Privacy Policy

Effective June 1, 2026 · Last updated June 1, 2026

Welcome to Bēquebēque. We take your privacy seriously — especially because this app exists to hold some of your most personal information: your money. This Privacy Policy explains in full detail what data we collect, why we collect it, how it is stored and protected, and what rights you have over it. Please read it carefully.

By using Bēquebēque, you agree to the practices described in this policy. If you do not agree, please do not use the app.

1. Who we are

Bēquebēque is a personal budgeting application designed and developed by Kyle Garcia. The app is intended for personal use and for sharing with a small community of trusted users. It is not operated by a corporation and does not have investors, advertising partners, or data brokers.

For any questions about this policy or your data, contact us at hello@bequebeque.com.

2. What information we collect

We collect only what is necessary to provide the app's functionality. This falls into three categories:

2a. Information you provide directly

Budget categories (buckets) — names, icons, colors, allotted amounts, savings floors and ceilings, and any configuration you apply to them.
Transactions — names, amounts, dates, due dates, notes, and whether they have been paid or saved.
Salary and income figures — monthly salary amounts and any per-month overrides you configure in Settings.
Widgets — the dashboard widgets you create, including their labels, types, colors, and linked buckets.
Notes — any free-text notes you attach to transactions.

None of this information is shared with any third party. It exists in our database solely to power your experience in the app.

2b. Information collected via Google Sign-In

Bēquebēque uses Google OAuth for authentication. When you sign in with Google, we receive:

Your name — displayed in the app header and settings.
Your email address — used as your account identifier.
Your profile photo — displayed as your avatar in the app.
Your Google user ID — a unique identifier used internally to associate your data with your account.
OAuth access and refresh tokens — short-lived credentials that allow the app to interact with optional Google services (Drive, Gmail, Calendar) if and only if you choose to enable those integrations. We do not use these tokens for any purpose other than the integrations you explicitly activate.

We do not request access to your Google contacts, search history, YouTube activity, or any other Google data beyond what is listed above.

2c. Automatically collected information

We do not run analytics software, advertising trackers, or fingerprinting tools. We do not collect your IP address for tracking purposes. Standard server logs (request paths, response times) may be generated by our hosting provider (Vercel) as part of normal infrastructure operation, but these are not used to build profiles or track user behavior.

3. How we use your information

Your information is used for one purpose: to make Bēquebēque work for you. Specifically:

To display your budgets, transactions, and savings progress across months.
To authenticate your identity and protect your account.
To power optional integrations (Google Drive backup, Gmail notifications, Google Calendar sync) when you choose to enable them.
To calculate recurring transaction schedules and project future months.
To generate dashboard widgets and statistics based on your financial data.

We do not use your data for advertising. We do not sell your data. We do not share your data with third parties for their own purposes. We do not build behavioral profiles. We do not use your financial information to make automated decisions that affect you outside the app.

4. Data storage and security

Your data is stored in a PostgreSQL database hosted by Supabase, a trusted infrastructure provider. The following security measures are in place:

Row-level security (RLS) — enforced at the database level on all tables. Your data is only accessible to your account. Even if a request were made with a lower-privilege key, the database itself would reject access to any row that does not belong to you.
Server-side API routes — all database operations go through Next.js API routes running on the server. The browser never has direct access to your database.
Authentication via NextAuth.js — every API request verifies your session before any data is read or written. Unauthenticated requests are rejected with a 401 error.
HTTPS — all data in transit is encrypted via TLS. Bēquebēque is served exclusively over HTTPS.
Environment variable isolation — sensitive keys (database service role key, NextAuth secret, Google OAuth credentials) are stored as environment variables and are never exposed to the client or committed to source control.

No security system is perfect, and we cannot guarantee absolute security. However, we have taken reasonable and industry-standard precautions to protect your data.

5. Third-party services

Bēquebēque relies on a small number of trusted third-party services to operate:

Supabase — database hosting and storage. Your financial data lives on Supabase's infrastructure. Supabase's own privacy policy applies to their infrastructure operations. supabase.com/privacy
Google OAuth — sign-in and optional integrations. When you sign in, Google's authentication services are involved. Google's privacy policy governs Google's own handling of your data. policies.google.com/privacy
Vercel — app hosting and deployment. Bēquebēque is hosted on Vercel's platform. Vercel may generate standard server logs as part of operating the infrastructure. vercel.com/legal/privacy-policy

No other third parties have access to your data. We do not use advertising networks, social media pixels, A/B testing platforms, customer data platforms, or any other tracking services.

6. Google API scopes

Because Bēquebēque offers optional integrations with Google Drive, Gmail, and Google Calendar, we request the following OAuth scopes during sign-in:

openid, email, profile — standard identity scopes used for authentication.
https://www.googleapis.com/auth/drive — used only for optional Google Drive backup of your budget data, if you enable it in Settings.
https://www.googleapis.com/auth/gmail.send — used only for optional Gmail notifications (e.g. due date reminders), if you enable them in Settings.
https://www.googleapis.com/auth/calendar — used only for optional Google Calendar sync of your due dates, if you enable it in Settings.

These scopes are requested at sign-in but the integrations are disabled by default. Tokens are only used when you explicitly activate an integration. We do not read your Drive files, your email inbox, or your calendar events — we only write to these services on your behalf when you turn on the relevant integration.

7. Data retention

Your data is retained for as long as your account exists. We do not automatically delete old transaction data, as historical records are part of the core value of a budgeting app.

You can delete all your data at any time from Settings → Danger Zone → Delete all data. This action immediately and permanently removes all your buckets, transactions, widgets, salary records, and account data from our database. This action is irreversible.

If you simply stop using the app without deleting your data, your data will remain in the database indefinitely until you choose to delete it or request deletion via email.

8. Your rights

You have the following rights over your data:

Access — you can view all your data directly within the app at any time.
Export — you can export your transaction data as an Excel file from Settings.
Deletion — you can permanently delete all your data from Settings → Danger Zone → Delete all data.
Correction — you can edit any transaction, bucket, or setting directly within the app.
Portability — your exported Excel data is in a standard format you can import into other tools.

If you need help exercising any of these rights or have a request that cannot be completed through the app, contact us at hello@bequebeque.com.

9. Children's privacy

Bēquebēque is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If the changes are significant, we will make reasonable efforts to notify active users. Continued use of the app after changes are posted constitutes your acceptance of the updated policy.

We will never change this policy in a way that reduces your rights or allows us to sell or share your data without obtaining fresh consent.

11. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your data, please reach out:

Kyle Garcia
hello@bequebeque.com

We will respond to all privacy-related inquiries within a reasonable timeframe.