Privacy policy
What Metrivo holds about you, why, who else ever sees it, and what you can make us do about it. Written to describe what the software actually does today — not what we intend it to do later.
The short version.
Metrivo holds the budget you type into it, and an email address and name so you can sign in. It has no connection to any bank, so it never sees or stores your banking credentials, card numbers or statements. It takes no payment, so it holds no payment details. There is no advertising and no profiling.
We count page views on our public pages using Google Analytics, and only if you press Allow on the banner. Say no and nothing is loaded, nothing is requested from Google, and no cookie is set. Analytics never runs inside the signed-in app, so nothing about your budget is ever measured.
One feature sends data off this server: the AI insight button on the insights page, and only when you press it. What it sends is category names and totals — never your transactions, merchants, account balances, name or email. You never have to press it.
Who is responsible for your data
Metrivo is a budgeting service established and operated from Bulgaria. We are the data controller for everything described here, under the EU General Data Protection Regulation — and under its UK equivalent for anyone using Metrivo from the United Kingdom.
Metrivo is not yet incorporated as a company. Until it is, the controller is the individual who operates the service, reachable at the address below. When a company is registered this page will name it, and the version at the top will change on the day it does.
For anything on this page — a question, a request, or a complaint — write to privacy@metrivoapp.com. A person reads it; there is no ticketing system.
What we hold
Everything below is either something you typed, or something the software had to create to make signing in work. Nothing is bought from anyone, inferred about you, or collected in the background.
| What | Specifically | Why we have it |
|---|---|---|
| Your account | Email address, your name, the country you chose, and the currency, number format and budget period (monthly or weekly) that follow from it. The date you signed up, and which plan you are on. | To identify you, sign you in, and render your figures in the right currency and format. |
| Your password | Never the password. A scrypt hash with a random per-password salt. |
To check a sign-in without being able to read what you chose. Nobody here can recover your password, including us. |
| Your budget | The accounts you set up (nickname, type, balance you entered, any interest rate), your categories and targets, and every transaction you record — its date, description, merchant if you enter one, and amount. Recurring items, event plans and their line items, and savings goals. | This is the product. Without it there is nothing to show you. |
| Household data only if you join one |
Which household you are in and who else is in it, the monthly income figure you enter for the split ratio, the expenses you mark as shared, and settlements between you. | To split shared costs and keep a running balance of who has paid more. |
| Insights | The insights shown to you and whether you dismissed them. | So the same thing is not shown twice. |
| Sign-in machinery | A session record — a hashed token and an expiry, never the cookie value itself. Failed sign-in attempts, as an email address and a timestamp. Password-reset tokens, stored hashed. | To keep you signed in, to slow down someone guessing at your password, and to make reset links work once and then stop. |
What we do not hold
Stated explicitly, because in this category people are right to assume the worst:
- No bank credentials, and no bank connection. Metrivo cannot connect to a bank account. It never asks for banking logins and has no mechanism to use them.
- No card or payment details. Metrivo currently takes no payment at all.
- No advertising or profiling. No ad networks, no pixels, no fingerprinting, no session recording, no data sold or shared for marketing. Our analytics has Google Signals and ad personalisation switched off.
- No analytics inside the app. Page-view counting runs on the public marketing and guide pages only. The signed-in application — your dashboard, budget, transactions, everything with a figure in it — is never measured.
- No location data, no contacts, no device identifiers.
- No special category data. We do not ask about health, beliefs, ethnicity or anything else in GDPR Article 9. Please do not type such things into a transaction description — nothing stops you, and we would rather you did not.
- Nothing bought from a data broker, and nothing about you inferred from anyone else.
Cookies and similar storage
Always set — the one that signs you in
| Name | What it does | Settings | Life |
|---|---|---|---|
metrivo_session |
Keeps you signed in. It holds a random token; the server stores only that token's hash, so a copy of our database does not hand anybody a live session. | HttpOnly, SameSite=Lax, Secure |
30 days, or until you sign out |
metrivo_consentlocal storage |
Remembers whether you said yes or no to analytics, so you are not asked twice. Kept in your browser's local storage, not sent to us. | First-party, this browser only | Until you clear it or change your choice |
Both are strictly necessary — one provides the service you asked for, the other records a choice you made — so neither requires consent.
Only if you press Allow — analytics
We use Google Analytics 4 to count page views on our public pages. It is set to page views only: Google Signals and ad personalisation are switched off, so it cannot build an advertising profile from your visit.
| Name | What it does | Set by | Life |
|---|---|---|---|
_ga | Distinguishes one browser from another so a visit is not counted several times. | Google Analytics | 2 years |
_ga_FGGLTKT95F | Keeps track of the current visit. | Google Analytics | 2 years |
Nothing loads until you say yes. The analytics tag is not in our pages. If you have not chosen, or you chose no, your browser never contacts Google at all — no script is fetched, no cookie is set, and no request carrying your IP address is made. That is the difference between a banner that asks and a banner that informs, and it is the reason ours is worth clicking.
Refusing is one click, in the same place and at the same size as accepting. Closing the banner without choosing is not consent, and we will simply ask again next time.
Changed your mind? Use Cookie choice — it is in the footer of every page — to switch either way at any time. Withdrawing deletes the analytics cookies immediately and stops anything further being sent from the next page load onwards.
Our lawful bases
| What we do | Basis (GDPR Article 6) |
|---|---|
| Running your account and showing you your budget | Performance of a contract — 6(1)(b) |
| Throttling failed sign-ins, hashing tokens, keeping the service secure | Legitimate interests — 6(1)(f): keeping other people out of your financial records |
| Sending a summary to OpenAI when you press the insight button | Consent — 6(1)(a). Pressing the button is the consent, and not pressing it costs you nothing else |
| Counting page views with Google Analytics | Consent — 6(1)(a), and ePrivacy consent for the cookie. Withdrawable at any time, and refusing costs you nothing |
| Keeping records we are required to keep | Legal obligation — 6(1)(c) |
Who else ever sees it
We do not sell your data, we do not share it for advertising, and there is no third party receiving a copy of your budget in the background. The complete list of everyone with any access at all:
Railway — hosting
The application and its database run on Railway, in their Amsterdam region — so your data physically sits in the Netherlands, inside the EEA. Hosting therefore involves no international transfer at all. The database is a single file on a Railway volume; Railway is our infrastructure provider and processes data on our instructions.
Cloudflare — DNS and traffic
Requests to metrivoapp.com pass through Cloudflare, which handles DNS and sits in front of the application. In doing so it processes connection metadata including your IP address, as any network provider between you and a website does.
OpenAI — only when you press the button
The insights page has a button that asks a language model to explain your figures. It is the only feature in Metrivo that sends anything off our server, and it does nothing until you press it.
What is sent is a summary. Precisely:
- your currency, the period label, and whether you budget monthly or weekly;
- period totals — income, income not yet due, spent, unfiled, budgeted, set aside for plans and goals, left over;
- for each category: its name, its group, what was budgeted, what was spent, and whether it is over;
- the names of categories with no target set;
- the headings of insights the app has already worked out locally, so the model does not repeat them.
What is never sent:
- individual transactions, their descriptions, or their dates;
- merchant names;
- account names, institutions or balances;
- your name, your email address, or any identifier for you;
- anything about the other people in your household.
This is not a promise about intentions — it is one function in the source code, and there are tests that fail if anything else is added to it. OpenAI processes the request in the United States; the transfer relies on Standard Contractual Clauses and OpenAI's API terms, under which API data is not used to train their models.
You can avoid it entirely by simply not pressing the button. Everything else on the insights page is worked out on our own server and appears whether or not that feature is used at all.
Google Analytics — only with your consent, public pages only
If you press Allow, Google Analytics counts your page view. Google receives your IP address, the page you are on, the page you came from, and general details of your browser and device. For visitors in Europe the service is provided by Google Ireland Limited; processing takes place on Google infrastructure including in the United States, and Google LLC is certified under the EU–US Data Privacy Framework, with Standard Contractual Clauses in place besides.
We have configured it as narrowly as it will go: page views only, Google Signals off, ad personalisation off, IP anonymisation on. We do not use it for advertising and have no ads product. It runs on the marketing and guide pages and never inside the signed-in app, so no page containing your financial data is ever measured.
If you press No thanks, none of the above happens — the script is never loaded.
Google Fonts — on the public pages only
The homepage and the guides load their typefaces from Google Fonts, which means your browser contacts Google and Google sees your IP address when you view those pages. The signed-in application does not do this — it serves its fonts from our own server. We would like to fix this on the public pages too; it is on the list.
Your household
If you join a household with someone, that is sharing, and it is worth being clear about. They can see the expenses you mark as shared, the running balance between you, shared category targets and shared event plans. They cannot see your personal transactions, your personal categories, your individual accounts or your personal goals. The monthly income figure you enter is used to work out the split ratio.
One exception, and only in “one pot”. A household is set either to one pot — money treated as the household’s rather than divided — or to keeping score. In one pot, and only there, each of you sees a single figure for what the other holds across their open accounts, on the Wallet tab of the shared page. It goes both ways. It is one total and nothing else: which accounts they are, what is in each of them, and every transaction behind the figure stay private. Set the household to keeping score in Settings and neither of you sees it — the figure is not hidden from the page, it is never sent to it.
A shared plan’s pot is the other. When a saving plan is shared, each member sees when the others put money into that plan and how much — a date, an amount and a name, on that plan’s page. You are filling the same pot, and a total on its own cannot say whether it got there steadily or in one go. It goes no further than those three things: which account the money came from, and whatever the person called the payment, are not sent. Contributions to your own, unshared plans are not visible to anybody.
Money you hand to each other is the third. If you record money handed to another member of your household, they are told: the date, the amount, your name and the note you typed, so they can record it arriving in one of their own accounts. That is the point of it — it is a payment addressed to them. Which of your accounts it came out of is not sent, and the row they write afterwards is theirs alone. Nobody else in the household sees it, and it is not counted as spending or income for either of you.
Leaving the EEA
Your budget itself never does: it lives in Amsterdam and is not copied anywhere else. Two things can cross the Atlantic, and only in the narrow circumstances described above — the summary sent to OpenAI when you press the insight button, and the page view sent to Google if you accepted analytics. Both rely on Standard Contractual Clauses, and Google LLC is additionally certified under the EU–US Data Privacy Framework. Decline the analytics banner and never press the insight button, and nothing about you leaves the EEA.
How long we keep it
| Your account and everything in it | Until you ask us to delete it |
| Session records | 30 days, and removed when you sign out or reset your password |
| Password reset tokens | One hour, and spent the moment they are used |
| Failed sign-in attempts | A 15-minute window; older rows are swept away on the next successful sign-in |
| Analytics, if you allowed it | Held by Google under our property's retention setting. The cookies themselves expire after 2 years, or when you clear them |
Being straight about a limitation: there is no automatic deletion of dormant accounts, and no scheduled purge. If you want your data gone, ask, and we will do it by hand.
Your rights
Under the GDPR you can require us to:
- Give you a copy of everything we hold about you (access, Article 15);
- Correct anything wrong (rectification, Article 16) — most of this you can do yourself in the app;
- Delete your account and its contents (erasure, Article 17);
- Restrict or object to what we do with it (Articles 18 and 21);
- Receive it in a portable format to take elsewhere (portability, Article 20);
- Withdraw consent at any time — for analytics, through the Cookie choice link in the footer; for the AI feature, simply by not using it.
How this works in practice, honestly. There is not yet a button in the app for deleting your account or exporting your data. Both are done by hand: email privacy@metrivoapp.com and we will action it within 30 days, as the regulation requires, and confirm when it is done. Self-service versions of both are planned; until they exist, the email address is the mechanism and it works.
If you think we have handled your data badly, please tell us first — but you have every right to go straight to a regulator instead. In Bulgaria that is the Commission for Personal Data Protection (Комисия за защита на личните данни), cpdp.bg. You may also complain to the supervisory authority in the EU country where you live.
How it is protected
- Passwords are hashed with
scryptand a random per-password salt, and compared in constant time. - Session and reset tokens are stored only as SHA-256 hashes, so a leaked database contains no usable session.
- Resetting a password invalidates every existing session on that account.
- Repeated failed sign-ins for an address are throttled, in a way that does not reveal whether the address is registered.
- All traffic is over HTTPS.
What we will not claim: there has been no independent security audit, and no penetration test. Metrivo is a small product in active development and you should weigh that.
Children
Metrivo is not intended for anyone under 16. We do not knowingly hold data about children; if you believe we do, write to us and it will be removed.
Things Metrivo does not do
Named because their absence is the point, and because a policy silent about them would leave you guessing. Nothing here is a plan; if any of it ever changes, this page is updated before the change ships.
- Bank connections. Metrivo does not connect to a bank, and no part of it is built to. It never asks for a banking login and has no mechanism to use one. Transactions reach Metrivo because you enter them, because a recurring item you set up records itself, or because you imported a statement file yourself.
- Payments. No payment is taken and no payment details are held. A payment processor would be added here first.
- Email. There is no email sender, so Metrivo sends you nothing — no marketing, and not even a password reset.
Changes
When this policy changes we will update the version and date at the top. For a change that materially affects you — a new recipient of your data, a new purpose — we will tell you directly rather than quietly editing the page, once there is a means of doing so.
Questions about any of this
Write to privacy@metrivoapp.com. If something here is unclear or seems wrong, that is worth knowing — a privacy policy nobody can follow is not doing its job.
Read the terms of service