Privacy Policy

For the application orvi. Last updated 3 October 2026.

The short version

Your financial data is collected onto your own device and stays there. There is no account to create and no server that holds your records. If you choose to share a household's records with family members, only data encrypted on your device — with keys that never leave your devices — is synchronised, so whoever stores it, including us, cannot read it. Turn that off and nothing ever leaves your device at all.

What this application is

orvi collects your own purchase and transaction history — from your email, your payment accounts and your retailer accounts — into a structured form you control. It runs on your device and keeps your records there.

It is local-first rather than a hosted service. That is a design decision with a privacy consequence: because there is no central database of users' financial records, there is none to breach, subpoena or sell.

What data it accesses, and only with your permission

Each source below is optional and separately authorised. Authorising none of them is a valid way to use the application: records can be entered by hand or imported from files you already have.

Email

With your permission it reads your Gmail using the https://www.googleapis.com/auth/gmail.readonly scope. That scope is read-only: the application cannot send, modify, delete or label any message.

It does not read your whole mailbox. Messages are selected by a search query executed by Google's own servers, so only mail matching known transaction senders is ever transferred to your device. From each matching message it extracts the date, the amount, the counterparty where one is stated, and a reference; receipts attached as PDFs are parsed for their line items.

Where you choose to, you can register your own Google OAuth client and supply it to the application, so that the authorisation is between you and Google with nobody in between — the same arrangement as for payment accounts below. Otherwise the application's own registered client is used, in which case Google identifies the application to you by name on its consent screen before you grant anything. Either way the mail is fetched by your device directly from Google and is never routed through us.

Payment accounts

If you want your payment accounts read, you register your own application with Enable Banking — a licensed Account Information Service Provider regulated by the Finnish Financial Supervisory Authority — and supply its key to the application on your device. That arrangement is deliberate and has three consequences worth stating plainly:

• Your bank relationship is yours. The consent is between you, your bank and Enable Banking. We are not a party to it and cannot act on it.
• We never hold your key or your bank data. There is no account of yours on our side to compromise, because there is no account of yours on our side.
• We cannot be compelled to produce what we do not have. A request to us for your transactions has no answer.

Access is account information only: the application requests no payment initiation capability and cannot move money. Only accounts you explicitly link are reachable, and only after you authenticate directly with your own bank — your banking credentials are entered at your bank, never in this application. From each transaction it reads the date, the amount, the counterparty name, a reference and the payment description. Consent lasts at most 180 days and can be withdrawn at your bank or at Enable Banking at any time, independently of this application.

Bank statements you provide

You can import statement files you have downloaded from your own bank. These are read from your device and are not uploaded anywhere.

Retailer receipts

With your permission it reads your digital receipts from retailer accounts you hold — such as REWE, Lidl Plus and Kaufland Card — using each retailer's own interface with credentials you obtain by logging in yourself. These return your purchases and their line items.

Where that data goes

• Onto your device, as encrypted local storage.
• Nowhere else by default. There is no analytics, no telemetry, no crash reporting and no profiling. We do not receive your records and have no way to request them.
• The only outbound connections are the requests your device makes directly to Google, to Enable Banking and to your retailers in order to read your data in the first place — and, if you enable family sharing, to whichever storage you choose for it.

Family sharing, and what leaves your device if you use it

A household's finances are often shared, so the application can share one set of records between family members you invite. This is off unless you turn it on.

When it is on, changes to your records are written to an encrypted log — a stream of changes rather than a copy of a database — which your family members' devices read in order to stay in step. Two things about that log matter:

• It is encrypted on your device, before it is sent, with keys generated on and held by your devices and shared only with the family members you invite.
• Whoever stores it receives only ciphertext. That includes us. We cannot read your records — not as a promise about our conduct, but because we do not hold the keys and cannot obtain them.

You choose where that log is stored:

• On infrastructure we operate (Cloudflare, acting as our processor), which is the simpler option and requires nothing from you.
• On your own cloud storage, in which case the encrypted log never touches infrastructure we operate at all, and we are not part of the path.

If you do not use family sharing, no log is ever transmitted and this entire section does not apply to you.

Google user data: limited use

orvi's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained from your Gmail account through gmail.readonly — together with anything derived or aggregated from it:

• is used only to provide the user-facing feature that is the whole purpose of the application: collecting your own transaction records into a structured history you can read, which is the prominent feature of its interface;
• is not transferred to anyone, except where you yourself instruct it — by sharing a household's records with family members you invite, and then only as ciphertext we cannot read;
• is not read by any human other than you. We cannot read it: it is held on your device and, where shared, encrypted with keys we do not have;
• is never transferred or sold to third parties, data brokers or information resellers;
• is never used for advertising of any kind, including retargeting, personalised or interest-based advertising;
• is never used to determine credit-worthiness or for lending purposes;
• is not used to develop, improve, or train generalised or non-personalised artificial intelligence or machine-learning models. To state it in the terms Google's policy uses: Google Workspace APIs are not used to develop, improve, or train non-personalised AI and/or ML models.
• is not used to create databases or to build any product other than the records shown to you in this application.

These are not undertakings that rest on our conduct alone. The data is processed on your device and stored there, so there is no copy for us to transfer, read or sell.

How your data is protected

Security procedures are in place to protect the confidentiality of your data:

• Encryption at rest. Your records are stored encrypted on your device, with keys held in your operating system's credential store or in files readable only by your user account.
• Encryption in transit. Every connection to Google, to your bank's provider and to retailers is made over TLS. The application makes no unencrypted request.
• Encryption before sharing. If you share a household's records with family members, the shared log is encrypted on your device before it is transmitted, with keys that never leave your devices.
• Least privilege. Every permission requested is read-only. The application cannot send email, modify or delete messages, or initiate a payment — not by policy but because it never requests the capability.
• Minimisation. Full account numbers, postal addresses and message bodies are discarded rather than stored. What cannot be stolen from us is what we never held.

The strongest protection is structural rather than procedural: your financial records are held on your device and not on a server we operate, so there is no central store of users' data to be breached.

What is deliberately not stored

• Full bank account numbers. Where a source states an IBAN, only the last four digits are kept.
• Postal addresses, even when a receipt contains one.
• Message bodies. Only the extracted fields are retained, not the mail itself.

Credentials

Credentials are held on your device in your operating system's credential store or in files readable only by your user account, and are transmitted only to the service that issued them. They are never sent to us. Where the application encrypts your records, the encryption keys are likewise generated and kept on your device.

Retention, export and removal

Your records are kept on your device for as long as you want them, and you can delete them by deleting them in the application or removing its local storage. Because the data is yours and local, export is a file operation rather than a request to us.

Access to each source can be withdrawn at any time, independently of this application:

• Google, from Google Account permissions, which immediately invalidates the token the application holds.
• Payment accounts, by revoking the consent at your bank or at Enable Banking.
• Retailers, from the account settings of each.

If you used family sharing on infrastructure we operate, deleting the shared log removes the only thing we ever held — and since it was encrypted with keys we never had, deletion removes ciphertext we could not read.

Sharing and sale of data

Your data is never sold, rented, licensed, or disclosed for advertising, profiling, analytics, model training or any other purpose. It is shared only where you instruct it: with the family members you invite. No third party receives it otherwise, and there is no readable copy of it for anyone to receive.

Your rights

Under the GDPR you have rights of access, rectification, erasure, restriction, portability and objection. For data on your device, those rights are exercised directly: you hold it, you can read, correct, export and delete it without asking anyone. For an encrypted shared log stored on infrastructure we operate, we can delete it on request, which is the extent of what we can do with something we cannot decrypt. You may also complain to your national data protection authority.

Children

The application is not directed at children and is not intended for use by anyone under 16.

Changes to this policy

If this policy changes in a way that affects what leaves your device, the change will be stated in the application before it takes effect, not only on this page.

Contact

Questions about this policy, or a request concerning data we hold, can be sent to the contact address shown on the application's consent screens and in the application itself.