Privacy Policy

Monesto is an expense tracker for one person and for groups of people who share costs. This page describes what the Monesto apps and this website collect, why, and what you can do about it. It is written to be read, not to be survived.

The short version

• We collect what you type in, and the minimum needed to give you an account.
• The mobile app contains no advertising SDK and no third-party analytics. It reports crashes, so we can fix them, and it counts which set-up steps people reach — to us only, and you can switch that off.
• We do not track you across other companies’ apps or websites, and we never sell your data.
• No card or bank details ever reach us. Payments are handled entirely by Apple or Telegram.
• You can delete your account from inside the app, and it is deleted.

What we collect

Account details

When you sign in with Apple, with Google or with your email address, we receive your email address and, on first sign-in with Apple or Google only, your name. For email sign-in we send you a one-time link and code. If you use Apple’s Hide My Email, we receive the relay address rather than your real one, and that is all we ever have. We store an internal account identifier alongside it.

What you record

The substance of the service: amounts, currencies, dates, descriptions, categories, accounts, budgets and recurring rules; the groups you create or join, the people in them, and how each expense is split. You typed it in, and it is yours.

If you use Describe to fill in an expense from a sentence, the text you type is sent to OpenAI to turn it into the form’s fields.

Receipt photos, only if you attach one

If you attach a photo of a receipt to a group expense, we store the photo and the items read from it. The photo is sent to OpenAI to read the items and amounts. Everyone you mark as present at that table can see the photo and the items while the receipt is open, and once it is finished the photo stays with the expense it became. A receipt that is cancelled, or that expires unfinished after 7 days, has its photo deleted.

Device details, only if you allow notifications

If you turn on push notifications we store a notification token for that device and whether it is an iOS or an Android device, so we can send you the reminders you asked for. On iPhone we also store the tokens Apple issues for Live Activities, so an open receipt can update on your Lock Screen. Refusing the permission means we store nothing, and signing out removes the tokens.

Purchases

If you subscribe, we record which plan you are on, when it renews, and the identifier the store gives that transaction. No card number, bank detail or billing address ever reaches us — the payment happens inside Apple’s or Telegram’s system, and we are told only whether it succeeded.

Anything you send us

If you use the in-app feedback form or write to us, we keep what you wrote so we can answer it.

Crash reports

When the app crashes it sends a report to Sentry so we can find out why. A report contains the error, where in the code it happened, and what kind of device and app version it happened on.

It is deliberately narrow. We have turned off the setting that would attach your IP address and account to a report; the record of network calls attached to a crash keeps the address and the status code and discards the contents, because the contents would be your actual transactions; and anything that reaches the report despite that is stripped before it is sent. We do not use crash reporting to measure what you do in the app, and it collects no performance trace of which screens you visited.

How you get set up

The app records a small number of usage events while you are setting it up: which of the introduction screens you reached, whether signing in succeeded or you closed the sheet, whether you added a first expense, and whether you finished or skipped. Each one carries the step, the platform and the app version — and, for the screens you see before you have an account, a random identifier belonging to that installation, so those screens can be joined to the account you end up with. It never carries the amount of an expense, a description, a group name, or anything you typed.

We use it for one thing: to find out where setting up the app goes wrong, so we can fix it. It goes to our own servers, in the same way everything else in the app does. There is no analytics SDK in the app and no third party receives it.

You can turn it off in Settings → Share usage data. Turning it off stops new events and deletes anything still waiting on your device.

What we do not collect

The mobile app has no advertising identifier, no cross-app tracking, no advertising or analytics SDK of any kind, and no session-replay tool. Nothing it records leaves our servers. We do not build a profile of you and we do not sell, rent or trade personal data to anyone, for any purpose.

This website is different from the app in one respect: monesto.me uses Google Analytics and Ahrefs Analytics to count visits and understand which pages people find. That is the website only. Those tools are not present in the mobile app.

Why we are allowed to hold it

If you are in the UK or the European Economic Area, the lawful bases we rely on are: performance of a contract for everything needed to run your account and show your figures; consent for push notifications, which you give by allowing the permission and withdraw by turning it off; and legitimate interests for keeping the service secure and working — which includes crash reporting — for understanding where setting up the app goes wrong, and for the website analytics described above. You can object to the set-up measurement by switching it off in Settings, which is why it has a switch.

Who else sees it

We use a small number of providers, and only for the job named:

• Apple — Sign in with Apple, App Store subscriptions, and delivery of push notifications and Live Activity updates to iPhones.
• Google — Google Sign-In, and analytics on this website.
• Expo — relays push notifications from us to Apple and Google. It sees the notification token and the text of the notification.
• Telegram — if you use Monesto through the Telegram bot, or pay with Telegram Stars.
• OpenAI — reads receipt photos and Describe text, only to fill in an expense for you.
• The AI assistant you connect — Anthropic for Claude, OpenAI for ChatGPT. Only if you connect one yourself, and only what it asks for while you use it. See AI assistants you connect.
• Cloudflare — stores receipt photos.
• Resend — sends the sign-in emails.
• Sentry — receives crash reports from the mobile app, in the narrowed form described above, on their European Union infrastructure.
• Our hosting and database providers — who store the data on our instructions and for no purpose of their own.

We will also disclose data where the law genuinely requires it. If that ever happens we will tell you, unless we are forbidden from doing so.

Other people in your groups see what you share with them. An expense you add to a group, and how it is split, is visible to every member of that group. That is the purpose of a group, and it is worth being clear that it is not private to you. The same goes for a receipt: its photo and who claimed what are visible to everyone marked as present.

AI assistants you connect

You can connect Monesto to an AI assistant such as Claude or ChatGPT, so you can add and read expenses by asking it. Nothing is shared with an assistant unless you connect it.

What the assistant receives. The entries, balances, categories and summaries it asks for to answer you, and the display names and shares of people in groups you share. It never receives other members' contact details or any payment details, and the connection cannot move money.

What we keep about the connection. Which assistant you connected, what it may do, and when it was connected, last used and disconnected, kept with your account. Its access tokens are stored only as one-way hashes. Sign-in requests, including the Apple or Google sign-in data tied to them, are deleted a day after they expire. A connection's token records are deleted 30 days after you disconnect it, or six months after it was created.

What your group sees. Entries an assistant adds for you are labelled with its name, for example “via Claude”. A member who connects an assistant shares with it the group data they can already see.

Disconnecting. Send /apps to @monesto_bot, use the link in the “connected” email, or remove the connector in the assistant. Access stops within a minute.

The assistant's side. What the provider does with your conversation is governed by its own policy: Anthropic and OpenAI. We cannot delete data from their side.

Where it is held

Data is stored on servers in the European Union, and crash reports go to Sentry's EU region specifically rather than to a default one. Some of the providers listed above operate internationally, and where data reaches them outside the EEA or the UK it is covered by the transfer safeguards those providers publish, such as Standard Contractual Clauses.

How long we keep it

For as long as you have an account, and then no longer. Deleting your account removes your personal details permanently and immediately.

One thing survives, and you should know why. Entries you added to a shared group stay in that group, with your name removed. If they did not, every other member’s balance would silently change — someone who owes forty euros would appear to owe nothing, because the record of what they owed it for is gone. What remains is the expense, not you.

Set-up usage events are kept for 24 months and then deleted. Deleting your account unlinks them from you at once: what is left is that a step was reached, with nobody attached to it.

Backups roll off within 30 days.

Deleting your account

In the app: Settings → Delete account. It is a real deletion, it takes effect at once, and it does not require you to write to anyone or explain yourself. If you prefer, write to the address below and we will do it.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, ask for it in a portable form, or object to a particular use of it. Write to support@monesto.me and we will answer within 30 days. There is no charge, and asking is not held against you.

If you are in the UK or the EEA and you think we have got something wrong, you can complain to your national data protection authority. We would rather you told us first, but it is your right either way.

Children

Monesto is not intended for children under 16. We do not knowingly collect their data, and if we learn that we have, we delete it.

Changes

If this page changes in a way that affects you, we will say so in the app before the change takes effect rather than quietly editing the date at the top.

14 October 2026: added AI assistants you connect.

Who operates Monesto

Monesto is operated by Anton Bogatikov, an individual trader based in Tbilisi, Georgia. That is the data controller for everything described on this page.

Contact

support@monesto.me, or @monesto_bot on Telegram.