app crashes, the stack trace, the device model, the Android version, the app version and an installation identifier Crashlytics generates. Never an amount, a description or anything else you wrote down.
Usage statistics (Analytics) record the events the SDK collects on its own, with the identifiers it collects by default, which include the Android Advertising ID, an app instance identifier, the device model, the Android version and a coarse region. On top of those the app logs a handful of events about the way to Pro: that the Pro sheet was opened, which plan was chosen and whether it began with a free trial, and whether the purchase went through. Nothing about your expenses, budgets or accounts.

Firebase is operated by Google; see the Firebase privacy documentation and the Google Privacy Policy.

Assistants

With Hello Budget Pro you can connect an AI assistant such as Claude or ChatGPT, or any other that supports MCP, at https://hello-budget-app.gpm.name/mcp. Nothing is sent to an assistant that nobody connected. The page that explains it is Hello Budget in Claude, ChatGPT and other assistants.

What is stored about a connection. The assistant’s name and the addresses it declared (its client id URL and its redirect addresses); whether the connection is read only; and when it was connected, last used and disconnected. A disconnected connection stays in the history on the server but stops working. Access and refresh tokens are stored only as hashes. An access token lasts 1 hour. A refresh token lasts 90 days and is replaced each time it is used. A request to connect that you have not answered lasts 10 minutes. When an assistant sends a request id so that a retry does not write twice, a hash of that id, a hash of the arguments and the result are kept for 24 hours.

What leaves the server. Only what the connected assistant reads through its tools, when it asks. From then on that copy is held by the assistant’s maker, such as Anthropic or OpenAI, under their own terms and privacy policy, and outside Hello Budget’s control. What the assistant writes, it writes into your account like anything else you write down.

Shared accounts. The members of a shared account should know that any one of them may connect an assistant, and that the assistant then reads the shared account as that member does: the entries of the other members, and their names, included. An assistant with permission to write can also add to the shared account, and the other members get the usual notices, as if it were done from the app.

Removing a connection. Settings → Connected assistants, in the bot, the web app, the Mini App and the Android app, disconnects an assistant at once. Delete all data and deleting the account remove every connection, its tokens and the request ids kept for it. The record of the assistant itself (its name and addresses) belongs to no account, and goes on its own once nobody uses it. What an assistant already read stays with its maker; to have it deleted, ask them.

Retention

What you write down is kept until you delete it, and there are two ways to delete it.

Your data, keeping the account. Settings → Delete all data in the bot, or Profile → Delete all data… in the Android app, deletes your expenses, income, budgets, subscriptions, investments and categories permanently and immediately, together with your assistant connections and their tokens. It is not a request that gets processed: the rows are gone when the confirmation comes back. What belongs to a shared account stays, because it is the other members’ too; your profile, your sign-ins and your Pro subscription survive, so Hello Budget still works afterwards.

The account itself. Profile → Delete account… in the Android app deletes the account with everything in it, at once. Without the app, write to the address above. Both are explained, with what is kept and why, on Delete your account.

Backups of the server exist for disaster recovery and are retained for a limited period. Data deleted from the live database is not restored from them.

Performance of a contract for everything you write down, for the sign-ins and sessions that let you reach it, and for the assistant connections you ask for: an expense tracker that does not keep your expenses is not the thing you asked for.
Consent for the crash reports and usage statistics of the Android app from Google Play, given on the screen that asks and withdrawn with the same switches.
Legitimate interest for the operational logs the server keeps to stay working and to investigate abuse.
Legal obligation for the records a payment leaves behind.

Your rights

You may ask for a copy of your data, its correction, or its deletion, and you may object to its processing. Two of those need nobody’s help: Settings → Export in the bot and Profile → Export in the Android app hand you your data as CSV files, and Delete all data is the deletion. For anything else, write to apps@gpm.name.

You also have the right to complain to a supervisory authority.

Children

Hello Budget is not directed at children and asks for nothing that would identify one.

Changes

This page carries the date it was last substantively changed. A change that affects what is collected will be said in the changelog as well, rather than only here.

The change of 23 October 2026 added the web app’s and the Android app’s sign-ins, the Android app’s notifications, its Google Play subscription and its diagnostics. Before it this page described the bot and the Mini App only, and its “no account” did not mention that the web app signs you in.

The change of 29 October 2026 added the section on assistants: what is kept about a connection, what an assistant that you connected receives and who then holds it, and what it means for shared accounts. It also changed the short version, which said that no third party has a copy.