Privacy Policy

Effective June 1, 2026 · Last updated October 18, 2026

Welcome to Bēquebēque. We take your privacy seriously — especially because this app exists to hold some of your most personal information: your money. This Privacy Policy explains in full detail what data we collect, why we collect it, how it is stored and protected, and what rights you have over it. Please read it carefully.

By using Bēquebēque, you agree to the practices described in this policy. If you do not agree, please do not use the app.

1. Who we are

Bēquebēque is a personal budgeting application designed and developed by Kyle Garcia. The app is intended for personal use and for sharing with a small community of trusted users. It is not operated by a corporation and does not have investors, advertising partners, or data brokers.

For any questions about this policy or your data, contact us at hello@bequebeque.com.

2. What information we collect

We collect only what is necessary to provide the app's functionality. This falls into three categories:

2a. Information you provide directly

• Budget categories (buckets) — names, icons, colors, allotted amounts, savings floors and ceilings, and any configuration you apply to them.
• Transactions — names, amounts, dates, due dates, notes, and whether they have been paid or saved.
• Funds and income figures — the income you log in your buckets. If you set a monthly funds figure in Settings before funds moved into a bucket, we also keep a copy of those figures so the move can be undone.
• Widgets — the dashboard widgets you create, including their labels, types, colors, and linked buckets.
• Notes — any free-text notes you attach to transactions.
• Survey answers — if you answer one of our short feedback surveys (sent by email once after a long break, or once after your first month), we keep your answers together with your account so we can read them as feedback. They are read only by us, never shared or sold, and are deleted with your account.

This information exists in our database solely to power your experience in the app. It is never sold. The only times any of it leaves our database are when you use a feature that needs it — the AI features, email reminders and push notifications — each described in Section 5. Please read the Google Gemini entry there in particular: it explains how Google may use what the AI features send it.

2b. Information collected via Google Sign-In

Bēquebēque uses Google OAuth for authentication. When you sign in with Google, we receive:

• Your name — displayed in the app header and settings.
• Your email address — used as your account identifier.
• Your profile photo — displayed as your avatar in the app.
• Your Google user ID — a unique identifier used internally to associate your data with your account.
• OAuth access token — a short-lived credential used only for authentication. We currently use this only to verify your identity at sign-in.

We do not request access to your Google contacts, search history, YouTube activity, or any other Google data beyond what is listed above.

2c. Automatically collected information

We run a small, privacy-respecting usage counter that we built ourselves — no third-party analytics service, no advertising trackers, no fingerprinting tools. It works like this:

• Anonymous browser ID — your browser is assigned a random identifier (a string of random characters stored in your browser). It is not derived from your identity, device, or IP address, and it tells us nothing about who you are. It only lets us count "one visitor" instead of "five page loads."
• Page visits and time on page — we record which pages of the site are opened and roughly how long they stay on screen.
• Clicks on a few key buttons — such as the sign-up buttons on the homepage, so we know which ones people actually use.
• Sign-up attribution — the first time you sign in, we record that a visitor went on to create an account, so we can measure what share of visitors sign up. We deliberately do not record which account, so there is no stored link between a browser's activity and any person. Your page visits and time-on-page records cannot be traced back to you, your account, or your name.

This data lives in our own database alongside the rest of the app's data, is never shared with or sold to anyone, and is only ever viewed as aggregate numbers ("120 visits this week"), not as individual browsing trails. We do not collect your IP address for tracking purposes. Standard server logs (request paths, response times) may be generated by our hosting provider (Vercel) as part of normal infrastructure operation, but these are not used to build profiles or track user behavior.

3. How we use your information

Your information is used for one purpose: to make Bēquebēque work for you. Specifically:

• To display your budgets, transactions, and savings progress across months.
• To authenticate your identity and protect your account.
• To authenticate your identity via Google Sign-In.
• To calculate recurring transaction schedules and project future months.
• To generate dashboard widgets and statistics based on your financial data.
• To answer your questions in Ask Bekbek, write the AI summaries on the Statistics page, and read a spreadsheet you choose to import — only when you use those features.
• To send you due-date reminders by email or push notification, if you turn them on.

We do not use your data for advertising. We do not sell your data. We do not share your data with third parties for their own purposes, with one exception you should know about: the AI features, as explained under Google Gemini in Section 5. We do not build behavioral profiles. We do not use your financial information to make automated decisions that affect you outside the app.

4. Data storage and security

Your data is stored in a PostgreSQL database hosted by Supabase, a trusted infrastructure provider. The following security measures are in place:

• Per-user data isolation — every single database query is scoped to your authenticated account. One account can never read, edit, or delete another account's buckets, transactions, or any other financial data through the app. This is enforced on every read and write across the entire API. The one exception is described below under Administrator access.
• Row-level security (RLS) — enforced at the database level on all tables as a second layer of defense. Even if our public API key were exposed, the database itself rejects any direct read or write to rows that do not belong to you. We verify this regularly.
• Server-side API routes — all database operations go through Next.js API routes running on the server. The browser never has direct access to your database, and the privileged database key never leaves the server.
• Authentication via NextAuth.js — every API request verifies your session before any data is read or written. Unauthenticated requests are rejected with a 401 error.
• HTTPS — all data in transit is encrypted via TLS. Bēquebēque is served exclusively over HTTPS.
• Environment variable isolation — sensitive keys (database service role key, NextAuth secret, Google OAuth credentials) are stored as environment variables and are never exposed to the client or committed to source control.

No security system is perfect, and we cannot guarantee absolute security. However, we have taken reasonable and industry-standard precautions to protect your data.

4a. Administrator access

As the sole developer and operator of Bēquebēque, Kyle Garcia has access to an internal admin dashboard used to operate and support the app. This dashboard shows account-level information only: your name, email address, profile photo, account creation date, last active date, and notification preferences. It is used to monitor app health, send service announcements (like the ones described in Section 3), and process account deletion requests.

The admin dashboard also shows the aggregate website statistics described in Section 2c — total visit counts, average time on site, button click counts, and sign-up numbers. These are always shown as combined totals across all visitors, never as any individual person's browsing activity.

The admin dashboard never displays your financial data — buckets, transactions, funds figures, widgets, or notes remain visible only within your own account and are never shown in this view.

5. Third-party services

Bēquebēque relies on a small number of trusted third-party services to operate:

• Supabase — database hosting and storage. Your financial data lives on Supabase's infrastructure. Supabase's own privacy policy applies to their infrastructure operations. supabase.com/privacy
• Google OAuth — used only for sign-in. We request your name, email, and profile photo. No other Google data is accessed. Google's privacy policy governs Google's own handling of your data. policies.google.com/privacy
• Vercel — app hosting and deployment. Bēquebēque is hosted on Vercel's platform. Vercel may generate standard server logs as part of operating the infrastructure. vercel.com/legal/privacy-policy
• Google Gemini — the AI model behind Ask Bekbek and the spreadsheet import. When you use one of these, the relevant data is sent to Gemini to get an answer: for Ask Bekbek, your question, your recent messages in that chat and a summary of your buckets, entries and funds; for an import, the contents of the file you uploaded. Nothing is sent unless you use the feature. Bēquebēque currently uses Gemini's free tier. Under Google's terms for the free tier, Google may use what is sent, and the answers it gives, to provide, improve and develop Google's products, and human reviewers at Google may read it. ai.google.dev/gemini-api/terms · policies.google.com/privacy
• Groq — the AI provider behind the Statistics summaries, which never go to Gemini. A summary sends Groq the chart you asked about plus a summary of your spending history: monthly totals and each bucket's averages. Groq does not keep these requests by default; it may log them for up to 30 days, only to fix errors or investigate abuse, and does not use them for anything else. groq.com/privacy-policy
• Cloudflare Workers AI — the backup for Ask Bekbek and the spreadsheet import: if Gemini is unavailable, the same request goes to Cloudflare instead, with the same data as described under Google Gemini. Cloudflare does not use what is sent to train AI models or to improve its own or anyone else's services. developers.cloudflare.com/workers-ai/platform/data-usage · cloudflare.com/privacypolicy
• Resend — sends our emails. If you turn on Email Notifications, it receives your email address, your first name and the content of each email, which for due-date reminders includes the names and amounts of the entries that are due. It also sends the occasional service announcement, a note when a bug you reported is fixed, and two one-time emails: a check-in if you have been away for 30 days, and a thank-you after your first month. Each carries a link to a short survey. resend.com/legal/privacy-policy
• Your browser's push service — if you turn on Push Notifications, reminders are delivered through the push service your browser uses (run by Google, Apple or Mozilla, depending on the browser). The contents of each notification are encrypted before they leave our server, so the push service can deliver them but not read them.

Want to keep your data to yourself? Turn off AI Insights in Settings → Data on each device you use: Ask Bekbek and the Statistics summaries switch off, and nothing from your account is sent to any AI provider. The spreadsheet import only ever runs on a file you choose to upload, and everything else in the app works exactly the same. Email and push reminders can be turned off in Settings → Notifications.

No other third parties have access to your data. We do not use advertising networks, social media pixels, A/B testing platforms, customer data platforms, or any other tracking services.

6. Google API scopes

We currently request the following OAuth scopes during sign-in:

• openid, email, profile — used to authenticate you and display your name and profile photo.

7. Data retention

Your data is retained for as long as your account exists. We do not automatically delete old transaction data, as historical records are part of the core value of a budgeting app.

The one exception is your Ask Bekbek chats. A saved chat is deleted automatically 30 days after its last message, unless you pin it. Pinned chats stay until you unpin or delete them.

You can delete all your data at any time from Settings → Danger Zone → Delete all data. This action immediately and permanently removes all your buckets, transactions, widgets, funds records, and account data from our database. (The anonymous visit counts described in Section 2c contain nothing that identifies you and are not linked to your account, so there is nothing of yours to remove from them.) This action is irreversible.

If you simply stop using the app without deleting your data, your data (apart from unpinned Ask Bekbek chats, as above) will remain in the database indefinitely until you choose to delete it or request deletion via email.

8. Your rights

You have the following rights over your data:

• Access — you can view all your data directly within the app at any time.
• Export — you can export your transaction data as an Excel file from Settings.
• Deletion — you can permanently delete all your data from Settings → Danger Zone → Delete all data.
• Correction — you can edit any transaction, bucket, or setting directly within the app.
• Portability — your exported Excel data is in a standard format you can import into other tools.

If you need help exercising any of these rights or have a request that cannot be completed through the app, contact us at hello@bequebeque.com.

9. Children's privacy

Bēquebēque is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If the changes are significant, we will make reasonable efforts to notify active users. Continued use of the app after changes are posted constitutes your acceptance of the updated policy.

We will never change this policy in a way that reduces your rights or allows us to sell or share your data without obtaining fresh consent.

11. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your data, please reach out:

Kyle Garcia
hello@bequebeque.com

We will respond to all privacy-related inquiries within a reasonable timeframe.