Privacy Policy

Last updated: 16 October 2026

This policy explains what personal data Ryd – the app for managing expenses, budgets, wealth and shared expenses – processes, why, for how long, and what rights you have. It applies to the app on iPhone, iPad and Android and to the website ryd-app.it.

1. Who the controller is

The data controller is Dario Rossi, a private individual who develops and runs Ryd.

For any privacy question or to exercise your rights, write to info@ryd-app.it.

2. In short

• Ryd shows no ads, does not track you, does not build marketing profiles and does not sell your data.
• Your data is stored in an encrypted database on your phone. If you keep cloud backup turned on, a copy is kept on our servers in the European Union, so you can use it on several devices and never lose it.
• Files you import (bank statements, CSV or Excel files) are analysed only on your device: their content is not sent to us or to any external artificial-intelligence service.
• You can export your data and delete your account at any time from the app.
• If you don't use Ryd for 60 days in a row, the cloud copy is deleted. We warn you by email 7 days and 2 days before.

3. What data we process

3.1 Account

• Email address and password. The password is stored only in encrypted form (hash) by the authentication system: nobody can read it.
• First and last name, if you enter them.
• If you sign in with Apple or Google: the account identifier, the email address (including Apple's private relay address, if you choose to hide yours) and your name, if you share it.
• One-time codes sent by email to confirm sign-in or reset your password.

3.2 Financial data you enter

• Accounts and balances, transactions (expenses, income, transfers), categories, tags, notes and budgets.
• Investments and assets: securities, quantities, prices, buy and sell trades, fees, taxes, real assets and related events.
• Advances, receivables, double-entry records and amortisation.
• Receipts and attachments (photos or PDFs), if you choose to add them.

You enter this data yourself: Ryd does not connect to your bank accounts and does not access your bank.

3.3 Shared expenses

• Groups, members, expenses, shares and repayments.
• The names (and optionally an emoji) of the people you add, even if they don't use Ryd.
• The details for receiving repayments, if you enter them: IBAN, account holder, bank, Revolut username, PayPal address. These are shown to the members of your groups and to anyone who opens one of your invitations, so they can pay you.

If you join a group through an invitation without having an account, we process the name you were added with, the repayments you record and the payment details you choose to enter.

When you enter other people's data (for example a friend's name in a group), make sure you are allowed to and enter only what is needed to split expenses.

3.4 Problem reports

When you send a report (by shaking your phone or from Settings › Report a problem) we process:

• the text you write;
• the screen you were on;
• the device model, operating system version, app version and theme;
• the date and your account identifier.

3.5 Technical data

When the app communicates with our servers, the IP address, date and time, type of request and its outcome are logged for security and troubleshooting. We do not use this data to track you.

3.6 Data that stays only on your device

• App database. All your data is stored on your phone in an encrypted database. The key is kept in the system's protected keychain.
• Import from file. Files you choose to import are read and interpreted on the device, with Apple Intelligence (where available) or with local rules. The file never leaves your phone; only the transactions you confirm are saved.
• Face ID, Touch ID and biometric unlock. These are handled by the operating system: Ryd only receives the result (success or failure) and never has access to your biometric data.
• Preferences such as theme and lock settings.

3.7 What we don't do

• We don't use advertising, tracking or behavioural analytics tools.
• We don't read your contacts, your location or other apps.
• We don't make automated decisions that produce legal effects on you.
• We don't sell or hand over your data to third parties.

4. Why we process data and on what legal basis

• Providing the service (account, storing and syncing data, shared expenses, invitations, password recovery): performance of the contract, i.e. the Terms of Use (Art. 6(1)(b) GDPR).
• Showing your payment details to the members of your groups: performance of the contract, at your choice. You can delete these details whenever you want.
• Processing data of people you add to groups: legitimate interest of you and the other members in splitting expenses (Art. 6(1)(f)).
• Handling reports and fixing problems: performance of the contract and legitimate interest in improving the app's stability.
• Security, abuse prevention and technical logs: legitimate interest in protecting the service and your data.
• Service emails (account confirmation, codes, warnings before deletion for inactivity, important changes to this policy): performance of the contract. We do not send promotional emails.
• Legal obligations (for example answering requests from authorities): compliance with a legal obligation (Art. 6(1)(c)).

Where we rely on legitimate interest, you can object at any time by writing to us.

5. Market prices

To update the value of your investments, our servers request prices from market data providers (Yahoo Finance for stocks and ETFs, CoinGecko for cryptocurrencies). We send only ticker symbols (for example "AAPL"), without any data that identifies you. The requests come from our servers, not from your phone.

6. Where data is stored and who processes it

Data saved in the cloud is stored on Supabase servers in a data centre in the European Union (Frankfurt, Germany). Supabase processes the data on our behalf as a processor, under an agreement compliant with Art. 28 GDPR.

Other recipients:

• the email service provider, which sends sign-in codes and warnings on our behalf;
• Apple and Google, if you sign in with their account: they process data as independent controllers, under their own policies;
• Apple App Store and Google Play, which handle the app download as independent controllers;
• authorities, only where required by law.

Supabase is a company based in the United States and its engineers may access the systems for support and maintenance. In these cases the transfer is protected by the Standard Contractual Clauses approved by the European Commission and by additional technical measures. The same applies to any other provider outside the European Economic Area. You can ask us for a copy of the safeguards by writing to info@ryd-app.it.

7. How long we keep data

• Account and cloud data: for as long as you use Ryd.
• Inactivity: if you don't sign in to Ryd from any device for 60 days in a row, the cloud copy of your data is deleted. We warn you by email 7 days and 2 days before. Just opening the app prevents it. On your phone the data stays as long as the app is installed: if you sign in again later, it is uploaded to the cloud again. Your account (email and sign-in) stays active, so you can come back whenever you want.
• Shared expenses during inactivity: groups, expenses and repayments shared with other people remain available to the other members, because they are needed to calculate their balances.
• Account deletion: cloud data is deleted immediately; the process is completed within 30 days. Groups you created are deleted together with their expenses.
• Technical backups of our provider: overwritten within 30 days.
• Problem reports: until they are resolved or closed, then deleted.
• Technical logs: for a short time, normally no longer than 90 days.
• Emails sent to support: for as long as needed to reply and in any case no longer than 2 years.
• Data on your device: as long as the app is installed or until you sign out. If device backup is on (iCloud, Google or computer), the encrypted database may be included in the backup according to your system settings.

8. Security

• Communication with the servers is protected with HTTPS (TLS).
• On the phone, data is kept in an encrypted database (AES-256) and the app can be locked with Face ID, fingerprint or passcode.
• On the server, each user can access only their own data and that of the groups they belong to; data is encrypted on disk.
• Cloud data is not end-to-end encrypted: it is protected by access controls, but technically readable by the infrastructure hosting it.

No system is 100% secure. If a breach poses a risk to your rights, we will inform you and the competent authority as required by law.

9. Your rights

Under the GDPR you can:

• access your data and get a copy;
• rectify it if it is inaccurate;
• erase it;
• restrict its processing;
• receive it in a structured format and transfer it elsewhere (portability): from Settings › Privacy & Security › Full backup, or from Settings › Export;
• object to processing based on legitimate interest;
• lodge a complaint with the supervisory authority of the country where you live, work or where you believe the infringement took place. In Italy this is the Garante per la protezione dei dati personali (www.garanteprivacy.it).

To exercise your rights, write to info@ryd-app.it from the address linked to your account. We reply within one month. We may ask you to confirm your identity.

10. Deleting your account

You can delete your account and all data from Settings › Privacy & Security › Delete account. If you no longer have the app, follow the instructions at ryd-app.it/en/delete-account.

11. Cloud backup turned off

In Settings › Privacy & Security you can turn off cloud backup: from then on your financial data stays only on your phone and is no longer updated on the server. Your profile (name and payment details) and the people you use in groups keep syncing, because they are needed for shared expenses. The copy already in the cloud remains, without updates, until you delete your account or the inactivity deletion applies.

12. Minors

Ryd is intended for people aged 18 or over. We do not knowingly collect data from minors. If you believe a minor has provided us with data, write to us and we will delete it.

13. Changes to this policy

We may update this policy as the app or the law evolves. For important changes we will notify you in the app or by email before they take effect. The date at the top shows the latest version.

14. Contact

Dario Rossi – info@ryd-app.it