Privacy
What Tobsy can see, and what it can't.
This page is written in plain words on purpose. Where it makes a claim about the code, the code is built to match it.
The short version
Your money data — every entry, category, note, merchant and figure — lives in a Google Sheet in your own Google Drive. Tobsy reads and writes that sheet directly from your browser. We have no server that stores it, and no path by which it could reach us. The only personal detail we ever hold is the email address you start a trial with.
Who holds what
- Your Google Sheet — every figure you ever enter. It is the only place your money data exists. You can open it, read it, and take it with you at any time.
- Your phone or laptop — the address of your sheet, a spare copy of your key so the app knows it's allowed to run, and a small cache so screens open quickly. None of it leaves the device.
- Google — the sheet is a Google document, so Google's own terms and privacy policy apply to it, as they do to anything in your Drive. Tobsy asks Google for exactly one permission: to work in the spreadsheet it is attached to. Not your Drive, not your email, not your contacts.
- This website — nothing about you. It has no analytics, no tracking pixels, and sets no cookies.
- Our key server — the email address you started with, a random trial number, a scrambled fingerprint of your copy of the sheet, and whether you have paid. Never a figure, never a shop name, never a category, never a person's name. Once a day the app asks it one question — is this key still good? — and tells it nothing but the key's own number.
- The checkout — payments are taken by a merchant of record, who handles your card and your receipt under their own privacy policy. We receive your email address and the fact that a purchase happened. We never see card details.
What the app talks to
The app in your browser talks to exactly one address: the script inside your own copy of the sheet. That script talks to Google Sheets and, for exchange rates, to a Google Finance formula inside your own sheet. There is no outside code on the page, the fonts are served by us rather than a third party, and the page tells browsers to refuse being embedded in anyone else's site.
Private categories
A category you mark private shows its rows as dots until a PIN is entered. This is privacy between people who trust each other and share a sheet — a curtain, not a vault. The rows are not encrypted on the device: someone holding your unlocked phone could read them. Five wrong PIN tries lock the keypad for fifteen minutes.
We use your email address to send you your key and your receipt, to send the key again if you ask, and to tell you about a new version of Tobsy when there is one. Nothing else. There is no newsletter, and we don't pass your address to anyone.
If we disappear
Every paid copy keeps working, for good. Your key never expires, the check that reads it runs inside your own copy, and the sheet was always yours. The only people affected would be those who haven't bought yet.
Deleting everything
Delete your copy of the sheet from your Drive and your money data is gone — it existed nowhere else. To have your email and trial record removed from our key server, write to [email protected] from that address.