Privacy
What Tobsy can see, and what it can't.
This page is written in plain words on purpose. Where it makes a claim about the code, the code is built to match it.
The short version
Your money data — every entry, category, note, merchant and figure — lives in a Google Sheet in your own Google Drive. Tobsy reads and writes that sheet directly from your browser. We have no server that stores it, and no path by which it could reach us. We run one small server of our own, the key server. It pairs the email address you start with to your key, so a trial can end after 30 days and a purchase can be told from a trial; without it there would be no trial and no purchase, only a free copy, and no way to keep building Tobsy. It holds no other personal or financial information.
Who holds what
- Your Google Sheet — every figure you enter. It is the only place your money data exists. You can open it, read it, and take it with you at any time.
- Your phone or laptop — the address of your sheet, a spare copy of your key so the app knows it's allowed to run, and a small cache so screens open quickly. None of it leaves the device.
- Google — the sheet is a Google document, so Google's own terms and privacy policy apply to it, as they do to anything in your Drive. Tobsy asks Google for exactly one permission: to work in the spreadsheet it is attached to. Not your Drive, not your email, not your contacts.
- This website — counts visits. Cloudflare, who host the site, count page views for us without cookies and without identifying anyone: which pages were opened, roughly which country, which kind of browser, and nothing that points at a person. We keep a count of our own as well, described under Counting visits. No tracking pixels, no cookies.
- Our key server — the email address you started with, a random trial number, a scrambled fingerprint of your copy of the sheet, and whether you have paid. Not a figure, a shop name, a category or a person's name. Once a day the app asks it one question — is this key still good? — and tells it nothing but the key's own number and a scrambled fingerprint of your copy.
- The checkout — payments are taken by a merchant of record, who handles your card and your receipt under their own privacy policy. We receive your email address and the fact that a purchase happened. We do not see card details.
What the app talks to
The app in your browser talks to our key server about your key: when you set it up, when you buy it, and once a day to ask whether the key is still good, which is how a refund can stop it. That is the one server of ours the app talks to, and it carries nothing about your money. Everything to do with your money goes to one place: the script inside your own copy of the sheet. That script talks to Google Sheets and, for exchange rates, to a Google Finance formula inside your own sheet. There is no outside code on the page, the fonts are served by us rather than a third party, and the page tells browsers to refuse being embedded in anyone else's site.
Counting visits
Each page of this website sends our own counter two things: which page was opened and, when you arrived by a link from another site, which site that was. There is no cookie. Like any request on the internet, it arrives with your internet address and browser type; the counter scrambles those two together with a code that changes every day, and keeps only the scrambled result, not your address. Tomorrow the same browser gives a different result, so nothing links one day’s visits to the next, and the results are deleted after 35 days, leaving only the counts. The Tobsy app sends the counter nothing. A tap on Useful under a post is counted the same way: the scrambled result marks the tap, so a second tap the same day takes it back, and only the count stays.
Why we count visits
The app sends us nothing: no telemetry, no analytics, no cookies, no account. This website counts visits and nothing else. That count is the one way we can tell whether anyone is finding Tobsy, and whether the trial and the price make sense to the people who do. We would rather learn that from an anonymous count than by following anyone.
Private categories
A category you mark private shows its rows as dots until a PIN is entered. This is privacy between people who trust each other and share a sheet — a curtain, not a vault. The rows are not encrypted on the device: someone holding your unlocked phone could read them. Five wrong PIN tries lock the keypad for fifteen minutes.
We use your email address to send you your key and your receipt, to send the key again if you ask, and to tell you about a new version of Tobsy when there is one. Nothing else. There is no newsletter, and we don't pass your address to anyone.
If we disappear
Your key does not expire, and your sheet is yours: every entry stays readable and downloadable with no Tobsy at all. The app itself does lean on two things we run, a small piece of code your copy talks to and the website the app loads from. If Tobsy shut down, we would publish both so existing copies keep working without us; the sheet is the part that survives anything.
Deleting everything
Delete your copy of the sheet from your Drive and your money data is gone — it existed nowhere else. A trial that does not turn into a purchase is removed from our key server by itself, six months after the trial ended. To have your email and trial record removed sooner, or a purchase record removed, write to [email protected] from that address.