Surplus — Privacy Policy (v2.0)
Dieses Dokument ist derzeit nur auf Englisch verfügbar. Der englische Text ist maßgeblich: English
Effective Date: 29 October 2026
Controller: GGkas Sàrl-S, 12 Rue de la Gare, L-3377 Leudelange, Luxembourg
RCS: B279432 · EU VAT: LU35348364
Contact (privacy & rights): support@surplus-app.com
This Privacy Policy explains how we collect, use, share, and protect your personal data when you use:
- the Surplus apps for iOS, Android and web (my.surplus-app.com),
- our website surplus-app.com and its subdomains.
“Surplus”, “we”, “us”, or “our” refers to GGkas Sàrl-S.
We comply with the EU GDPR and Luxembourg law, and with UK-GDPR where applicable. If this Policy conflicts with mandatory local law, the latter prevails.
1) Summary
- Surplus forecasts your household’s money from the balances and plan you enter. We never ask for your bank login and do not connect to your bank.
- CSV and Excel statements you import are read on your device. PDF import is switched off; if we enable it, an uploaded PDF is parsed on our EU server and deleted after parsing (see §4). Only the normalised transactions are stored, for 24 months from import.
- Your data is stored in Google Cloud/Firebase in europe-west1 (Belgium).
- If you share a household, the other members can see that household’s data according to their role (see §9).
- No ads, no ad tracking, no sale of data.
- Subscriptions (Surplus Plus) are bought through the Apple App Store or Google Play; entitlements are managed by RevenueCat. We do not process card details.
- You can delete your account in the app. To get a copy of your data, or for any other request, email us.
- Minimum age is 16.
2) Who we are & how to contact us
Controller: GGkas Sàrl-S (Luxembourg), 12 Rue de la Gare, L-3377 Leudelange
Email: support@surplus-app.com
No Data Protection Officer (DPO) is appointed; this is not legally required given our size and processing. We reassess periodically.
Supervisory authority: Commission nationale pour la protection des données (CNPD), Luxembourg. You may also complain to your local authority in the EEA/UK.
3) Scope
This Policy covers the Surplus apps, the surplus-app.com website, and the backend services, support channels and mailings that go with them. It does not cover third-party sites or the app stores, which have their own policies.
4) What we collect
- Account & profile — name (optional), email, sign-in provider and authentication UID (Google, Apple, or email link), language, notification preferences, and your choices on crash reports and usage analytics, with the version of this notice they were given for and when you made them.
- Household data you enter — household name and settings; accounts (current, savings, card) with balances and card terms; income and scheduled payments; day-to-day budgets; one-off items; savings and purchase plans; checkpoints; notes; member list and roles.
- Imported transactions — CSV and Excel statements are parsed on your device and the original file is not uploaded. We store only the normalised transactions (date, amount, description, category) and your categorisation rules. PDF import is switched off. If we enable it, household owners and editors on Plus can upload a PDF: it is uploaded to our server in the EU, parsed there and deleted after parsing; only the normalised transactions are kept. While it is off, an uploaded PDF is deleted on arrival.
- Invitations — the email address you enter when inviting someone, so we can send the invitation.
- Reminders — your reminder settings and the scheduled reminder records needed to send them (push notifications; device push token).
- Subscription — your subscription status (Plus or Free, expiry, source store) and purchase identifiers from RevenueCat, the App Store or Google Play. We do not receive your card or payment details.
- Crash reports — only if you consent: app and OS version, device model, crash reports and stack traces (Firebase Crashlytics, iOS and Android only; the web app sends none). Crash reports do not contain amounts or descriptions.
- Usage analytics — only if you consent: a limited set of events (e.g., which screen or feature was used) via Firebase Analytics. Events never include amounts, names, descriptions, or a user or household identifier.
- Security & logs — IP address and standard server logs; App Check attestation tokens (Play Integrity, Apple App Attest, reCAPTCHA Enterprise in the web app) used to ensure requests come from genuine apps. Our backend logs record identifiers only, not financial content. Sign-in audit: when someone tries to sign in with an email address that has no Surplus account, we keep one record per address with a keyed hash (HMAC) of the address, the email domain in plain text, the platform (iOS, Android or web), one-way hashes (SHA-256) of the IP address and of the browser or app user-agent, a count, and the first and last time seen. Hashed IP counters limit how often sign-in attempts are recorded.
- Newsletter — email address, the language of the page you subscribed from, and a record of your consent and confirmation (double opt-in), when you subscribe on our website (see §15).
- Support — emails you send to support@surplus-app.com.
- Beta feedback — if you test a beta version and fill in our feedback form (Google Forms): your answers (device type, who shares money in your household, ratings, free-text comments, the parts of the app you used) and, only if you choose to give it, an email address so we can contact you about your answers. The form does not collect your email address automatically and does not require you to sign in.
We do not intentionally collect special-category data nor data about children under 16. Free-text fields (notes, descriptions) are yours; please do not enter sensitive data there.
5) Sources
- You (data you enter, import or share).
- Other household members (data they add to a household you belong to).
- Your device (diagnostics).
- App stores and RevenueCat (subscription status).
6) Purposes & lawful bases
| Purpose | Examples | Lawful basis |
|---|---|---|
| Provide the service | Sign-in, storing and forecasting your household data, sharing with members, reminders | Contract (Art. 6(1)(b)) |
| Invitations | Emailing the person you invite | Legitimate interests (the invitee is not a party to the contract; one email, no profiling) |
| Subscriptions | Verifying entitlement, applying Plus to a household | Contract + Legal obligation |
| Security & abuse prevention | App Check, rate limits, logs, sign-in audit | Legitimate interests (protecting accounts and the service) |
| Crash reporting | Crashlytics (iOS, Android) | Consent (Art. 6(1)(a)), withdrawable in Settings → Privacy |
| Product analytics | Firebase Analytics events | Consent (Art. 6(1)(a)), withdrawable in Settings → Privacy |
| Newsletter | Product updates | Consent (Art. 6(1)(a), double opt-in) |
| Newsletter consent record | Keeping the record of your consent and opt-out after you unsubscribe | Legitimate interests (Art. 6(1)(f): being able to prove consent and honour the opt-out) |
| Newsletter abuse protection | Sign-up rate limits, hidden bot field | Legitimate interests (stopping abuse of the form and of other people's email addresses) |
| Support | Answering your emails | Legitimate interests |
| Beta feedback | Improving the app from testers' answers | Legitimate interests (Art. 6(1)(f)) |
| Beta feedback contact | Contacting you about your answers, if you left an email address | Consent (Art. 6(1)(a)), withdrawable by email at any time |
| Legal & accounting | Records we must keep | Legal obligation |
Where we rely on legitimate interests, we balance them against your rights and you may object.
7) Cookies and similar technologies
- The apps use local storage on your device for sign-in and offline data. Analytics and crash-reporting identifiers are used only with your consent.
- The web app (my.surplus-app.com) uses Google reCAPTCHA Enterprise for App Check, to verify that requests come from the genuine app (security, see §6). It reads browser and interaction signals and may set Google cookies for that purpose only.
- The website uses no advertising or analytics cookies and loads no third-party tracking or anti-bot scripts.
- We do not use advertising SDKs, ad identifiers or cross-site tracking.
8) Where we process & store data
- Primary storage: Google Cloud/Firebase europe-west1 (Belgium) for account and household data.
- Optional PDF uploads and data export files are kept in Cloud Storage for Firebase in europe-west1 (Belgium) (see §11).
- Some providers (e.g., RevenueCat, Resend, Google crash and analytics services) may process limited data outside the EEA. We rely on the transfer tools described in §10.
9) Sharing & recipients
Household sharing. A household can have several members (owner, editors, viewers). Every member can see the household’s data (accounts, balances, plan, imported transactions); editors and owners can change it. Members see each other’s name/email as shown in the member list. The owner controls invitations and roles. If you leave a household, you lose access to it; the household’s data stays with the household. Before you add someone, make sure they should see this information.
Other recipients. We do not sell your data and do not share it for cross-context behavioural advertising. We disclose data to:
- Processors acting on our instructions: Google Cloud/Firebase, RevenueCat, Resend (email: household invitations and the newsletter), Google Workspace (support mail; the beta feedback form and its responses in Google Forms and Google Sheets). Sign-in links are sent by Google (Firebase Authentication); reminders are push notifications (Firebase Cloud Messaging). See /subprocessors.
- Independent controllers: Apple and Google (App Store / Google Play purchases, and sign-in if you choose Apple or Google).
- Authorities, where required by law or to protect rights, safety and security.
- Corporate transactions: in a merger, acquisition or asset sale, subject to continued protection.
10) International transfers
Where processing involves a country without an EU/UK adequacy decision, we use Standard Contractual Clauses (SCCs) and, where applicable, the UK IDTA/Addendum, plus supplementary measures. Some providers also participate in recognised transfer frameworks. Contact us for details.
11) Retention
- Account & profile: for the life of your account; erased within 30 days of deletion (cleanup starts as soon as you delete the account).
- Household data (accounts, plan, items): until the household is deleted. A household is deleted when its last member deletes their account (see §13).
- Imported transactions: 24 months from import, then deleted automatically.
- Uploaded PDFs (optional import): deleted after parsing; an hourly check deletes any upload left unprocessed.
- Data export files: each file is deleted automatically about 24 hours after it is created (checked every hour), or earlier when you make a new export. If you delete your account, the file is deleted with it (within 2 hours at the latest). The download link is valid for 15 minutes.
- Reminder records: 30 days.
- Sign-in audit: 30 days after the last recorded attempt, deleted automatically. Hashed IP counters: 1 hour.
- Newsletter: confirmed subscriptions until you unsubscribe. After you unsubscribe we keep your address marked as unsubscribed, with the consent history, to prove your consent and honour the opt-out, and delete it 3 years after you unsubscribe. Sign-ups never confirmed are deleted 30 days after the request (the confirmation link itself expires after 7 days). Both deletions are automatic and can lag the date by up to a few days. Sign-up rate-limit counters (hashed): 1 hour (per network address) or 24 hours (per email address), deleted automatically.
- Invitations: an invitation expires after 7 days; the invitation record, including the invitee's email address, is deleted about 37 days after it was sent.
- Crash reports: 90 days.
- Server logs (incl. IP): 30 days.
- Analytics data: 2 months (event-level data).
- Backups: we keep no database backups.
- Support emails: 24 months after last contact.
- Beta feedback: 12 months after you submit the form, then deleted from Google Forms and Google Sheets. If you withdraw your consent to be contacted, we delete your email address from your answers.
- Data-subject request records: 3 years.
- Subscription records: as long as required for tax/audit (up to 10 years), held by the stores and RevenueCat.
We may retain minimal data to comply with legal obligations, resolve disputes and enforce agreements.
12) Security
We apply technical and organisational measures including: encryption in transit and at rest; Firestore security rules enforcing household membership and roles; App Check on our backend; least-privilege access with MFA for admin accounts; no secrets in code; logging of identifiers only; incident response with GDPR notification (authorities within 72 hours where required; affected users without undue delay).
No system is perfectly secure.
13) Your rights
Under GDPR/UK-GDPR you can access, rectify, erase, restrict or object to processing, port your data, withdraw consent at any time, and lodge a complaint with a supervisory authority.
- Export: email us and we send you a copy of your data (JSON), until the in-app export is available.
- Deletion: in the app under Settings → Your data → Delete account, or by email. Deleting your account removes your profile, your memberships and your reminder settings. A household where you are the last member is deleted with all its data. In a shared household the data stays with the household for its other members, including what you added; if you were the owner, ownership passes automatically to the longest-standing editor, or otherwise to the longest-standing member. To delete a shared household as a whole, email us. Our backend starts the cleanup as soon as you delete your account, and it completes within 30 days.
- Other requests: email support@surplus-app.com. We respond within one month (extendable by two months for complex requests). We verify identity via your signed-in account or email match; we do not generally require photo ID.
14) Children
Surplus is intended for users 16+. We do not knowingly collect data from children under 16. If you believe a child has used Surplus, contact us and we will delete the account.
15) Marketing & newsletter
We send newsletters only with your explicit double opt-in, and you can unsubscribe at any time (link in every email). Service messages (sign-in links, invitations, push reminders you enabled) are not marketing.
Newsletter. You can subscribe to occasional news about Surplus with the form on surplus-app.com.
- What we collect: your email address; the language of the page you subscribed from (English, French, German or Luxembourgish; other languages are recorded as English); and a consent record: when you submitted the form with the consent box ticked, where you subscribed (our website, or our one-time re-confirmation email described below), when you confirmed and, if you unsubscribe, when.
- Purpose and lawful basis: to send you the newsletter, based on your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by unsubscribing; this does not affect sending that took place before. After you unsubscribe we keep the consent record on the basis of our legitimate interests (Art. 6(1)(f)), so that we can show you agreed and honour your opt-out.
- Double opt-in: after you submit the form we email you a confirmation link. You are subscribed only after you open the link and press Confirm subscription. The link is valid for 7 days. If you do not confirm, you receive no newsletter.
- Subscribers from the previous version of our website: if you subscribed there, we have no record that you confirmed your subscription. We email you once in the language you subscribed in and ask whether you want to keep receiving the newsletter, and we send you no newsletter until you confirm. If you confirm, the time of your confirmation is recorded as your consent. If you do not confirm, your address is deleted 30 days after that email. Lawful basis for this one email: legitimate interests (Art. 6(1)(f): asking people who subscribed before whether they still want the newsletter, instead of either mailing them without proof of consent or deleting them without asking).
- Abuse protection: the form has a hidden field that filters out bots, and we limit sign-ups to 10 per hour per network address and 3 per day per email address. For this we store only one-way hashes (SHA-256) of your IP address and email address, deleted automatically after 1 hour or 24 hours. Lawful basis: legitimate interests (stopping abuse of the form and of other people's email addresses).
- Where it is stored and who processes it: subscriptions are stored in our database (Google Cloud Firestore, europe-west1, Belgium), which only our backend can read. The confirmation email and the newsletter issues are sent by Resend (EU, Ireland) from news@surplus-app.com. We will update /subprocessors before any other provider sends the newsletter.
- Unsubscribe: every newsletter email, including the confirmation email, has an unsubscribe link, and mail apps that support it show a one-click unsubscribe button. You can also write to support@surplus-app.com. Unsubscribing takes effect immediately. To subscribe again you must give your consent again.
- Retention: see §11.
16) UK users & representative
If and when Article 27 UK-GDPR requires a UK representative, we will update this Policy before commencing the relevant activities. Until then, UK users can contact us directly.
17) Changes to this Policy
We may update this Policy to reflect changes in law, technology or our services. For material changes we will give reasonable notice (email, in-app or banner).
18) Contact & complaints
- Contact us: support@surplus-app.com
- Supervisory authority (Luxembourg CNPD): you may lodge a complaint with the CNPD or your local authority.