orza.

Privacy Policy

1. Introduction

Orza is a personal budget manager developed by Tsukiyo Labs. This Privacy Policy explains how we collect, use, and protect your information when you use Orza, and the rights you have over your data under the EU General Data Protection Regulation (GDPR).

Data controller: Gonçalo Santos, Portugal. You can reach us at tsukiyo.labs.orza@outlook.com.

2. Data We Collect

2.1 Personal Information

When you create an account, we collect:

• Email address — used for authentication and account recovery. Managed by Supabase.
• Password — stored only as a salted hash by our authentication provider; we never store it in plain text.

2.2 Financial Data

All financial data you enter (accounts, budgets, transactions, categories) is encrypted on your device using AES-256-GCM before it is stored locally or synced to our servers. The encryption key is derived from your password on your device and is never stored on our servers in readable form. As a result, we cannot read your financial data stored in our database — we only ever hold it as encrypted, unintelligible ciphertext.

2.3 Advertising Data

On the free tier, Orza displays ads via Google AdMob. Where required (including for users in the European Economic Area and the UK), we ask for your consent before any personalised advertising data is processed, using Google's consent management framework. AdMob may collect:

• Device identifiers
• IP address
• General location (country/region)
• Ad interaction data (clicks, impressions)

This data is collected and processed by Google as an independent controller. See Google's Privacy Policy for details. Users who upgrade to Orza Premium are no longer served ads.

2.4 In-App Purchases

If you purchase Orza Premium, the transaction is processed entirely by Google Play. We do not collect or store any payment information. See Google Play's Terms of Service for details.

3. How We Use Your Data and Our Legal Basis

Under the GDPR we must have a lawful basis for each use of your data:

Data	Purpose	Legal basis (GDPR Art. 6)
Email address	Authentication and account recovery	Performance of a contract (providing your account)
Encrypted financial data	Cloud backup and multi-device sync	Performance of a contract
Account & security data	Keeping your account and data secure	Legitimate interests (security of the service)
Advertising data (free tier)	Displaying ads	Consent (which you can withdraw at any time)

We do not sell or rent your personal data, and we do not share it beyond what is described in this policy.

4. Who We Share Data With (Processors)

We use the following service providers to operate Orza:

• Supabase — hosts your account and your encrypted data. We have a Data Processing Agreement in place with Supabase. See Supabase's Privacy Policy.
• Google (AdMob & Google Play) — advertising and payment processing. See Google's Privacy Policy.

5. Data Storage, Transfers and Security

• Financial data is encrypted on-device with AES-256-GCM before it is transmitted or stored.
• Your encryption key is derived from your password on your device and is never stored on our servers in readable form.
• Your encrypted data is stored on Supabase infrastructure hosted in the European Union.
• International transfers: our advertising and payments provider, Google LLC, may process some data (such as device identifiers and IP address) on servers in the United States. Such transfers are covered by Google's Standard Contractual Clauses and the EU–US Data Privacy Framework.
• We retain your data for as long as your account is active. When you delete your account, your personal and encrypted data are removed from our live systems, and from backups within [e.g. 30] days.
• You may request deletion of your account and all data at any time (see Section 7).

6. Biometric Data

Orza may use your device's biometric authentication (fingerprint, face recognition) to unlock the app. Biometric data is processed entirely by your device's operating system and is never accessed, transmitted, or stored by Orza.

7. Your Rights

Under the GDPR you have the right to:

• Access your data — available at any time through the app
• Rectify inaccurate data — you can edit your data directly in the app
• Erase your account and all associated data — via Settings → Delete account, or by contacting us
• Data portability — export your financial data through the app's export feature
• Restrict or object to certain processing
• Withdraw consent for advertising at any time, via your device's ad settings or the in-app consent options

For account deletion instructions, visit: orza.pt/delete-account.html

Right to complain: if you believe we have not handled your data lawfully, you have the right to lodge a complaint with your local data protection authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt.

8. Children's Privacy

Orza is not directed at children. We do not knowingly collect personal information from children below the age of digital consent in their country (16 in the EU by default; 13 in Portugal). If you believe a child has provided us with personal information, please contact us so we can delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or via email. Continued use of the app after changes constitutes acceptance of the updated policy.

---

10. Contact

If you have any questions about this Privacy Policy or wish to request data deletion, please contact us at:

tsukiyo.labs.orza@outlook.com