Privacy Policy

Effective date: 06.08.2026
Last updated: 14.10.2026

1. Summary — your data stays on your device

Pigles ("Pigles", the "App"; package identifier es.pigl.app) is a personal finance tracking app for Android, iOS and desktop. It is designed to be private by default.

• Your financial data (accounts, operations/transactions, categories, and similar records) is stored only on your device, in a database encrypted with SQLCipher.
• Your financial data is never transmitted to, or stored on, the developer's servers.
• The App has no user accounts and no registration. It contains no advertising, no third-party analytics, no crash-reporting SDKs, no tracking technologies and no cookies.
• Backups and synchronisation between your own devices are optional, are end-to-end encrypted, and use only your device or your own cloud account (Google Drive or Apple iCloud). The developer’s servers are not involved in either feature, and the developer cannot access this data or its encryption keys.
• If you buy a subscription and connect a Google account, the App can link that subscription to your account so that the Premium features are also available in the web version of Pigles and without the App installed. For this the developer’s server receives a salted hash of your Google account’s e-mail address — never the address itself (Section 8).
• The optional AI chat (for subscribers, in the App and in the web version) works only with a third-party AI provider that you choose, pay for and connect yourself. When you use it, your questions and the data needed to answer them go directly from your device to that provider, with your explicit permission — never to the developer (Section 10).

Because of this design, in normal use the developer processes almost no personal data about you. This Policy explains the limited situations in which some personal data is processed, why, and what your rights are.

2. Who is responsible for your data (Data Controller)

The App is developed and operated by an individual developer (a natural person) acting as the data controller:

• Controller: Mikhail Lobov (individual developer, trading as Pigl.ES).
• Postal address:
  Pigl.ES
  Calle Princesa 31, planta 2, puerta 2
  28008 Madrid, Spain
• Privacy contact: support@pigl.es

You may contact the developer at the email or postal address above for any privacy question or to exercise your rights (see Section 16).

A data protection officer (DPO) has not been appointed, because the App's processing does not meet the criteria that would require one under the GDPR or Spanish Organic Law 3/2018 (LOPDGDD).

3. Scope of this Policy

This Policy covers only the Pigles application (Android, iOS and desktop) and the services it uses on api.pigl.es, and the web version of Pigles at https://pigl.es/app/ — as regards signing in to Google Drive through the authorisation broker and the cookies it sets (Section 7) and the subscription entitlement check (Section 8).

This Policy does not cover the general Pigles website beyond the page on which this Policy is hosted (https://pigl.es/privacypolicy). The page hosting this Policy is served without cookies. Other pages of the website are governed by their own separate notices.

4. What Pigles does NOT do

To be explicit, the App does not:

• require you to create an account or provide your name, email, phone number or any identity information to use it (connecting your own Google or Apple iCloud account is optional and serves only the cloud features; a Google account additionally serves subscription linking and signing in to the web version — Sections 6, 7 and 8);
• collect or transmit your financial data to the developer;
• send your financial data to any AI service unless you yourself connect an AI provider and give explicit permission (Section 10);
• contain advertising or advertising SDKs;
• contain third-party analytics or crash-reporting SDKs;
• track you across other apps or websites, or build any advertising or behavioural profile;
• use cookies or similar tracking technologies inside the App;
• sell, rent or monetise your personal data in any way.

5. Data stored on your device

All content you create in the App — accounts, operations, categories, notes, balances, currencies and related settings — is stored locally on your device in a database encrypted with SQLCipher. This data does not leave your device unless you choose to create a backup or enable synchronisation between your own devices (see Section 6), use the optional AI chat with a provider you have connected (see Section 10) — or, in future, an optional sharing feature (see Section 11).

Because this data remains under your control on your device and is not accessible to the developer, the developer does not "collect" it. Deleting the App, or clearing its data, permanently deletes this on-device data (subject to any backups you created yourself).

6. Backups and synchronisation in your own cloud

Two optional features store data outside your device: encrypted backups and synchronisation between your own devices. Both operate entirely within storage that belongs to you — your device, or your own Google or Apple account. The developer’s servers are not involved in any way: this data does not pass through, and is never stored on, any infrastructure operated by the developer, even in encrypted form.

Backups. The App lets you create optional encrypted backup files (the ".pig" format), protected with AES-256-GCM encryption. You can export a backup file through your device’s system share sheet and store it wherever you choose, or keep it in your own cloud as described below.

Synchronisation between your own devices. You can optionally connect a database to your own cloud so that your own devices (for example, your phone and your tablet) exchange changes and stay up to date. For this, the App maintains a hidden, app-private sync folder in your own cloud account:

• on Android, the hidden application data folder (appDataFolder) of your own Google Drive, accessible only to the App and hidden from other apps;
• on iOS, the CloudKit private database of your own iCloud account.

The sync folder contains: an end-to-end-encrypted full snapshot of the database; end-to-end-encrypted change journals (one per device); and small service files — device "cards" (each carrying a device name and a device identifier, see below) and a display file with the database name. You can delete a database from your cloud at any time from within the App; deleting the folder or the App’s data in your Google or Apple account also removes this content.

Encryption keys. The key protecting a cloud database is stored in the sync folder only in "wrapped" (encrypted) form: it is either derived from an optional password you set (see below), or protected by an app key held in your device’s secure system key store, or — on iOS, by default — stored in your iCloud Keychain. iCloud Keychain is a service operated by Apple: in narrow scenarios, such as Apple-assisted account recovery or a response to a valid legal demand, technical access by Apple to keys stored there cannot be ruled out. What holds in every configuration: the developer operates no servers holding your data and never has your keys.

Optional cloud database password. You may protect a cloud database with a password. In that case the encryption key is derived solely from that password, and the iCloud Keychain option above no longer applies. The password itself is stored nowhere — not by the developer and not in your cloud; only a key derived from it remains on your device. There is no password recovery. If you forget the password, the contents of the cloud folder become permanently inaccessible; the only safeguard is a backup copy saved in advance.

Device identifier. So that your devices can tell each other apart during synchronisation, the App generates a stable random device identifier that survives reinstalling the App. It is published to the sync folder together with the device name. It is not linked to your identity, is never transmitted to the developer, and is not used for advertising or analytics.

What your cloud provider can see. The content of your data is encrypted, but the service metadata of the sync folder is stored in plain form and is technically visible to your cloud provider (Google or Apple): the display name of the database; the names of your devices as set in your device’s system settings (for example, "Mike’s iPhone"); device identifiers; and the names, sizes and modification times of the files in the folder. This is a deliberate design decision — without it your devices could not show each other in a list — but you should be aware of it.

In all cases the backup and synchronisation content is end-to-end encrypted. The developer has no access to it and no access to your encryption keys. This data is held in infrastructure operated by Google or Apple under your account and under their respective terms and privacy policies:

• Google Privacy Policy: https://policies.google.com/privacy
• Apple Privacy Policy: https://www.apple.com/legal/privacy/

Google Drive access and Limited Use disclosure. Connecting Google Drive uses the standard Google sign-in (OAuth), and the App requests two narrow scopes: drive.appdata — its own hidden application data folder — and email — the e-mail address of the Google account you connect. The address is used only on your device: to show in the App which account it is connected to, and to compute the salted hash used for linking a subscription (Section 8). The address itself is not transmitted to the developer. Thanks to the Drive scope, the App technically cannot read or even list any other files in your Google Drive: this is enforced by the permission itself, not merely promised. Pigles’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements: that Drive access is used solely to store and retrieve your own encrypted Pigles backups and synchronisation data in the hidden app data folder, the e-mail address is used solely for the two purposes named above, and this data is not transferred to the developer or any third party — only the salted hash of the address reaches the developer’s server (Section 8).

7. Services on api.pigl.es (the App and the web version)

To show up-to-date currency conversions, the App downloads currency exchange-rate snapshots from the developer's server api.pigl.es. This is a one-way distribution of reference data to the App:

• No financial data, account data or personal identifiers are sent to this server as part of this feature.
• Like virtually any internet server, api.pigl.es generates technical connection logs. These logs may include technical data such as a truncated IP value, timestamp, and the requested resource. IP addresses in these logs are anonymised by truncation to their network prefix (subnet); the logs are kept for up to 48 hours and are used only for security, abuse prevention, rate-limiting and keeping the service reliable.
• These logs are not used to identify you, to profile you, or for any advertising or analytics purpose.

Legal basis: the developer's legitimate interests (Article 6(1)(f) GDPR) in operating a secure and reliable service and preventing abuse.

Update policy check. On each launch the App retrieves a small public file from api.pigl.es describing whether the installed version is still supported. Its purpose is to make it possible to warn you, or to require an update, if a critical defect is discovered in a version you have already installed. The request is an ordinary download of a static file: it carries no identifiers, no version parameter and no request body, and no data about you, your device or your finances is sent. The response is cached on your device and is also used when you are offline. This check cannot be switched off, because it is the only channel through which a defect in a released version can be signalled to copies that are already installed. The same technical logging, retention and legal basis described above apply.

Sign-in for the web version (authorisation broker). The web version of Pigles runs in a browser and cannot keep a Google session by itself, so signing in to Google Drive there goes through an authorisation broker on the developer’s server api.pigl.es. When you sign in, the server stores, in encrypted form, the Google refresh token for the same two narrow scopes the App uses (drive.appdata and email) and the e-mail address of that account, together with a browser session identified by a technical cookie. It uses them for one purpose only: to hand your browser short-lived Google access tokens so that the web version stays signed in. The contents of your Google Drive and the contents of your databases never reach the server — the browser talks to Google Drive directly, and the data itself remains end-to-end encrypted (Section 6). The stored grant is deleted when you sign out with the “revoke access” option, and in any case 180 days after the session was last used; you can also withdraw the access at any time in your Google account settings. Legal basis: performance of the service you asked for (Article 6(1)(b) GDPR). This applies to the web version only — the mobile apps sign in to Google on the device, without the developer’s server.

Cookies and local storage. Pigles uses no advertising, no analytics and no third-party cookies, and nothing here tracks you across other sites. The web version sets only what is strictly necessary for the service you asked for — signing in and staying signed in — which is why no consent banner is shown (strictly necessary storage is exempt from consent under Article 5(3) of the ePrivacy Directive and, in Spain, Article 22.2 LSSI). The App itself uses no cookies at all.

• pigles_web_session — cookie set by api.pigl.es: your sign-in session in the web version. Up to 180 days without activity, extended each time it is used. Technical, strictly necessary.
• pigles_web_oauth — cookie set by api.pigl.es: protects the sign-in itself (the OAuth state and PKCE values) while Google is authorising you. 10 minutes. Technical, strictly necessary.
• Local storage in your browser (localStorage; never sent anywhere): pigles.device_id, pigles.replica_id, pigles.device_name — the identity of this browser inside your own synchronisation folder; pigles.last_db — the identifier of the last database you opened, so that it reopens after a reload; pigles.pref.language, pigles.pref.theme — your interface language and theme; pigles.notif.browser, pigles.notif.sound, pigles.notif.dismissed — your reminder settings and the reminder tiles you have dismissed. Kept until you clear the site’s data.
• Session storage (sessionStorage, cleared when you close the tab): pigles.session.showcase_pinned — whether the database list stays pinned. No access token and no e-mail address are stored in the browser.

To remove them: sign out of the web version (this deletes the session cookie), or clear this site’s data in your browser.

8. Paid subscriptions and in-app purchases

Pigles is free to use. Optional paid features (see below) are sold exclusively through the Apple App Store and Google Play in-app purchase and subscription systems.

• All payment processing is handled by Apple and Google. The developer never receives or has access to your payment card number, bank details or billing address.
• The developer receives only limited, largely anonymised transaction/subscription-status information from Apple or Google (for example, whether a subscription is active), which is necessary to unlock and maintain the paid features.
• Your use of these payment systems is governed by Apple's and Google's own terms and privacy policies.

There are currently three paid areas:

• The web version of Pigles (https://pigl.es/app/) — working in a browser, without the App installed, with a database that lives in your own Google Drive. Access is for subscribers only, confirmed by the entitlement check described below in this Section. No personal data is collected for this beyond that check: the browser works with your Google Drive directly, and the data stays end-to-end encrypted (Sections 6 and 7).
• Cryptocurrency exchange-rate feeds. This works exactly like the fiat currency-rate distribution described in Section 7: reference data is delivered to the App and no personal data is collected for this purpose.
• Cloud database features — creating a cloud database, attaching it on a device, and receiving changes from your other devices (Section 6). No personal data is collected for this either: synchronisation runs through your own cloud, without the developer’s servers.

Linking a subscription to your Google account (entitlement check on the server). If you have an active subscription and have connected a Google account in the App, the App links the subscription to that account on the developer’s server api.pigl.es. This is what makes the Premium features available in the web version of Pigles and keeps them available even if the App is no longer installed. For this purpose the server processes the following data:

• What is stored: a hash of your Google account’s e-mail address (SHA-256 with a fixed salt) linked to the store’s own identifier of your subscription (Apple originalTransactionId or Google Play purchase token), together with the subscription’s paid-until date, its status and the platform (Apple/Google). The e-mail address itself is never sent to and never stored on the server; the hash is pseudonymous personal data — the developer does not hold the address and cannot derive it from the hash.
• Purpose: confirming your entitlement to the Premium features in the web version of Pigles and without the App installed.
• Source: the App, when you link the subscription, and the notifications that Apple and Google send about the state of your subscription (renewal, cancellation, refund) — these keep the record up to date without any involvement of your devices.
• What is not stored: your e-mail address, receipts or purchase records, your IP address (anonymised when the technical logs are written, see Section 7), and any of your financial data — that data stays only on your device and in your own cloud, end-to-end encrypted (Sections 5–6).
• Limit: up to five Google accounts can be linked to one subscription; further linking attempts are refused.
• Retention: 365 days after the end of the last paid period, then the record and its links are deleted automatically; the log of store notifications is kept for 90 days.
• Deletion on request: write to support@pigl.es — the link is removed by the hash of the address you name.
• Recipients: Apple and Google Play (the stores, which report the state of your subscription) and DigitalOcean as the hosting provider of api.pigl.es (EU data centre, Frankfurt, Germany) — see Section 15.

Legal basis: performance of a contract (Article 6(1)(b) GDPR) — providing the subscription you purchased across your devices and on the web.

Two actions are always free, regardless of any subscription: downloading a full copy of your data (a ".pig" backup file) and deleting a database from your cloud. Your data is never held behind a payment.

Legal basis: performance of a contract (Article 6(1)(b) GDPR) to provide the paid feature you purchased.

9. Support communications

If you email support@pigl.es, the developer will process your email address and the contents of your message for the sole purpose of reading, investigating and answering your request. This information is kept only as long as needed to handle your request and any reasonable follow-up, and is not used for any other purpose.

Legal basis: the developer's legitimate interests (Article 6(1)(f) GDPR) in responding to and supporting users, and, where relevant, taking steps at your request.

10. AI chat with a provider of your choice (optional)

The App and the web version include an optional AI chat, available to subscribers. It is off by default and works only if you yourself connect a third-party AI provider: you choose the provider (DeepSeek, Google, or any OpenAI-compatible API endpoint you specify), obtain an API key from it under your own account and at your own cost, and enter the key in the App. The connection (provider, model and key) is stored as part of that database's data: on your devices and, if you synchronise the database, in your own cloud, end-to-end encrypted like the rest of the database (Section 6); a backup file containing the key can only be saved with a password. The key is never transmitted to the developer. In the web version the key is not saved in the browser's storage.

What is sent. When you use the chat, the App sends to the provider you chose, directly from your device: your questions and the text of the conversation; and the portions of your financial data that the AI model requests through the App's read-only tools in order to answer — account names and balances, currencies, operations (amounts, dates, categories, comments), exchange rates and related settings. The model does not receive your whole database; each request retrieves only the selection needed for that answer.

Consent. Before the first connection to a provider, the App shows what will be sent and to whom and asks for your explicit permission; nothing is sent if you decline. Permission is requested again for each new provider or endpoint; once given for a database, it applies to that database on all your devices. You can withdraw it at any time by disabling AI in the App's settings ("Turn off AI"), which removes the connection and the key from the database and from your devices. Your conversation history is part of the database's data — it stays on your devices and, if you synchronise, in your own cloud, end-to-end encrypted — and is deleted together with the database's data.

Role of the developer. The developer's servers are not involved: the App communicates with the provider directly, and the developer does not receive, see or store your questions, your data or the provider's answers, and has no access to them. The provider is an independent data controller and processes the data under its own terms and privacy policy, in the countries where it operates — which may be outside the EU/EEA. To exercise your rights regarding data held by the provider, including deletion, contact the provider directly. The developer is not a party to your agreement with the provider and does not select the provider for you.

Legal basis: your consent (Article 6(1)(a) GDPR), given in the App before the first connection and revocable at any time.

11. Future features (only if and when introduced, and only if you enable them)

Note: synchronisation between your own devices is already available and works through your own cloud, without the developer’s servers — it is described in Section 6, not here. The features below are different and separate.

The developer may introduce the following optional features in the future. They are described here in advance for transparency. None of them is active unless and until it is released and you choose to enable it, and this Policy will be updated with specific details before any such feature processes your data.

• Tier-2 synchronisation / sharing between users (via Pigles servers). If introduced and enabled by you, this would allow sharing selected data (for example, individual accounts) between different users through the developer's servers. Any such data would be end-to-end encrypted and pseudonymised / de-identified before it reaches the servers, so that the developer cannot read the content. The server infrastructure (PostgreSQL database and S3-compatible object storage) would be hosted in the European Union. Legal basis: your consent and/or performance of a contract.
• AI receipt recognition (OCR). If introduced and enabled by you, this would let you scan a receipt so the App can extract data (such as amount, date and merchant) to create an entry. It would process only the minimum data necessary for that purpose. Full details, including whether any processing occurs on-device or via a service provider, would be provided before release. Legal basis: your consent.

12. Legal bases for processing (GDPR)

Where the developer processes personal data, it relies on the following legal bases under Article 6(1) of the GDPR:

• Legitimate interests (Art. 6(1)(f)) — security, abuse prevention and rate-limiting of api.pigl.es; responding to support requests.
• Performance of a contract (Art. 6(1)(b)) — providing and maintaining paid features you purchase, including confirming your entitlement to them through the subscription link described in Section 8.
• Consent (Art. 6(1)(a)) — the optional AI chat with a provider you connect (Section 10), and optional future features you choose to enable (e.g. sync/sharing, AI receipt recognition). You may withdraw consent at any time.

13. Data retention

• On-device data (including your financial data): kept on your device until you delete it, clear the App's data, or uninstall the App. This is under your control.
• Backups and synchronisation data in your own cloud: kept until you delete them from within the App or in your Google/Apple account, or uninstall the App (in the case of the Google Drive app data folder); subject to your Google/Apple account settings.
• AI chat: the connection (including the key) and your conversation history are part of the database's data and follow the same rules as the rest of it — on your devices and in your own cloud until you delete them. Anything sent to an AI provider is retained under that provider's own policy — the developer holds nothing (Section 10).
• Server technical logs (api.pigl.es): kept for up to 48 hours with IP addresses truncated to their network prefix, then deleted; used only for security and abuse prevention.
• Subscription entitlement records (api.pigl.es): the hashed account identifier and the linked subscription record are kept for 365 days after the end of the last paid period and then deleted automatically — this period covers subscription resumption, refunds and the resolution of disputes about access rights; the log of store notifications is kept for 90 days. Earlier deletion — on request to support@pigl.es (Section 8).
• Web sign-in session and the encrypted Google grant (api.pigl.es): deleted when you sign out of the web version with the “revoke access” option, and in any case 180 days after the session was last used (Section 7).
• Support emails: kept only as long as needed to handle your request and reasonable follow-up.

14. Security

The developer uses appropriate technical measures to protect your data, including:

• SQLCipher encryption of the on-device database;
• AES-256-GCM encryption of backup files;
• end-to-end encryption of backups and synchronised data, so that the developer cannot read your content;
• data minimisation by design — the App is built so that personal data is not sent to the developer in the first place.

No system can be guaranteed to be perfectly secure. In particular, if your device is compromised, or if you export an unencrypted copy of your data, or share your credentials or recovery keys, your data may be exposed. Keeping your device, operating system and account credentials secure is your responsibility.

15. International transfers and recipients

The developer's own processing is minimal and, where server infrastructure is used (api.pigl.es; the future sharing feature described in Section 11), it is located in the European Union / European Economic Area.

The App integrates with the following independent third parties, which act as independent data controllers for the data they handle under their own terms and privacy policies. If you use their services, data may be processed in the countries where they operate, under their own safeguards:

• Apple (iCloud backup and synchronisation storage under your account; App Store payments) — https://www.apple.com/legal/privacy/
• Google (Google Drive backup and synchronisation storage under your account; Google Play payments) — https://policies.google.com/privacy

AI providers you connect yourself (only if you enable the AI chat, Section 10) act as independent data controllers under their own policies and may process data outside the EU/EEA. The developer does not select them for you and is not a party to that processing. The providers offered in the App:

• DeepSeek — https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html
• Google (Gemini API) — https://policies.google.com/privacy
• any other provider whose API endpoint you enter manually — under that provider’s own policy.

For the subscription entitlement records described in Section 8 the developer uses DigitalOcean (EU data centre, Frankfurt, Germany) as its hosting provider, acting as a data processor on the developer’s instructions. Apple and Google are the sources of the subscription-status information for those records (App Store Server Notifications; Google Play Real-time Developer Notifications) and act as independent controllers as described above.

The developer does not otherwise share, sell or transfer your personal data to any third party, except where strictly required to comply with a valid legal obligation.

16. Your rights

Regardless of where you live, the developer aims to honour the following rights. Under the GDPR and Spanish law (LOPDGDD), if you are in the EU/EEA you have the right to:

• access your personal data;
• rectify inaccurate data;
• erase your data ("right to be forgotten");
• restrict processing;
• object to processing based on legitimate interests;
• data portability;
• withdraw consent at any time, where processing is based on consent, without affecting prior lawful processing.

To exercise any of these rights, contact support@pigl.es. In line with Article 12(3) GDPR, the developer will provide information on action taken without undue delay and in any event within one month of receiving the request; that period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case you will be informed within the first month. Note that most of your data is stored only on your device and is directly accessible, exportable and deletable by you at any time through the App — the developer does not hold it.

Right to complain. If you are in the EU/EEA, you have the right to lodge a complaint with a supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid — https://www.aepd.es. You may also contact the supervisory authority in your country of residence.

Users outside the EU/EEA. Privacy rights vary by country. Even where a specific law may not apply to a small individual developer, the developer will make reasonable efforts to honour valid requests to access or delete personal data it actually holds, regardless of where you are located. This Policy does not claim that the developer is a "business" subject to the California Consumer Privacy Act (CCPA), as amended by the CPRA: under Cal. Civ. Code § 1798.140 those obligations apply only to a for-profit business meeting at least one of three thresholds — annual gross revenue above the inflation-adjusted baseline (US $26,625,000 for 2025–2026 under § 1798.199.95(d)), buying/selling/sharing the personal information of 100,000 or more California consumers or households per year, or deriving 50% or more of annual revenue from selling or sharing personal information — none of which the developer meets. The universal commitment above applies instead.

17. Children's privacy

Pigles is a general-audience personal finance tool and is not directed at children. The developer does not knowingly collect personal data from children.

The App is intended for users who are old enough to consent to the processing of personal data under the law of their country. Under Article 8(1) GDPR the default digital-consent age is 16 (member states may lower it to no less than 13); Spain's LOPDGDD (Article 7) sets it at 14; and the U.S. Children's Online Privacy Protection Act (COPPA), enforced by the FTC, governs data collection from children under 13. If you believe a child has provided personal data to the developer (for example, by emailing support), contact support@pigl.es and it will be deleted.

18. Changes to this Policy

This Policy may be updated from time to time, for example to reflect new features or legal requirements. The current version is always available at https://pigl.es/privacypolicy, with the "Last updated" date shown at the top. For material changes, the developer will provide reasonable notice — for example, an in-app notice or a prominent note on this page — and, where a change requires your consent, will ask for it before the change affects you.

19. Contact

Questions, requests or concerns about this Policy or your privacy:

Email: support@pigl.es
Postal address:
Pigl.ES
Calle Princesa 31, planta 2, puerta 2
28008 Madrid, Spain
Controller: Mikhail Lobov (individual developer, trading as Pigl.ES).