Yes, I have your expenses

Let’s start where the doubt actually is. If you log your spending in Gastón, those records sit in a database I can open. That is the honest answer, and any app that tells you otherwise while still showing you a monthly report is not being straight with you.

Gastón is not end-to-end encrypted, and that is a deliberate trade. Encrypting your expenses so that nobody but you could ever read them would also mean nothing could add them up, sort them into categories, warn you about a budget, or write you a summary at the end of the month. The whole product is arithmetic on your data, and arithmetic has to see the numbers.

So here is what I promise instead

Since I can’t tell you it is technically impossible for me to look, I’ll tell you exactly when I do.

• I open the database against an individual account in two situations: when you have asked me for help with something specific, and when I am chasing a bug that is affecting you.
• Keeping Gastón running sometimes means touching everybody’s records at once (a database migration, or filling in something that was missing for every account created before a certain date). That is work on the shape of the data rather than a look at yours, but it is real access and you should know it happens.
• Never to browse. Not out of curiosity, not to see what you spend on, not to compare you to anybody.
• I don’t sell your data and I don’t show you ads. The one place advertising comes in is my own: I advertise the Android app on Google, and so that Google can tell which ads bring people who actually sign up, the Android app tells it that an account was created and which features get used, along with the phone’s advertising ID. Never an amount, a merchant, a category or a note, and switching off usage analytics switches this off too.
• Apart from that, I don’t hand it to anyone else, except where the law leaves me no choice.

That is a commitment from a person, not a mathematical guarantee, and you should weigh it as exactly that.

What never reaches me at all

• Your bank statements. When you import one, the file is read and thrown away. What is kept is the filename, a fingerprint so you can’t import the same statement twice, and the transactions that came out of it. The document itself is not stored anywhere.
• Your password. Stored as a one-way hash. I can’t read it, which is also why I can’t recover it for you, only help you reset it.
• What you spend, in the usage analytics. They record that you logged an expense, never what it was. No amounts, no merchant names, no category names, no notes. You can switch them off, and they are deleted after 180 days either way.

Who else can see it

Being specific about this, because “trusted partners” means nothing:

• No other person using Gastón, unless you share a book with them. Your own book is scoped to your account. If you create or join a shared book, its members see what is in that book, including what you add there, and your name and profile photo, never your email. Nothing from your own book. There is no leaderboard, no social anything.
• The companies that host the app and the database. Ordinary infrastructure providers, under their own privacy terms.
• Anthropic’s Claude models, for the Monthly Review and the assistant, through the Vercel AI Gateway. Only the records needed to answer the thing in front of it. It can look at your spending and talk about it, and the assistant can draft an expense for you to accept, but it saves, edits and deletes nothing itself.
• Meta, and an OpenAI transcription model, if you send me expenses on WhatsApp. Your messages, and my replies, travel through WhatsApp. A voice note is turned into text by OpenAI’s model, through the same Vercel AI Gateway, and Claude reads that text, or your message, or your receipt photo, to find the expense. I keep the text, encrypted, plus the amount, merchant and date read from it, not encrypted, and never the recording or the photo, and nothing becomes an expense until you confirm it, in the app or with a tap on my WhatsApp reply.

What you can do about it, right now

None of the above counts for much if you can’t act on it, so:

• Take it with you. Settings → Data → Export hands you the whole thing as a file.
• Destroy it. Delete Account, on the web or in the app on your phone. It is a real delete (expenses, categories, budgets, conversations, your photo, all of it in one shot), not a hidden “deactivated” flag. What you added to a shared book stays there for its other members, without your name, email or photo. The encrypted backups keep a copy until they age out.
• Turn the analytics off. Settings → Privacy on the web, You → Preferences on your phone.

And if that is still not enough

Then that is a completely reasonable place to land, and I would much rather you say so than use Gastón while feeling uneasy about it. Try it for a month and delete the account afterwards. Or don’t try it. Neither of those hurts my feelings.

If you want the formal version, with the defined terms and the retention periods, it is in the privacy policy. If you want to ask something it doesn’t answer, write to maxivarela@gmail.com.