Privacy Policy
1. Who is the data controller?
The data controller for Forra is:
Michael Salah Milik Andrawos
Bienengasse 9/22, 8020 Graz
Austria
Email: [email protected]
You can reach us in English, German, or Arabic.
2. What data we collect and why
We collect only the data Forra needs to function. Every item below is named, justified, and tied to a legal basis under GDPR Article 6(1).
| Data category | Why we collect it | Legal basis (Art. 6(1)) | Retention |
|---|---|---|---|
| Account credentials (email, hashed password) | Authenticate you; restore your sessions | (b) contract performance | Account lifetime + 24h post-deletion |
| Family memberships + display name | Family-scoped data isolation | (b) contract performance | Account lifetime + 24h post-deletion |
| Shopping list items + checked status | Core product feature | (b) contract performance | Account lifetime + 24h post-deletion (items added by other family members survive on the shared list) |
| Expense entries (amount, category, date, note) | Core product feature + AI recap input | (b) contract performance | Account lifetime + 24h post-deletion; invoice-relevant entries retained 7 years per Austrian Tax Code § 132 BAO |
| Income entries | Core product feature | (b) contract performance | Same as expenses |
| Recurring expense + income rules | Auto-post automation | (b) contract performance | Account lifetime + 24h post-deletion |
| Voice recordings (microphone audio) | Speech-to-text transcription | (a) your explicit consent — one-time JIT modal | Not retained — discarded immediately after one transcription request |
| Voice transcripts (text result) | Display + intent extraction | (a) your explicit consent | Account lifetime + 24h post-deletion |
| Voice & AI consent flag | Remember whether you accepted the one-time JIT consent so we don't re-prompt | (a) your explicit consent (state of) | Account lifetime + 24h post-deletion; revokable anytime via Settings → Privacy → Voice & AI |
| AI summary cache | Recap result memoization | (b) contract performance | Same as expenses |
| Crash reports | Bug detection + diagnosis | (f) legitimate interest — opt-out anytime via Settings → Privacy | 90 days at Sentry, then aggregated |
| Push notification tokens | Deliver notifications you opted into | (a) consent (OS-level prompt) | Until you rotate the token or delete your account |
| Invitation reminder email | Tell you when an invitation you created is about to expire unused. Sent to you, never to the person you invited — we hold no contact details for them | (f) legitimate interest — a service message about your own invitation, not marketing. Switch off anytime in Settings → Notifications, or via the one-click unsubscribe in the email | A delivery record (type, recipient, success) is kept 30 days; the email text is never stored |
| Invitation feedback answer | Three one-tap answers about why an invitation was not taken up | (f) legitimate interest — stored as anonymous counts only. No user, family, invitation reference or token is recorded, so an answer cannot be traced to anyone, including by us | Indefinite, as three running totals holding no personal data |
| How you heard about Forra (mobile app only) | One optional, one-tap question (e.g. Instagram, TikTok, a friend) so we know where to tell other families about Forra. You can skip it | Your answer: (a) your consent, given by choosing it — ask us at [email protected] to delete it at any time. If you skip: (f) legitimate interest — we keep only that you skipped, when, and how many times, so we ask again at most twice more, a month apart, and then never | Account lifetime + 24h post-deletion |
| Questionnaire answers (mobile app only): who you manage money with, your main goal, monthly household income after tax (a range, or an exact amount if you typed one), the 3–5 spending areas you picked with any amounts you entered, and how you track money today | Build your starting plan before you sign up, turn it into your household’s first budget, and later fill in the Home checklist forms so you don’t type the same numbers twice. The answers stay only on your phone until your household exists; they are then sent once to set it up. Your household members can see them | (b) contract performance — the starting budget is the service you asked for | As long as the household exists; deleted with the household, or with your account if you created it. Answers left unused on a phone are deleted there after 30 days |
| Onboarding step counts (mobile app only) | Count how many people reach each step of getting started (each question, the plan, sign-up, creating the household), so we can see where people give up and fix it | (f) legitimate interest — anonymous daily totals only: per day, step, platform and app language. No identifier is stored on your phone or on our servers for this, no IP address is kept, and no answer content is included, so a count cannot be traced to anyone, including by us | 6 months, then deleted automatically |
| IP-based approximate-location (city/country) | Password-change email recognition signal | (f) legitimate interest | Not stored after the password-change email is sent |
| Subscription state | Unlock the paid features for you and, because one subscription covers the whole household, for the other members of your household. They see that the household is covered and the display name of the member whose subscription covers it — never your store, plan, price or renewal dates. We also keep the price your app store showed when you subscribed and whether you switched off renewal, only so the trial reminder below can be right. A household created after Premium became required pauses while nobody in it has a subscription; its data is kept, not deleted | (b) contract performance | Subscription lifetime + 30 days for fraud-investigation audit |
| Trial reminder (when you start a free trial): your email address and display name, the trial's end date, the price your store showed, and your household's name | Two days before a free trial turns into a payment, we send you one email (and one push notification, if you allow notifications) with the date, the price and how to cancel. We record that it was sent, so you get it once | (b) contract performance — the reminder is part of the trial we offer you | The record of the reminder is deleted with your account; the email itself is delivered by Resend (see § 3) |
| Experiment counts (households created after Premium became required) | Count, per household, when it was created, started a trial, became paying, paused or came back, so we can decide whether to keep requiring Premium for new households | (f) legitimate interest — counts per household only: no names, no amounts, no device identifiers | Deleted with the household, and at the latest 12 months after the experiment ends |
| Account-deletion audit log | Fraud investigation + GDPR audit trail | (f) legitimate interest | 30 days from deletion confirmation |
| Advertising identifier (IDFA on iOS / Advertising ID on Android) + app & purchase events shared with Meta (mobile app only) | Attribution — measure which Meta ad led you to install Forra, so we can evaluate our own advertising (see § 4) | (a) your explicit consent — iOS: the App Tracking Transparency prompt; Android: a one-time in-app prompt. Nothing is shared unless you allow it | Processed and retained by Meta per its own policy; Forra's own servers do not store it |
What we do NOT collect: precise location coordinates, contacts, photos, files outside Forra, browsing history, or your behavior on other apps. This website contains no third-party analytics or tracking pixels. The only advertising-attribution technology anywhere in Forra is the Meta SDK inside our mobile app, described in § 4 — and it activates only if you grant permission: on iOS through the App Tracking Transparency prompt, on Android through a one-time in-app consent screen shown when you first open the app. If you decline, nothing is shared with Meta, and Forra never uses your data to show you ads or to build an advertising profile of you.
3. Sub-processors
Forra uses these third-party services to deliver the product. Each has a signed Data Processing Agreement with Forra under GDPR Art. 28. Transfers to US-based sub-processors rely on the EU Standard Contractual Clauses (Art. 46) and supplementary measures as required by the Schrems II ruling.
| Sub-processor | Country | Role | DPA |
|---|---|---|---|
| Supabase, Inc. | EU (Frankfurt) | Database, authentication, edge functions, file storage | supabase.com/legal/dpa |
| OpenAI, LLC | United States | Voice transcription (Whisper) + intent extraction (GPT-4o-mini) | openai.com/policies/data-processing-addendum |
| Resend, Inc. | United States | Transactional email delivery (sign-up, password, invite and free-trial reminder emails) | resend.com/legal/dpa |
| Functional Software, Inc. (Sentry) | United States | Crash reporting (opt-out anytime) | sentry.io/legal/dpa |
| RevenueCat, Inc. | United States | Subscription billing receipts + webhook delivery | revenuecat.com/dpa |
| Meta Platforms Ireland Ltd. | EU (Ireland) | Mobile app-install attribution & advertising measurement — active only with your tracking consent (see § 4) | facebook.com/legal/terms/dataprocessing |
| ipapi.co | United States | IP-based approximate location for password-change emails | ipapi.co/privacy |
4. Advertising attribution (Meta)
Forra's mobile app includes the Meta SDK so we can measure how well our own advertising on Facebook and Instagram performs — specifically, whether a Meta ad led you to install Forra. This is called attribution. Forra shows no ads inside the app; this is only about evaluating the ads we run about Forra.
- What is shared with Meta: your device's advertising identifier (IDFA on iOS) and basic app events such as install and app opens. If you make a purchase, the purchase event may also be shared so we can measure campaign value.
- Who receives it: Meta Platforms Ireland Limited, which may combine it with data Meta already holds about your device in order to match your install to an ad. This constitutes tracking as Apple and the GDPR define it, and it is disclosed as such on Forra's App Store privacy label.
- Legal basis: your explicit consent (GDPR Art. 6(1)(a)). On iOS this consent is the App Tracking Transparency prompt shown when you first open Forra; if you choose "Ask App Not to Track," your advertising identifier is not read and this attribution does not take place. On Android, where there is no system-level tracking prompt, Forra shows a one-time in-app consent screen the first time you open the app; the Meta SDK stays completely switched off — it does not initialize, does not collect your advertising ID, and sends no events — unless you tap Allow.
- How to change your mind: On iOS, go to Settings → Privacy & Security → Tracking and turn tracking off for Forra at any time. On Android, you can reset or delete your advertising ID in Settings → Privacy → Ads (Meta then receives no usable identifier), and you can email [email protected] to object to this processing or ask us to delete data already shared — we will act on your request and ask Meta to delete it. Reinstalling the app also lets you make a fresh choice.
- What we never do: Forra does not show you ads inside the app, does not build an advertising profile of you, and does not sell your data. This data is used solely to measure our own install campaigns.
5. Voice input and AI (EU AI Act Art. 50)
When you use Forra's voice input feature:
- Your microphone audio is sent to OpenAI Whisper for speech-to-text transcription.
- The resulting text transcript is sent to OpenAI GPT-4o-mini to extract structured intent (e.g., "add milk to shopping list" → a `shopping_item_added` action).
- The audio recording is not retained by OpenAI or Forra after transcription completes.
- You always confirm or edit the parsed result before Forra writes anything to your data.
- You can revoke consent for voice anytime in Settings → Privacy → Voice & AI.
Voice input is part of Forra's optional paid subscription (€4.99/month or €49.99/year). If you do not subscribe, the voice button does not appear.
Siri (iPhone)
If you turn on Settings → Siri in the Forra app, you can use Forra by voice through Siri on that iPhone:
- Apple handles the speech: Siri turns what you say into text under Apple's own privacy policy. Forra never receives your voice recording.
- Forra receives the text of your request and who you are (your Forra account), and answers with figures from your household. To understand a new expense, income or shopping item, that text is sent to OpenAI GPT-4o-mini, exactly as for the voice button. Questions such as "what's left" use no AI.
- For each request Forra keeps a short record: which command it was, whether it succeeded, the language, and what it saved (so you can undo it). It does not keep what you said. These records are deleted after 90 days.
- Connecting creates a separate sign-in for that iPhone, stored in the iPhone's Keychain. Turning Siri off, signing out or deleting your account ends it at once. The record that an iPhone was connected is deleted 90 days after it was disconnected, or immediately when you delete your account.
- Siri can answer on a locked iPhone, so anyone holding your phone can hear your household's figures. Turn Siri off in the Forra app if you don't want that.
Siri in Forra is part of the same optional subscription as the voice button.
6. Account deletion
You can delete your account anytime from Settings → Account → Delete account inside the Forra app. We commit to:
- Confirming your deletion with your password.
- Completing the deletion cascade within 24 hours of your confirmed request.
- Sending you a confirmation email when deletion completes (no clickable recovery link in that email — see /delete-account).
- Retaining only what Austrian law requires us to keep: invoice records (7 years per Tax Code § 132 BAO) and a 30-day account-deletion audit log entry for fraud investigation.
7. Your rights under GDPR
You have these rights regarding your personal data:
- Access (Art. 15): request a copy of all data we hold about you.
- Rectification (Art. 16): correct any inaccurate data.
- Erasure (Art. 17): delete your account and all associated data (see § 6).
- Portability (Art. 20): receive your data in a machine-readable format.
- Objection (Art. 21): object to processing based on legitimate interest (e.g., turn off crash reports).
- Withdrawal of consent (Art. 7(3)): revoke your consent at any time — including tracking consent (see § 4). Withdrawal does not affect processing that was lawful before withdrawal.
To exercise any of these rights, email [email protected]. We will respond within 30 days per Art. 12(3).
8. Right to complain
If you believe Forra is mishandling your data, you can lodge a complaint with the Austrian data protection authority:
Österreichische Datenschutzbehörde
Barichgasse 40-42, 1030 Wien, Austria
www.dsb.gv.at
9. Breach notification
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, Forra commits to notifying:
- The Austrian Datenschutzbehörde within 72 hours of becoming aware (GDPR Art. 33).
- You directly, without undue delay, if the breach is likely to result in a high risk to your rights and freedoms (Art. 34).
10. Automated decision-making
Forra does not make any solely-automated decisions about you that produce legal or similarly significant effects. The AI recap is informational only and does not change any state without your action; voice input always returns a transcript for your manual confirmation before writing to your data.
11. Changes to this policy
When we materially update this policy, we will notify you in-app and via email when the changes take effect, per Art. 13(3). The current version + "Last Updated" date appears at the top of this page.