Privacy Notice

Last updated: September 7, 2026

Token Circles is operated by Irchiinnuss, the data controller. We keep this notice short because, by design, we collect very little — the app is local-first, and in its default mode your financial data never leaves your device.

• Local-first by default. When you use Token Circles in your browser, everything — accounts, transactions, budgets, goals, and settings — is stored locally in your browser (IndexedDB). The app’s logic runs on your device; there is no account, no server round-trip, and nothing is sent to us.
• Bank statement imports run on your device. When you import a spreadsheet (Excel or Google Sheets) or a Revolut, Erste, or PBZ statement, the file you provide is parsed in your browser to build your ledger. In local mode those files and their contents are not uploaded to us.
• Optional cloud sync. If you choose the managed cloud at tokencircles.com, the data you sync (such as your accounts, transactions, and budgets) is stored in our Cloudflare database, and any receipts you upload are stored in Cloudflare object storage — solely to sync your data across your devices and provide the features you asked for. If you self-host, that data lives in your Cloudflare infrastructure and we receive nothing.
• Accounts and sign-in. You can use the entire local-first app without an account. If you sign in to use cloud sync (for example, with Google), we store the minimum needed to recognise you across sessions and to keep your synced data associated with you.
• Email reminders (optional). If you enable them on the cloud, we use your email address to send the budget alerts and spending reports you asked for. You can turn them off at any time.
• Payments. If you buy a paid cloud plan, payment is processed by Stripe. We don’t receive or store your full card number. We keep a record of your purchases and plan status to provide the Service and meet legal and accounting obligations.
• Newsletter (optional). If you sign up, we use your email only to send the updates you asked for, delivered through our email provider (Resend). You can unsubscribe anytime.
• Basic operation. Like most websites, we may process limited technical data (such as IP address and basic server logs) to keep the Service running, secure, and reliable. We don’t use advertising or third-party tracking analytics — no trackers, no data brokers.
• Cookies and local storage. The app sets only what it needs to work: a session cookie that keeps you signed in, and short-lived cookies that carry a passkey or two-step sign-in challenge between the steps of signing in. The bot protection on the sign-in screen (Cloudflare Turnstile) may set its own security cookie. Your local-first data, preferences and offline cache live in your browser’s local storage and never leave it unless you turn on cloud sync. Nothing here is used for advertising, analytics or tracking, so there is no cookie banner: strictly necessary cookies need no consent.
• We don’t sell your data, ever — and we never use your financial data to train or fine-tune machine-learning models.
• Your data is portable, and yours to delete. You can export everything to CSV or JSON at any time, clear your local data by clearing your browser storage, and — if you use the cloud — delete your account and the data associated with it. If you’re in the EU/EEA, you also have the rights to access, correct, port, and erase your data; contact us to exercise them.

We may update this notice at any time; when we do, we’ll change the date above. Questions or requests: privacy@tokencircles.com.