CapitalCurvePrivacy
Your money data stays yours.
CapitalCurve is a personal expense tracker. This page explains, in plain language, what we do with the information you enter — and, more importantly, what we do not do with it.
We never sell your data
Your transactions, budgets, notes, categories and accounts are not sold, rented, or shared with advertisers — ever.
Private to your account
Everything you log is tied to your account. Only you (and members you explicitly invite to a shared account) can see it.
CSV export is for you
When you export a CSV, it's generated for your view and downloaded to your device. We don't ship your CSV to any third party.
Only what's needed
We store the data you enter to make the app work — your email for sign-in, and the transactions you add. Nothing else.
Who we are (data controller)
CapitalCurve is operated by Capitalcurve, a business established in Belgium and trading as "CapitalCurve". Capitalcurve is the data controller for the personal data described on this page and decides why and how it is processed. You can reach us at support@capitalcurve.app.
What we store
Your email address (for authentication), your profile settings (display name, currency, monthly budget, language), and the transactions, categories, accounts and recurring rules you create inside the app.
Who can see it
Only you. For shared accounts, the members you invite can see the transactions on that specific shared account — nothing from your personal accounts. If you subscribe to Pro, our payment provider Paddle.com Market Ltd acts as Merchant of Record and receives the billing data you enter at checkout (name, email, address and tax details) to process the payment, invoice you and handle VAT. Paddle never receives your transactions or budgets.
Legal basis for processing (GDPR Art. 6)
We rely on: performance of a contract (Art. 6(1)(b)) to create and run your account, store your transactions and provide Pro features you purchase; legal obligation (Art. 6(1)(c)) for accounting, tax and invoicing records; legitimate interests (Art. 6(1)(f)) to keep the service secure, prevent fraud and abuse, and fix problems; and consent (Art. 6(1)(a)) for any non-essential cookies or optional communications, which you can withdraw at any time.
CSV & PDF exports
Exports are generated in your browser from your own data and downloaded directly to your device. We do not upload the resulting file anywhere.
How long we keep your data
Account and transaction data is kept for as long as your account is active. If you delete your account, your personal data is deleted from our production database within 30 days, and from encrypted backups within 90 days. Billing and invoice records held for legal and tax purposes are retained for 7 years as required by Belgian law. Security and error logs are kept for up to 12 months. Data we no longer need is deleted or anonymised.
How we protect your data
Data is hosted on Supabase (PostgreSQL) infrastructure in the EU, which is SOC 2 Type II certified. Traffic is encrypted in transit with TLS and data is encrypted at rest. Access is restricted per user by row-level security policies in the database, passwords are hashed and never stored in plain text, and administrative access is limited to what is strictly necessary. We never ask for your bank login. No system is perfectly secure, but we apply appropriate technical and organisational measures and review them regularly.
Deleting your data
You can delete any account (and its transactions) from the app at any time. Deleting your user account removes your data from our database.
Contact
Questions about privacy? Reach out through the sign-in page and we'll get back to you.