Privacy Policy
Last updated: 19 September 2026
This Privacy Policy explains what personal data Money Space collects when you use our mobile app and website, why we process it, who we share it with, and the rights you have. Money Space is a personal-finance app for tracking accounts, transactions, goals, assets and liabilities, together with an AI assistant, Richie. The controller of your personal data and contact details for privacy questions are set out in "Who we are".
Who we are
The controller of your personal data is Fedir Fedorovych Markov, an individual entrepreneur (fizychna osoba-pidpryiemets, "FOP") under Ukrainian law, tax registration number (RNOKPP) 3214010451, registered at 59 Universytetska St., Apt. 30, Zhytomyr, 10008, Ukraine ("Money Space", "we", "us"). For data protection questions, contact hello@money-space.app.
We are registered and operate as an individual entrepreneur solely in Ukraine. We have no office or establishment in the EU and do not target users in the EU, so we do not currently have a designated representative under Article 27 GDPR. Should we begin targeting users in the EU, we will appoint an EU representative and update this section. Until then, users in the EU who use the service on their own initiative are covered by the safeguards described in "International data transfers".
You have the right to lodge a complaint with a data protection supervisory authority. In Ukraine this is the Ukrainian Parliament Commissioner for Human Rights, who oversees compliance with the Law "On Personal Data Protection" No. 2297-VI. If a dedicated data protection authority is established, we will update this information. If you live in the EU, you may contact the data protection authority of your country of residence.
Data we collect
Account and profile data
- Email address and, where applicable, a hashed password.
- First and last name, date of birth, avatar, and your chosen assistant communication style.
- Third-party sign-in identifiers (Google, Apple, Firebase): provider UID, email, name, photo and phone number, where the provider supplies them.
- Your financial profile: monthly income and expenses, savings, net assets, risk profile, desired retirement age, country, language and default currency.
Financial data
- Accounts and wallets: name, type, institution, masked account/card number, currency, balances and balance snapshots.
- Transactions: amount, currency, date, description, counterparty, category, and any attachments you add (such as receipt photos).
- Financial goals, assets and their valuations, liabilities, insurance policies, budgets and categories.
- Households and the members you add for shared tracking.
Bank statement imports
You can upload bank statements in Excel/CSV format (currently the Monobank and Privat24 formats are supported). We store the uploaded file and the parsed statement rows (date, description, amounts, balances, counterparty, and account/category hints) in order to import your transactions. Money Space does not connect directly to your bank accounts — data enters the app only through manual entry or files you upload.
AI assistant
When you chat with the AI assistant, we store your conversation history (message text), run metadata, and a record of token usage. See "The AI assistant and your financial data" below for details of AI processing.
Technical data, consents and communications
- Consent records: consent key, timestamp, IP address, and device/browser information (user agent) at the time consent was given.
- Subscription and billing data: plan, subscription status, and payment-event identifiers from the payment provider.
- Email delivery logs (recipient address, message context) and in-app notifications.
- Device tokens for push notifications (Firebase Cloud Messaging), so we can send you in-app notifications.
- Technical logs and error diagnostics needed to operate and keep the service stable.
How we use your data
- Providing core functionality: finance tracking, analytics, goals, transaction imports and shared household tracking.
- Authentication, account protection and preventing abuse.
- Running the AI assistant and generating personalized responses based on your financial data.
- Sending service notifications and emails (for example, password resets and import status).
- Processing subscriptions and payments.
- Improving the product, diagnosing errors and maintaining security.
- Complying with legal obligations.
Legal bases for processing
We process your data on the following legal bases:
- Performance of a contract — providing the core functionality of the service under our Terms of Service, including finance tracking and automatic categorization of imported transactions.
- Your prior consent — in particular for marketing cookies, marketing emails and website analytics.
- Our legitimate interests — security, fraud prevention, product improvement, and the AI assistant's background features (see "The AI assistant and your financial data" for your right to object).
- Compliance with our legal obligations.
You can withdraw any consent you have given at any time; this does not affect the lawfulness of processing carried out before withdrawal.
The AI assistant and your financial data
The Money Space AI assistant (Richie) is powered by large language models from OpenAI, which acts as our data processor under its standard Data Processing Addendum.
We use AI in three scenarios:
- Chatting with Richie — when you choose to use the assistant yourself; legal basis: performance of a contract.
- Importing bank statements — automatically categorizing transactions and detecting transfers between your own accounts, as part of the core import functionality; legal basis: performance of a contract.
- Background features that run without any action on your part — weekly financial tips, spending and net-worth forecasts, and summaries of your progress toward your goals, available to users with an active paid subscription; legal basis: our legitimate interest in providing a personalized product.
To carry out these tasks, we may send OpenAI: the text of your messages and conversation history (for chat); relevant financial context from your account (account balances, transactions, spending by category, cash flow, net worth, goals and a household overview); and elements of your profile, including your email address, language, country, currency and risk profile.
Weekly tips and forecasts involve profiling — automated evaluation of your financial behavior. We do not make decisions to grant or refuse services based solely on automated processing: this profiling does not produce legal effects concerning you or affect you in a similarly significant way. You have the right to object to processing based on our legitimate interests, including profiling, by writing to hello@money-space.app; we will stop processing your data in this way unless we have compelling legitimate grounds to continue.
By default, OpenAI does not use data sent through our API account to train its models. For real-time requests (such as chat), OpenAI retains inputs and outputs for up to 30 days for abuse-monitoring purposes. For background features (weekly tips, forecasts, goal summaries) we use OpenAI's Batch API, and we delete the uploaded files from OpenAI's servers within 7 days of processing.
The AI assistant provides general informational content and is not professional financial, investment, tax or legal advice.
Who we share data with
We do not sell your personal data. We use the service providers listed below, who process data on our behalf as our processors:
- Google Firebase Authentication (Google LLC) — authentication and sign-in via Google/Apple/email.
- Apple Inc. (Sign in with Apple) — authentication and sign-in via your Apple account, if you choose this method.
- Google Cloud Platform (Google LLC) — infrastructure hosting and storage of uploaded files (statements); data is hosted in an EU region (Warsaw, Poland).
- OpenAI, L.L.C. — processing AI-assistant requests (see the section above); OpenAI's current sub-processor list is available at https://platform.openai.com/subprocessors.
- Firebase Analytics and Performance (Google LLC) — aggregate app-usage analytics and app performance metrics.
- Firebase Cloud Messaging (Google LLC) — delivering push notifications to your device.
- Firebase Crashlytics (Google LLC) — mobile app crash diagnostics.
- Resend (Resend, Inc.) — sending transactional emails.
- Sentry (Functional Software, Inc.) — backend error diagnostics; enabled as needed; error reports may include technical context (such as request data).
- Apple App Store and Google Play — processing subscription payments under the relevant app store's terms; we do not receive or store your payment card details.
- ExchangeRate-API — retrieving currency exchange rates (no personal data is shared).
We may also disclose data where required by law, where necessary to protect our rights, or in connection with a business reorganization or sale — in each case subject to this Policy.
International data transfers
Our infrastructure is hosted in a European Union region. However, some processors — notably OpenAI, Google (its Firebase services), Apple, Sentry and Resend — may process data outside your country, including in the United States. For transfers from the EEA to the United States, we and our processors rely on standard contractual clauses approved by the European Commission (Decision 2021/914) or on arrangements providing equivalent safeguards. Transfers from Ukraine to the United States are based on your consent or are necessary to perform our contract with you (Article 29 of Ukrainian Law No. 2297-VI).
Data retention
We retain your personal data for as long as your account is active. After you delete your account, we keep your data in archived form for a further 30 days, so you can recover your account in case of accidental deletion and so we can complete any pending operations. After this period, we permanently delete or anonymize your data, except where the law requires us to keep it longer. We keep consent records as proof they were given, for the statutory limitation period after you withdraw consent, and we keep data needed for tax and accounting purposes (including billing data) for the period required by Ukrainian law. We delete files uploaded for the AI assistant's background features from OpenAI's servers within 7 days (see "The AI assistant and your financial data"). Your conversations with the AI assistant, and any tips or forecasts generated from them, are deleted when you delete the relevant conversation or your account.
Your rights
Depending on your jurisdiction, you may have the following rights:
- Access your personal data and obtain a copy.
- Correct inaccurate or incomplete data.
- Delete your data and account.
- Restrict or object to certain processing.
- Port your data in a structured format.
- Withdraw consent you previously gave.
To exercise any of these rights — including requesting account deletion or a data export — email us at hello@money-space.app. We handle requests free of charge (unless they are manifestly unfounded or excessive) and respond within one month under GDPR, or within 30 calendar days under Ukrainian Law No. 2297-VI. Where necessary, we may extend this period by up to two further months; if we do, we will tell you and explain why. We may ask you to verify your identity before acting on a request. You also have the right to lodge a complaint with a data protection supervisory authority (see "Who we are").
Data security
We apply technical and organizational measures to protect your data:
- Data transmitted between the app and our servers is protected with encryption (HTTPS/TLS).
- Passwords are stored only as a cryptographic hash (PBKDF2) and are never stored in plaintext.
- On your device, access tokens are stored in the operating system’s secure storage (Keychain on iOS, Keystore on Android).
- Data is hosted on Google Cloud infrastructure in an EU region; the provider encrypts data at rest.
- Access to data is restricted to authorized personnel on a least-privilege basis.
Despite these measures, no method of transmission or storage is completely secure. We cannot guarantee absolute security, but we work to continuously improve our practices. If you discover a vulnerability, please report it to hello@money-space.app.
Children's privacy
Money Space may be used by people aged 16 and over, as set out in our Terms of Service. During sign-up we ask for your date of birth to confirm you meet this age requirement. We do not knowingly collect personal data from anyone under the age of 16. If you believe someone under 16 has provided us with their data, contact us at hello@money-space.app so we can delete it.
Direct marketing
If you gave us your email address to join our waitlist or subscribe to our newsletter, we send product and marketing emails on the basis of your consent (Article 6(1)(a) GDPR, Article 8 of Ukrainian Law No. 2297-VI) or, if you are already a customer, under the soft opt-in exception for messages about similar features of our service. Every such email includes an unsubscribe link; you can unsubscribe at any time without affecting the core service.
Changes to this Policy
We may update this Policy from time to time. We will notify you of material changes — including any that affect processing based on your consent — through the app or by email, and will ask for your consent again where needed. The current update date is always shown at the top of this document; earlier versions are available on request at hello@money-space.app.
Contact
For questions about this Privacy Policy or how we handle your personal data, contact hello@money-space.app.
If you have any questions about this document or how we handle your data, email us at hello@money-space.app.