Privacy Policy
Last updated: 5 August 2026
Tremr Finances is operated by João Paulo Ramos (Brazil), the data controller. This policy explains what personal data we collect, why, and the rights you have under Brazil's LGPD (Law 13.709/2018) and, where applicable, the EU GDPR.
What we collect
Account data — your email, name and a hashed password (or a Google sign-in identifier). Financial records you choose to store — accounts, transactions, categories, tags, budgets, goals, recurring rules and investments. Technical data needed to run the service, such as your IP address in request logs. Messages you send us — if you use the contact form or subscribe to the newsletter on our public site, we store the name, email address and message you submit, along with the IP address the request came from (which we keep to curb spam and abuse). Usage data — only if you accept analytics cookies; see below.
Why we use it, and our legal basis
To operate the service — authenticate you, render dashboards, compute reports and run scheduled jobs (legal basis: performance of our contract, LGPD Art. 7, V / GDPR Art. 6(1)(b)); to answer messages you send us and protect the site from abuse (legitimate interests, LGPD Art. 7, IX / GDPR Art. 6(1)(f)); to measure how the public site is used, strictly on the basis of your consent (LGPD Art. 7, I / GDPR Art. 6(1)(a)), which you may withdraw at any time; and to meet legal and security obligations. We do not sell your data and we do not show ads.
Cookies & analytics
We use strictly necessary first-party cookies for authentication and preferences (theme, language, selected household) — these are always on. On our public marketing pages only, we also use Google Analytics 4 to understand which pages people find useful. It loads with all storage denied by default: until you accept, it sets no cookies and can't recognise you. It is never loaded inside the signed-in app, so your financial pages are never measured. We do not enable Google's advertising features. Details of every cookie are in our Cookie Policy, and you can change or withdraw your choice anytime via your .
Who we share it with
Only the minimum necessary, with processors acting on our behalf: Resend (transactional email — verification, magic links, notifications), Google (sign-in, if you use it, and Google Analytics if you consent), Vultr (the server our application runs on) and Cloudflare (encrypted off-site backup storage). We also read public exchange rates from Frankfurter, which involves no personal data. We never sell or rent your data, and no one receives it for their own purposes.
International transfers
Some of those providers process data outside Brazil and the European Union, including in the United States. Where that happens we rely on the safeguards those providers offer — contractual clauses approved for international transfers and, where applicable, adequacy decisions (LGPD Art. 33 / GDPR Chapter V). Your account and financial data themselves live in our own database on a single server; only the backups leave it, encrypted.
Where we store it & security
Application data lives in a self-hosted PostgreSQL database. Connections are encrypted in transit (TLS), passwords are hashed with bcrypt, two-factor secrets are encrypted at rest, and session refresh tokens are stored as httpOnly cookies. Encrypted backups are kept off-site.
How long we keep it
We keep your account and financial data until you delete your account. Backups are retained for up to 30 days. Analytics data is retained by Google for up to 14 months. Messages sent through the contact form are kept while we deal with them and for a reasonable period afterwards. When you delete your account we permanently erase your personal and financial data and keep only anonymized aggregate metrics, which the LGPD permits (Art. 12).
Your rights
You can access, correct, export and delete your data, object to or restrict processing, and withdraw consent at any time. You can export everything via Settings → Profile → Download my data and delete your account permanently from Settings → Profile — no request needed. For anything else, write to privacy@tremr.live. If you believe we've mishandled your data you may complain to Brazil's ANPD or, in the EU, to your local supervisory authority.
Changes to this policy
We may update this policy as the product changes. The date at the top always reflects the current version, and we will announce material changes in the app or by email before they take effect.
Contact
João Paulo Ramos — privacy@tremr.live. See also our Terms of Service.