Privacy Policy
Last updated: October 28, 2026
This policy explains what personal data Costia collects, what we use it for, and what rights you have over it. It is drafted in line with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Data controller
The controller of your personal data is Javier Rubio Roca, an individual developer and operator of the Costia service (the "service"). Contact for privacy matters: support@costia.app
2. Personal data we process
We only process the data we need to provide you with the service: • Account data: email, name, nickname, first and last name, date of birth, phone and avatar (all optional except email). • Technical identifiers: internal user id, device id ("X-Device-Id" header) and Firebase Cloud Messaging tokens for push notifications. • Authentication data: hash of your password (never the plain password), Google or Apple identifiers if you link those sign-in methods, and public keys of your passkeys (WebAuthn). • Service usage data: your personal expenses, expenses shared in groups, the list of groups you belong to, your friendships, your custom categories and payment methods, and your preferences (language, currency, privacy settings). • Avatar photo: if you upload one, it is stored in our object storage service. • Premium Family household: if you own or join a family plan, the household you belong to, its members, and the invitations sent and received (who invited whom, the code, and when it expires). • Suggestions: if you suggest an idea or tell us about a bug from Profile → Suggestions or through the assistant, the text you write, together with your account id and the app's version, platform and language.
3. Data we DO NOT process
For transparency, here is what Costia does NOT collect: • We do not process payments and we do not store credit-card data. • We do not collect your geolocation. • We do not access your device contacts. • We do not use third-party analytics, advertising pixels or tracking cookies. • We do not record audio. The microphone is used only while you dictate a message to the assistant, and the speech is turned into text on your own device: the audio never leaves it and is not stored.
4. Purposes of processing
We use your data to: • Provide the core service of expense tracking and splitting. • Sync your information across your devices. • Authenticate you and protect your account. • Send push notifications when there are changes in your groups (if you have the app installed). • Handle the suggestions and bug reports you send us, with the help of AI, and let you know how they are going: in the app and, if you ask, by email when one is accepted or declined. • Comply with applicable legal obligations.
5. Legal basis (GDPR art. 6)
The legal basis for processing is the performance of the contract you accept by using the service (art. 6.1.b GDPR) for everything required to make the app work. For optional features we rely on your consent (art. 6.1.a GDPR): • Push notifications. • Discoverability by email or phone ("Allow others to find me by email/phone"), which you can toggle in Profile → Privacy. We process the suggestions you choose to send us to deal with your request (art. 6.1.b GDPR) and on the basis of our legitimate interest in improving the app (art. 6.1.f GDPR).
6. Recipients and processors
To operate the service we rely on the following providers, who process data on our behalf: • Google LLC: Firebase Cloud Messaging (push delivery), Google Sign-In if you link that method, and the Gemini models that currently answer the AI features. • Vercel Inc.: runs the AI Gateway, which passes what you hand an AI feature (a receipt photo and its text, the content of an expense, your messages to the assistant) to the model provider, along with the text of the suggestions you send us, to check whether they are about the app or repeat another one. • Cloudflare, Inc.: hosts the web version (finance.costia.app) and Costia's public pages (costia.app), and every connection to Costia's servers (api.costia.app and the other costia.app addresses the app talks to) passes through its global network, which protects it: it processes the technical data of each request (IP address, browser or app user agent, requested address) and passes its content on to our servers without storing it; and object storage (Cloudflare R2, EU jurisdiction) for photos, attachments, avatars and the emails you forward to Costia. • Gcore (G-Core Labs S.A., Luxembourg): while Spanish internet providers block Cloudflare's addresses (during LaLiga football matches), the app retries its connections to Costia's servers through a mirror on Gcore's network, which passes each request on to Cloudflare: the encrypted connection ends there, so it processes the same technical data (IP address, browser or app user agent, requested address) and passes the content on to our servers without caching or keeping it. • Sentry (Functional Software, Inc.): crash reports, stored in the EU, with the error, the app version and platform, and your internal user id. • RevenueCat, Inc.: keeps track of Premium subscriptions bought in the app stores, with your internal user id and the state of your purchases. • Resend: sends Costia's emails, such as the verification of your address and invitations, with your email address and the message. • GitLab Inc.: stores each suggestion, with the details that come with it, as a confidential issue for Costia's team. • Anthropic PBC: Claude, the AI agent that analyzes suggestions, reads their text and the app's code. • Apple Inc.: Sign in with Apple if you link that method. • Apple and Google, as app stores: they process the purchase of a subscription; we never see your payment method. • Own infrastructure: the servers and databases behind api.costia.app, operated directly by the controller. We do not sell or share your data with third parties for commercial purposes. If you belong to a Premium Family household, its other members see your nickname, name and avatar, and its owner also sees who is in the household and who has been invited. They do not see your expenses because of it.
7. International transfers
Google, Apple, Vercel, Cloudflare, RevenueCat, Resend, GitLab and Anthropic may process data outside the European Economic Area. Such transfers rely on the Standard Contractual Clauses approved by the European Commission or equivalent adequate safeguards. Crash reports (Sentry) and stored files (Cloudflare R2) are kept in the EU.
8. Data retention
We keep your data while your account is active. When you delete your account, we erase or anonymize your personal data: references to your participation in shared groups become "Deleted user" to preserve the historical integrity of group expenses, while your credentials, email, name, avatar, personal expenses and custom data are removed, along with the text of your suggestions and its copy in GitLab.
9. Your rights
As the data subject you may exercise the following rights at any time: • Access, rectification, erasure, objection, restriction and portability. • Withdraw your consent for consent-based processing. • Lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or your local supervisory authority. To exercise any of these rights write to support@costia.app. For erasure you can also use the account-deletion page linked at the end of this policy. For portability you can also download your expenses and income as a CSV file at any time, free of charge, from Profile → Export expenses.
10. Minors
The service is not directed to children under 14 years of age. If we become aware that an account belongs to a child under that age we will delete it.
11. Cookies and local storage
The web version of the service uses browser local storage (localStorage and IndexedDB) to keep your session and an offline cache of your data. We do not use tracking or advertising cookies.
12. Security
We apply reasonable technical safeguards to protect your data: encryption in transit (HTTPS), password storage with adaptive hashing functions, token-based access control and periodic credential rotation.
13. Changes to this policy
We may update this policy to reflect changes in the service or in applicable law. Any material change will be announced inside the app before it takes effect.
You can exercise your right to erasure directly from the web, without installing the app: