Your privacy.

Who runs Budgety

Budgety is operated by Nox Interactive LLC, the company behind Ramuvo, incorporated in Missouri, United States. This notice covers Budgety at budgety.ramuvo.com. Ramuvo’s own privacy notice separately covers your Ramuvo account.

Your private vault

Your browser encrypts financial records before saving them to Budgety. Transaction descriptions, amounts, dates, categories, currencies, and budgets are stored as an encrypted vault. Encryption uses AES-256-GCM with a key derived from your separate vault password using PBKDF2-SHA-256 (600,000 iterations).

Your vault password and decryption key are not sent to our server. The unlocked key and financial records stay in browser memory. The vault locks after five minutes of inactivity, on page reload or leaving the page, and when you lock it or sign out. We cannot recover your records if you lose your vault password.

Encryption does not protect data while your device or browser is compromised, or against malicious code delivered to your browser. It is not a guarantee of absolute security. If you used Budgety before private vaults, legacy records remain readable by the server until you create your vault; migration deletes the active plaintext records after saving the encrypted vault, but older backups may retain them.

Account and service data

Ramuvo sign-in provides your account identifier and display name. Budgety stores these in your signed session and stores your account identifier with your currency and theme preferences, encrypted vault, encryption salt and nonce, revision, and update time. These details are not encrypted with your vault password. Ciphertext size and update timing can also reveal usage patterns.

We use this information to sign you in, associate your vault with your account, save preferences, and operate and secure the service. Request metadata, including IP addresses and technical information, may be processed by our hosting provider. We do not install advertising or third-party analytics trackers in Budgety.

Creating your Budgety account through Ramuvo can award the Vaultkeeper achievement on your public Ramuvo profile. That badge shows an association with Budgety; it does not include financial records or your vault password.

Cookies and browser storage

Budgety uses essential sign-in cookies: budgety_flow lasts up to ten minutes during sign-in, and budgety_session lasts up to one hour. Production cookies use Secure, HttpOnly, and SameSite=Lax protections. Signing out clears the Budgety session.

The budgety-appearance local storage entry remembers your currency and theme until you change them or clear site data. It contains no financial records or vault password. Demo records are examples held in the current browser session and are not saved to your account.

Providers and disclosure

Cloudflare provides application hosting and database infrastructure and processes encrypted vaults, account preferences, and technical request data. Its infrastructure is global and may process information in the United States and other countries. Ramuvo provides authentication and the account achievement. Budgety does not send your financial records to Ramuvo for the achievement.

We do not sell your personal information. We may disclose available information when required by law or necessary to protect the service and its users. A disclosure of stored vault contents would contain ciphertext, not a decryption key held by us.

Retention and your choices

Saved vaults and preferences remain stored for continued use. Budgety does not currently have a self-service account deletion tool or a published fixed retention period for infrastructure logs and backups. Clearing browser data or deleting an Ramuvo account does not itself delete the Budgety database record.

Contact hello@ramuvo.com to request access, correction, or deletion of the account information and encrypted vault we hold. We may need to verify account ownership. Depending on your location, you may also have rights to restrict or object to processing, request portability, or complain to your local data protection authority. We cannot decrypt financial records to fulfil an access request; access to their readable contents requires your vault password.

Where applicable, we rely on providing the requested service to process account and vault data, legitimate interests to secure and maintain the service, and legal obligations for required disclosures. We will update this notice when our practices change and show the revision date above.