Yes — I have your expenses

Let’s start where the doubt actually is. If you log your spending in Gastón, those records sit in a database I can open. That is the honest answer, and any app that tells you otherwise while still showing you a monthly report is not being straight with you.

Gastón is not end-to-end encrypted, and that is a deliberate trade. Encrypting your expenses so that nobody but you could ever read them would also mean nothing could add them up, sort them into categories, warn you about a budget, or write you a summary at the end of the month. The whole product is arithmetic on your data, and arithmetic has to see the numbers.

So here is what I promise instead

Since I can’t tell you it is technically impossible for me to look, I’ll tell you exactly when I do.

• I open the database against an individual account in two situations: when you have asked me for help with something specific, and when I am chasing a bug that is affecting you.
• Keeping Gastón running sometimes means touching everybody’s records at once — a database migration, or filling in something that was missing for every account created before a certain date. That is work on the shape of the data rather than a look at yours, but it is real access and you should know it happens.
• Never to browse. Not out of curiosity, not to see what you spend on, not to compare you to anybody.
• I don’t sell your data and I don’t show you ads. There are no advertisers in the picture at all.
• I don’t hand it to anyone else, except where the law leaves me no choice.

That is a commitment from a person, not a mathematical guarantee, and you should weigh it as exactly that.

What never reaches me at all

• Your bank statements. When you import one, the file is read and thrown away. What is kept is the filename, a fingerprint so you can’t import the same statement twice, and the transactions that came out of it. The document itself is not stored anywhere.
• Your password. Stored as a one-way hash. I can’t read it — which is also why I can’t recover it for you, only help you reset it.
• What you spend, in the usage analytics. They record that you logged an expense, never what it was. No amounts, no merchant names, no category names, no notes. You can switch them off, and they are deleted after 180 days either way.

Who else can see it

Being specific about this, because “trusted partners” means nothing:

• No other person using Gastón. Every query is scoped to your account. There is no shared view, no leaderboard, no social anything.
• The companies that host the app and the database. Ordinary infrastructure providers, under their own privacy terms.
• Anthropic’s Claude models, for the Monthly Review and the assistant, through the Vercel AI Gateway. Only the records needed to answer the thing in front of it, and read-only: it can look at your spending and talk about it, it cannot create, edit or delete anything.

What you can do about it, right now

None of the above counts for much if you can’t act on it, so:

• Take it with you. Settings → Data → Export hands you the whole thing as a file.
• Destroy it. Delete Account, on the web or in the app on your phone. It is a real delete — expenses, categories, budgets, conversations, your photo, all of it in one shot, not a hidden “deactivated” flag. The encrypted backups keep a copy until they age out.
• Turn the analytics off. Settings → Privacy on the web, You → Preferences on your phone.

And if that is still not enough

Then that is a completely reasonable place to land, and I would much rather you say so than use Gastón while feeling uneasy about it. Try it for a month and delete the account afterwards. Or don’t try it. Neither of those hurts my feelings.

If you want the formal version, with the defined terms and the retention periods, it is in the privacy policy. If you want to ask something it doesn’t answer, write to maxivarela@gmail.com.