Your household's data is stored in the EU, in Frankfurt, and only members of your household can see it. Forra shows no ads and never sells your data. The only advertising measurement, through Meta, runs only if you allow tracking.
Who can see your household's data
Only the people in your household. The database enforces this itself, and each request is checked against your account, so even a bug in the app can't show one household's data to another.
How it's protected
- Everything travels over encrypted connections (HTTPS).
- Our database provider, Supabase, encrypts stored data.
- Passwords are stored as one-way hashes by our sign-in provider. Nobody at Forra can read them.
- Changing your password signs out your other devices and sends you a confirmation email.
AI and your numbers
- The monthly report and recap are calculated with plain arithmetic. No AI model sees your expenses or income.
- Voice input (Premium) sends your recording to OpenAI to turn it into text and an item or expense. Forra asks your permission first and doesn't keep the audio. Switch it off any time in Settings › Privacy › Voice & AI.
Crash reports and tracking
- Crash reports help us fix bugs. They carry an anonymous account ID but no names, email addresses or household entries. Switch them off in Settings › Privacy › Send crash reports.
- Install measurement through Meta runs only if you allow tracking when Forra asks.
Services we use
These providers process data for us under a data processing agreement. The Privacy Policy is the authoritative list.
| Provider | Location | What for |
|---|---|---|
| Supabase, Inc. | EU (Frankfurt) | Database, sign-in, background jobs, file storage |
| OpenAI, LLC | United States | Voice transcription and understanding (voice input only) |
| Resend, Inc. | United States | Sending account emails |
| Functional Software, Inc. (Sentry) | United States | Crash reporting (you can opt out) |
| RevenueCat, Inc. | United States | Subscription receipts |
| Meta Platforms Ireland Ltd. | EU (Ireland) | App-install measurement, only with your tracking consent |
| ipapi.co | United States | Approximate location shown in password-change emails |
Transfers to US providers are covered by the EU Standard Contractual Clauses.
Your data, your call
- Delete your account in Settings › Account. It's done within 24 hours. How.
- For a copy of your data or any other privacy request, email [email protected]. We answer within 30 days.