Last updated: 2 November 2026
The data controller is Matteo Gottard, an independent developer based in Italy. You can write to us at info@musina.app. Musina is free, with no advertising and no purchases: nobody makes money from your data. We do not have a data protection officer because the law does not require one for a service of this size.
Account. Email, name, profile picture if it comes from Google or Apple, language, reference currency, creation date. If you sign up with email and password, we only store an encrypted version (hash) of the password. If you sign in with Google or Apple, we store the identifier they give us to recognise you, never your Google or Apple password.
Expenses and households. The transactions you enter: amount, currency, description, category, date, wallet used, any trip, budget, savings goal, recurring expense. The households you create or belong to, with your role, and the invitations sent and received. If you enter an expense in a currency other than the euro, we calculate an equivalent value in euros using a public exchange rate: the conversion is only indicative.
Technical data on the device. Preferences and app state saved on your phone, listed in section 10. We do not collect advertising identifiers, GPS location, contacts or photos, and we do not track you across other apps or websites.
Diagnostic data (crashes and errors). If the app closes unexpectedly or runs into an error, it sends a report to Sentry. The report contains the type of error and the place in the code where it happened, the phone model, the iOS version, the app version and build, the system language and the names of the screens opened before the error. It also contains the calls to our server, with the path without parameters, the outcome and the request identifier. It identifies you only with a pseudonymous code: the SHA-256 fingerprint of your user identifier, or "anonymous" if you have not signed in. If you are looking at a household, the report also carries a pseudonymous code for that household, computed the same way. With the session data, which is used to measure how many launches end without a crash, the app also sends a random identifier generated at installation time, which resets if you reinstall the app. The report never contains amounts, descriptions, names, emails, screenshots of the app or the content of requests. Sentry does not store your IP address, but before discarding it, it derives your approximate city, which remains in the report. Our server sends Sentry only its own internal errors, with the request identifier, the app version and the same pseudonymous code. It never sends the content of the request, the parameters, credentials or amounts.
Problem reports (only if you send them). From the profile you can report a problem to us. The report goes to Sentry, the same service as the crash reports, and contains what you write, the contact email if you choose to give one, and a screenshot of the screen you opened the report from, which you see before sending and can remove. In the screenshot your name, your email and your profile picture are covered. The screenshot is never taken from screens that show amounts, transactions, household members or invitations: in that case the report is sent without it. Write only what is needed to understand the problem: if you mention amounts or other people, they end up in the report too. The report carries the same technical information as crash reports: app version and build, phone model and iOS version, the names of the last screens opened, the last calls to our server (only path, outcome and request identifier, never the content), your pseudonymous code, that of the household you are looking at, and the approximate city derived from the IP address. If you have no network at that moment, the report stays in the app until it is sent. It does not depend on the «Help us improve Musina» switch.
Usage data (only if you allow it). If you turn on the «Help us improve Musina» switch, in the introduction or in the profile, the app sends PostHog some events about how you use it: app opened, screens visited (only the name of the screen, never the identifier of a household or the code of an invitation), sign-in or sign-up started with the chosen method, introduction steps seen, skipped or completed. Our server adds, again only with your consent: sign-up completed, household created, invitation sent or accepted, transaction recorded (only the type, income or expense, and whether personal or household). Some technical information travels with the events: app version and build, operating system name and version, device type (phone or tablet), language and time zone, screen size. And four pieces of information about your account: the day you signed up, how many households you have, how many members your main household has, the app version. It identifies you with the same pseudonymous code used for crashes, together with a random code generated by the app on the phone: before sign-in it is the only identifier, at sign-in it is linked to your pseudonymous code. It never sends amounts, currencies, descriptions, notes, categories, names or emails. It does not record the screen, does not collect taps and does not store or use your IP address to derive your location. The events the app records from the moment you open it, in the session in which you turn on the switch, stay in memory and are sent only after your yes, with their original time; if you do not turn it on, they are lost. Before your yes nothing is sent or saved on the phone. If you turn off the switch, sending stops immediately on the phone you are using, events not yet sent are discarded and the random code is deleted; our server stops immediately for all your devices, and another phone with the app still open stops the next time it is reopened. The same happens when you sign out of the app.
Push notification identifier. If you turn on notifications, the phone gives us an identifier used to deliver them to you. It is personal data: it identifies that copy of the app on that phone, and we store it linked to your account. We receive it only after you have given permission to iOS and we use it only to send you the notifications you have chosen to receive. It does not contain your name, does not say where you are and cannot be used to recognise you outside Musina. If you have Musina on two phones, there is one per phone. We delete it when you sign out of the app or delete your account (sections 6 and 7), and you can make it disappear at any time by turning off Musina notifications in iOS Settings.
Security data. Session tokens (in encrypted form on the server), temporary tokens to verify your email or reset your password, counters of sign-in attempts linked to your email. The server logs the requests it receives with IP address, method, path, outcome and duration, without the content of the request.
| Purpose | Legal basis | Data |
|---|---|---|
| Creating and managing your account, letting you sign in | Contract, Art. 6(1)(b) GDPR | Account, security data |
| Recording your expenses and showing them to you | Contract, Art. 6(1)(b) | Expenses |
| Sharing expenses with the other members of a household | Contract, Art. 6(1)(b) | Name and profile picture; email only to administrators; expenses in the household |
| Sending you the address verification and password reset emails (the only ones the server sends) | Contract, Art. 6(1)(b) | |
| Delivering household invitations and app notifications to you | Contract, Art. 6(1)(b) | Email (the one an administrator invites you with), name |
| Converting amounts in foreign currencies | Contract, Art. 6(1)(b) | Only currency codes and date, never who you are |
| Protecting the service from abuse and unauthorised access attempts | Legitimate interest, Art. 6(1)(f) | Security data, server logs |
| Detecting and fixing crashes and errors in the app and the server | Legitimate interest, Art. 6(1)(f): an expense-tracking app that breaks without us knowing is a defective service. You can object by writing to us | Diagnostic data |
| Reviewing a report you send us and, if you leave us an email, replying to you | Contract, Art. 6(1)(b): it is support for the service you use, and the report is sent only if you send it | The text, the contact email if you give one, the screenshot if you do not remove it, the technical data of the report |
| Understanding which features are used and where the introduction is abandoned, to improve the app | Consent, Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code, revocable from the switch in the profile | Usage data |
| Expense entry reminders | Consent, Art. 6(1)(a), revocable at any time | No data leaves the phone: the notification is local |
| Push notifications about what happens in your households and trips | Consent, Art. 6(1)(a), revocable at any time | Push notification identifier; the text of the notification (who did what and where, never an amount) |
| Unlocking with Face ID | Consent, Art. 6(1)(a) | No biometric data: recognition happens on the phone and we only receive "unlocked yes or no" |
Email and name are required to create the account: without them, we cannot provide the service. Everything else (expenses, households, reminders, push notifications, Face ID, usage data) is optional. Consents are revoked from the profile, by turning off the switch, without affecting what happened before; for push notifications you can turn everything off with a single switch, or choose event by event. Turning them off stops the notification on the phone: the same information remains visible inside the app.
Notifications never contain an amount. They say who did what and in which household or trip — for example «Anna recorded an expense in Casa Milano» — so what appears on the lock screen does not tell the person next to you how much you spent.
No processing involves automated decisions with effects on you, or profiling.
Data we do not receive from you. If you sign in with Google or Apple, we receive your name, email and profile picture from them. If an administrator invites you to a household, we receive your email address from them. The transactions that other members record in a shared household may mention you in the description: they write them, not us.
The other members of your household. All members see your name and your profile picture, as well as the transactions recorded in the household, with descriptions and categories. Household administrators also see your email, because they invite by address; the other members do not. Nobody sees your personal expenses outside the household. If you leave a household, the transactions you recorded remain visible to the others, but without your name: they appear as paid by a member who left.
Providers that process data on our behalf (processors).
de.sentry.io)eu.posthog.com)| Provider | Role | What it receives | Where |
|---|---|---|---|
| Google Cloud EMEA Ltd (Cloud Run, Cloud SQL) | Processor, with the Google Cloud Data Processing Addendum | All server data: database and logs | Region europe-west8, Milan |
| Resend (Plus Five Five Inc.), the email provider | Processor, with the data processing addendum that applies on accepting its terms | Email address, subject and body of the verification and password reset emails | United States |
| Expo (650 Industries, Inc.), the service that delivers push notifications and app updates | Processor, with the data processing addendum that applies on accepting its terms | For notifications: your phone's notification identifier and the text of the notification, which pass through it to reach Apple and then you. Never your expenses, never an amount. For updates: at every launch the app asks it whether a newer version of its own code exists; the request contains the operating system, the version of the code in use and the one built into the app, the channel (preview or public), the project identifier, the network address of the connection and a random code that the app generates once per installation to count the installations that ask for updates: it is not the phone's identifier and it is not linked to your account. If the previous launch ended with a serious error, the next request also contains the technical text of that error (at most 1,024 characters), which serves only to avoid serving defective code again: it may contain fragments of the data the app was processing at that moment, never a screenshot | United States |
| Sentry (Functional Software, Inc.), the service that collects crashes and errors | Processor, with the Sentry Data Processing Addendum | The diagnostic data and the reports you send (section 2): crash and error reports from the app and the server, with the pseudonymous code and the approximate city. Never your expenses or an amount, except what you write yourself in a report | European Union (Frankfurt, de.sentry.io) |
| PostHog, Inc., the usage analytics service | Processor, with the PostHog Data Processing Addendum | Only if you have turned on the switch: the usage data in section 2, with the pseudonymous code and the phone's random code. Never your expenses, never an amount | European Union (Frankfurt, eu.posthog.com) |
Independent controllers. If you sign in with Google or Apple, the respective service processes your sign-in data according to its own privacy policy. Our server contacts Google and Apple only to verify that the sign-in token is authentic and, with Apple, to revoke it when you delete your account.
Exchange rates. Our server requests rates from the public Frankfurter service, sending only currency codes and dates. Your app never contacts it, so Frankfurter does not see your IP address or any data about you.
We do not sell data, we do not pass it to advertisers, we do not advertise.
The database and the server are in Italy (Google Cloud, Milan). Google LLC, the US parent company, may access the systems for technical support: this access is covered by the EU standard contractual clauses and by Google's EU-US Data Privacy Framework certification. The verification and password reset emails go through Resend, which processes them in the United States: this transfer is covered by the European Union standard contractual clauses included in Resend's data processing addendum. Resend receives only your email address and the text of those two emails, never your expenses.
Push notifications and app updates also go through the United States. For notifications: our server hands them to Expo, which forwards them to Apple, and Apple to your phone; Expo receives the notification identifier and the text of the notification, covered by the same European Union standard contractual clauses included in its data processing addendum. It does not receive your expenses and, since notifications never contain an amount, it does not see how much you spend. For updates: the app asks Expo whether a newer version of its own code exists, with only the data listed in section 4, covered by the same standard contractual clauses.
Diagnostic data and usage data remain in the European Union: Sentry and PostHog receive and store them in Frankfurt, in their European environments. Both companies are based in the United States and could access them from there for technical support: for Sentry the access is covered by the EU-US Data Privacy Framework certification and by the standard contractual clauses in its addendum; for PostHog by the standard contractual clauses in its addendum. In both cases what they could see is a pseudonymous code, not your name or your email, except what you write yourself in a report.
| Data | Retention |
|---|---|
| Account and expenses | As long as the account exists |
| Session tokens | They expire on their own; access lasts 15 minutes and is renewed automatically as long as you use the app. The refresh token lasts at most 30 days from the last sign-in; signing out of the app revokes it immediately. |
| Email verification and password reset tokens | Until used or expired, then deleted |
| Sign-ups awaiting email verification | Until verification or expiry of the link; a new sign-up with the same email replaces the previous one |
| Push notification identifier | As long as notifications remain on for that phone. We delete it when you sign out of the app or delete your account, when the phone gives us a new one to replace the old one, and when Apple tells us that phone no longer receives them. If you sign out of the app without a network connection the deletion does not start: the identifier stays on our server until a new one is registered on that phone or until Apple tells us it no longer receives them. In the meantime that phone may keep receiving notifications for the account you signed out of: this is why it is best to sign out of the app with the network on |
| Diagnostic data (crash and error reports) | 90 days from the event in Sentry, then deleted automatically |
| Problem reports (text, contact email, screenshot) | 90 days from sending in Sentry, like crash reports, then deleted automatically. If you ask us to delete one sooner, we do |
| Usage data | 1 year from the event in PostHog, then deleted automatically; earlier, if you delete your account (section 7) |
| Anti-abuse counters | 15 minutes, in memory, never written to disk |
| Server logs | 30 days in Google Cloud Logging, then deleted automatically. |
| Database backups | 7 days: daily backups and database logs are overwritten within 7 days of deletion |
| Shared household wallet transactions after your deletion | As long as the household exists: the amount remains, not your name (section 7) |
You can delete your account from the app, in Profile. We ask you to confirm your identity. Before confirmation the app shows you, household by household, how many transactions will disappear. Then:
For the households you share with others, the following applies:
When you delete your account, the transactions you recorded in a shared household and paid with your own money — expenses and income — are deleted, for the other members too: they cannot be attributed to anyone else without misstating who spent the money. Household wallet transactions (deposits and withdrawals) remain, because they are the household's money and not yours: the amount remains, not your name. The other members receive a notification saying how many transactions are no longer in the history, without your name. Deletion on production systems is immediate; backup copies containing your data are overwritten within 7 days.
This also applies to households you have already left: leaving does not delete your transactions, which remain visible to the others as long as your account exists; deleting the account removes them there too, and the app tells you so with the count.
If you are the only administrator of a household with other members, the deletion flow asks you to hand the role over to another member, with one tap, before proceeding. Dissolving a household is only possible for the last remaining member: nobody can erase other people's history with a single action.
You have the right to access your data, to rectify it, to erase it, to restrict its processing, to object to processing based on legitimate interest (including crash and error reports), to withdraw your consents and to receive the data in a machine-readable format. Exercising them is free. You change your name, language and currency from the app; you withdraw consent to usage data from the switch in the profile; for everything else write to the address in section 1 and we will reply within one month. From the profile you can export your personal expenses for the current year to CSV ("Export my data"); for previous years and for household data write to us and we will send them to you in the same format.
If you believe that the processing breaches the law, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it.
Musina is reserved for people aged at least 18 and we do not knowingly collect data from minors. If we learn of an account belonging to a minor, including through a report from a parent, we delete it.
The app does not use cookies and does not show a banner: everything it saves on the phone is strictly necessary for it to work, except usage data, which exists only after your yes. You can delete everything by uninstalling the app.
In the system Keychain, encrypted and tied to this device:
musina.auth.v1: the session tokens.active_scope_v1: whether you are looking at personal expenses or those of a household.In the app's regular storage:
musina.first_launch_done, musina.auth.intent, musina.last_auth_method, musina.auth.pending_verify_email.v1 (your email, until you verify it), musina.auth.pending_apple_name.v1 (the name received from Apple, until we save it on the server).musina.face_id_lock_enabled, musina.entry_reminder_enabled, musina.entry_reminder_id, musina.entry_reminder_time.musina.push.token.v1 (the phone's identifier, described in section 2), musina.push.primed_at.v1 and musina.push.reask_shown_at.v1 (two dates used only to avoid asking you for permission more than once), musina.push.shared_count.v1 (how many shared households and trips you had the last time the app checked: used only to know when you join your first one, so as not to ask for permission at the wrong moment).musina.analytics.consent.v1 (the answer you give to the switch in the introduction, before you have an account: it is used to carry it over to your account at sign-up and is deleted immediately afterwards, or when you sign out of the app). Only after your yes does the analytics tool's storage also exist, with the phone's random code and the events waiting to be sent: it is deleted entirely when you turn off the switch or sign out of the app.musina.feedback.throttle.v1 (the time of the last report and how many you have sent today: used only to avoid sending too many in a row).musina.activity.swipe_hint_dismissed, musina.onboarding.carousel_seen.v1, musina.onboarding.install.v1, musina.onboarding.invite_branch.v1.<user id>, musina.dashboard.scope_hint.v1 (for each account that has used this phone, the date on which we explained, only once, what the «+» in a household dashboard is for: used only to avoid explaining it again).musina.invitation_link_urls (the invitation links you created), musina.pending_invite_token (an invitation received and not yet accepted).musina.app_config.v1 (the latest configuration received from the Musina server: the minimum app version still supported, the latest available version, the App Store link and which features are turned on. It contains nothing about you and is the same for everyone).Musina's web pages on musina.app (site, this policy, the terms) do not use cookies and do not show a banner. The only measurement is Vercel Analytics, which counts visits in aggregate form without cookies, without saving anything on your device and without storing your IP address or a personal identifier. The pages served by brain.musina.app (invitations, email verification) do not use cookies or analytics tools.
If we change anything substantial, we will tell you in the app or by email before the change takes effect. The version in force always shows the date at the top. Version: 2 November 2026.
This is a translation of the Italian text, which prevails in case of discrepancy.