Privacy Policy

Last updated: September 13, 2026

This Privacy Policy explains how Sova — Budget & Split ("Sova", "the app", "we", "us"), a mobile application by kodmap, handles information when you use it on iOS and Android. We built Sova to be private by default: you can track your budget and use core features without creating an account.

The short version. Your personal budget, accounts, and transactions are stored on your device. When you use shared groups, that group's expenses are synced so members can see them. We collect pseudonymous usage and crash data to keep the app working, and your subscription status to unlock Pro. We never ask for your bank logins or card numbers, we do not sell your data, and we never collect your precise location.

1. Information we process

  • Financial data you enter — accounts, transactions, amounts, categories, budgets, savings goals, and recurring bills. This is entered manually by you and stored locally on your device. It may be sent to our backend only to power features you request (such as shared groups or optional backup).
  • Shared group data — if you use groups to split expenses (a Pro feature), the group's shared expenses, splits, "who owes whom" balances, and your chosen display name are synced via Google Firebase so other members of that group can see them.
  • Account identifier — the first time you open the Groups tab, the app creates an anonymous account for you automatically through Firebase Authentication. You are not asked for anything and we receive no personal details: it is a random identifier that lets a group tell its members apart. It stays on this install.
  • Display name — the name you choose to be known by inside a group. Optional; until you set one you appear to other members under a generic label. It is visible to the other members of any group you join.
  • Sign-in with Apple or Google (optional) — you only need this to reach your groups from a second device. If you use it we receive, from the provider, an identifier and the email address associated with that sign-in. Sign in with Apple lets you hide your address, in which case we receive only Apple's private relay address and never your real one. We use the address to identify your account; we do not send marketing to it. Signing in upgrades the anonymous account you already have — your groups stay where they are.
  • Usage & analytics data — pseudonymous events about which screens and features you use, via Google Firebase Analytics. Used to understand and improve the app.
  • Diagnostics & crash data — device model, OS version, app version, and crash stack traces, via Firebase Crashlytics.
  • Notifications token — if you enable notifications, a push token via Firebase Cloud Messaging, used only to deliver bill reminders and updates.
  • Purchase & subscription status — whether you have an active Pro subscription, via RevenueCat and the Apple App Store / Google Play. We never see or store your payment card details; billing is handled entirely by the stores.

2. What we do not collect

We do not collect your bank login credentials, card numbers, or account numbers — Sova uses manual entry only and never connects to your bank. We do not collect your precise GPS location, contacts, or photos, and you can use personal budgeting without signing in. We do not use your data to build advertising profiles, and we do not sell your data.

3. Shared expenses

Sova helps you record and split expenses with people you choose. It does not move money or process payments — settling up happens directly between you and your group outside the app. Balances shown in the app are informational records based on what you and your group enter.

4. Financial data

Your financial records can be sensitive. We treat this information as private, keep it on your device by default, do not sell it, and only transmit it when needed for a feature you actively use (such as a shared group or backup). Amounts are stored as exact minor units, never approximated.

5. Multi-currency

To convert between currencies, the app fetches reference exchange rates from a rates provider. These requests contain currency codes only — no personal or financial details about you.

6. Third-party services

Sova relies on these processors, each under their own privacy terms:

  • Google Firebase (Authentication, Firestore, Realtime Database, Storage, Analytics, Crashlytics, Cloud Messaging, App Check) — accounts, shared-group sync, analytics, diagnostics, notifications, and abuse protection.
  • Apple — only if you choose Sign in with Apple, to verify that sign-in.
  • RevenueCat — subscription management.
  • Apple App Store / Google Play — app distribution and billing.
  • An exchange-rate provider — currency conversion.

7. Data retention & security

On-device data remains until you delete it or uninstall the app. Shared-group data remains until the group is deleted or you leave it. We may also delete a shared group that nobody has used for 24 months — no expenses, settlements or edits in that time — together with its expenses; we will not touch a group that is still in use. Analytics and diagnostics data are retained by our processors for limited periods per their policies. Sova also offers an in-app lock (PIN and Face ID / Touch ID); biometric checks are performed by your device and we never receive your biometric data. We use industry-standard measures to protect data in transit and at rest, though no method is 100% secure.

8. Your choices & rights

  • Delete your data — clear it in the app or uninstall to remove on-device data. To erase everything we hold on our backend, open Settings → Groups → Delete account in the app. This works whether or not you ever signed in with Apple or Google: it deletes your profile, removes you from every group, deletes any group you owned alone, and deletes the authentication record itself. Groups you shared with other people survive without you — your name is removed from them, while the expenses you were part of stay so the group's balances still add up. You can also write to us and we will do it for you.
  • Notifications — turn reminders off anytime in your device settings or in-app.
  • Analytics — you may limit analytics through your device's privacy settings.
  • Depending on your region (e.g. EEA/UK GDPR, California CCPA), you may have rights to access, correct, or delete your information. Contact us to exercise them.

9. Children

Sova is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect data from them.

10. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above.

11. Contact

Questions or requests: kodmapdev@gmail.com.