Privacy Policy

Effective June 1, 2026 · Last updated July 11, 2026

Welcome to Bēquebēque. We take your privacy seriously — especially because this app exists to hold some of your most personal information: your money. This Privacy Policy explains in full detail what data we collect, why we collect it, how it is stored and protected, and what rights you have over it. Please read it carefully.

By using Bēquebēque, you agree to the practices described in this policy. If you do not agree, please do not use the app.

1. Who we are

Bēquebēque is a personal budgeting application designed and developed by Kyle Garcia. The app is intended for personal use and for sharing with a small community of trusted users. It is not operated by a corporation and does not have investors, advertising partners, or data brokers.

For any questions about this policy or your data, contact us at hello@bequebeque.com.

2. What information we collect

We collect only what is necessary to provide the app's functionality. This falls into three categories:

2a. Information you provide directly

• Budget categories (buckets) — names, icons, colors, allotted amounts, savings floors and ceilings, and any configuration you apply to them.
• Transactions — names, amounts, dates, due dates, notes, and whether they have been paid or saved.
• Funds and income figures — monthly funds amounts and any per-month overrides you configure in Settings.
• Widgets — the dashboard widgets you create, including their labels, types, colors, and linked buckets.
• Notes — any free-text notes you attach to transactions.

None of this information is shared with any third party. It exists in our database solely to power your experience in the app.

2b. Information collected via Google Sign-In

Bēquebēque uses Google OAuth for authentication. When you sign in with Google, we receive:

• Your name — displayed in the app header and settings.
• Your email address — used as your account identifier.
• Your profile photo — displayed as your avatar in the app.
• Your Google user ID — a unique identifier used internally to associate your data with your account.
• OAuth access token — a short-lived credential used only for authentication. We currently use this only to verify your identity at sign-in.

We do not request access to your Google contacts, search history, YouTube activity, or any other Google data beyond what is listed above.

2c. Automatically collected information

We do not run analytics software, advertising trackers, or fingerprinting tools. We do not collect your IP address for tracking purposes. Standard server logs (request paths, response times) may be generated by our hosting provider (Vercel) as part of normal infrastructure operation, but these are not used to build profiles or track user behavior.

3. How we use your information

Your information is used for one purpose: to make Bēquebēque work for you. Specifically:

• To display your budgets, transactions, and savings progress across months.
• To authenticate your identity and protect your account.
• To authenticate your identity via Google Sign-In.
• To calculate recurring transaction schedules and project future months.
• To generate dashboard widgets and statistics based on your financial data.

We do not use your data for advertising. We do not sell your data. We do not share your data with third parties for their own purposes. We do not build behavioral profiles. We do not use your financial information to make automated decisions that affect you outside the app.

4. Data storage and security

Your data is stored in a PostgreSQL database hosted by Supabase, a trusted infrastructure provider. The following security measures are in place:

• Per-user data isolation — every single database query is scoped to your authenticated account. One account can never read, edit, or delete another account's buckets, transactions, or any other financial data through the app. This is enforced on every read and write across the entire API. The one exception is described below under Administrator access.
• Row-level security (RLS) — enforced at the database level on all tables as a second layer of defense. Even if our public API key were exposed, the database itself rejects any direct read or write to rows that do not belong to you. We verify this regularly.
• Server-side API routes — all database operations go through Next.js API routes running on the server. The browser never has direct access to your database, and the privileged database key never leaves the server.
• Authentication via NextAuth.js — every API request verifies your session before any data is read or written. Unauthenticated requests are rejected with a 401 error.
• HTTPS — all data in transit is encrypted via TLS. Bēquebēque is served exclusively over HTTPS.
• Environment variable isolation — sensitive keys (database service role key, NextAuth secret, Google OAuth credentials) are stored as environment variables and are never exposed to the client or committed to source control.

No security system is perfect, and we cannot guarantee absolute security. However, we have taken reasonable and industry-standard precautions to protect your data.

4a. Administrator access

As the sole developer and operator of Bēquebēque, Kyle Garcia has access to an internal admin dashboard used to operate and support the app. This dashboard shows account-level information only: your name, email address, profile photo, account creation date, last active date, and notification preferences. It is used to monitor app health, send service announcements (like the ones described in Section 3), and process account deletion requests.

The admin dashboard never displays your financial data — buckets, transactions, funds figures, widgets, or notes remain visible only within your own account and are never shown in this view.

5. Third-party services

Bēquebēque relies on a small number of trusted third-party services to operate:

• Supabase — database hosting and storage. Your financial data lives on Supabase's infrastructure. Supabase's own privacy policy applies to their infrastructure operations. supabase.com/privacy
• Google OAuth — used only for sign-in. We request your name, email, and profile photo. No other Google data is accessed. Google's privacy policy governs Google's own handling of your data. policies.google.com/privacy
• Vercel — app hosting and deployment. Bēquebēque is hosted on Vercel's platform. Vercel may generate standard server logs as part of operating the infrastructure. vercel.com/legal/privacy-policy

No other third parties have access to your data. We do not use advertising networks, social media pixels, A/B testing platforms, customer data platforms, or any other tracking services.

6. Google API scopes

We currently request the following OAuth scopes during sign-in:

• openid, email, profile — used to authenticate you and display your name and profile photo.

7. Data retention

Your data is retained for as long as your account exists. We do not automatically delete old transaction data, as historical records are part of the core value of a budgeting app.

You can delete all your data at any time from Settings → Danger Zone → Delete all data. This action immediately and permanently removes all your buckets, transactions, widgets, funds records, and account data from our database. This action is irreversible.

If you simply stop using the app without deleting your data, your data will remain in the database indefinitely until you choose to delete it or request deletion via email.

8. Your rights

You have the following rights over your data:

• Access — you can view all your data directly within the app at any time.
• Export — you can export your transaction data as an Excel file from Settings.
• Deletion — you can permanently delete all your data from Settings → Danger Zone → Delete all data.
• Correction — you can edit any transaction, bucket, or setting directly within the app.
• Portability — your exported Excel data is in a standard format you can import into other tools.

If you need help exercising any of these rights or have a request that cannot be completed through the app, contact us at hello@bequebeque.com.

9. Children's privacy

Bēquebēque is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If the changes are significant, we will make reasonable efforts to notify active users. Continued use of the app after changes are posted constitutes your acceptance of the updated policy.

We will never change this policy in a way that reduces your rights or allows us to sell or share your data without obtaining fresh consent.

11. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your data, please reach out:

Kyle Garcia
hello@bequebeque.com

We will respond to all privacy-related inquiries within a reasonable timeframe.