Language: English

Saldo Pocket

Privacy policy

This policy explains what Saldo Pocket stores, what it sends and to whom, how long it is kept, and what you can do about it. The short version: your budget stays on your phone.

Last updated: November 5, 2026

Who is responsible

Olstad Digital (org. no. 938 090 432, Selma Ellefsens vei 3H, 0581 Oslo, Norway) is the controller for the processing described here. Contact us at kontakt@nordicdigitalapp.no.

In short

Stored on your phone

The app keeps the following in its own storage on your phone. It is not sent to us, and it is deleted when you delete all data in the app or uninstall it:

KID numbers are never stored, and neither is the full account number. The app may store the last four digits of the account number to recognise the account.

Backup on your phone

If backup is turned on, the phone includes the app's data in it: on Android in the backup on your Google account, on iPhone in iCloud. Your budget then comes back on a new phone. Apple and Google store the backup under their own terms, and you turn it on and off in the phone's settings.

Your sign-in and the secure storage are never included, so on a new phone you sign in again.

Importing CSV and Excel files

When you import a CSV or Excel file from your bank, the file is read only on your phone. The file itself is never stored, copied or sent anywhere – neither to a server nor to AI.

From the file, only the date (and booking date when the file has it), description, amount, vendor, the bank's balance to reconcile the account, and the last four digits of the account number, to recognise the account, are stored. KID numbers, other references and the file's other columns are not stored.

Entries that are not yet booked are stored as ordinary entries and count straight away. If such an entry is missing from a later import from your bank, the app asks whether you want to remove it. It is never removed by itself.

The app remembers how the file's columns are laid out, without their content, so the next import is quicker. When you are signed in with Pro, this is synced with your other settings.

AI reading is used only for pictures and PDFs, and only when you have said yes.

AI reading of account lists, receipts and invoices (optional)

When you import a screenshot or photo of an account list, or scan a receipt or invoice, you can let AI read it. The app asks for permission first, and you can turn it off at any time on the import screen. Without permission, everything is read on your phone and nothing is sent.

With permission, the picture, today's date, the currency, your country, the app's categories (as codes) and the account's column headings (only the headings, not their content) are sent through our server at Supabase (Ireland) to Anthropic (USA), which reads the entries with its AI model (Claude) and sends them back. The request goes through the Supabase server closest to you; neither we nor Supabase store the picture or the entries. Anthropic does not use data sent through its API to train its models, and deletes it within 30 days (privacy.claude.com).

To keep the service within its limits, our server counts AI readings per device and day. The phone sends only a one-way code made from the random device ID, and the server makes a new code from it with a secret key before it is stored, so the count cannot be linked to you or your account. Only the code, the date and the number are stored, and the count is deleted automatically after 30 days.

Only in the free version: for the limit on AI scans, the phone sends a one-way code made from the phone's ID, never the ID itself. The server makes a new code from it with a secret key and stores only that, the month, whether it is a test version, and the number. The hashed device ID is used only to count free AI scans, not for tracking, and the count is deleted automatically after 13 months. With Pro, no phone ID is sent.

Scanning receipts and invoices

When you scan a receipt or invoice, the picture is read on your phone, or by AI if you have said yes (see above). The picture is deleted as soon as it has been read, even if you cancel or something goes wrong. From the picture, only the store, date, amount and category are stored. KID and account numbers are never stored.

Crash reports

When the app crashes or an error occurs, a report is sent to Sentry (EU, Germany): what went wrong and where in the app, what happened just before (without content from your budget), the app version, and the phone model and system version. Sentry does not store the IP address, and the reports contain no name, e-mail or account. They are kept for at most 90 days and are used only to fix errors.

App updates

Each time it starts, the app asks Expo (USA), the service that delivers updates, whether there is a new one. Expo then receives the IP address, the platform (iOS or Android), the app's version and a random ID for the installation – nothing about you or your budget.

Buying Pro

Pro is bought in the App Store or Google Play. Apple or Google handle the payment under their own privacy policies; we never see your card details.

RevenueCat (USA) keeps track of whether you have Pro. The app contacts RevenueCat each time it starts, also in the free version, with an anonymous customer ID that RevenueCat creates, or your account ID when you are signed in, so Pro follows your account. RevenueCat receives the purchases and receipts from the store, the platform and the app's version. In test versions and for test purchases, the customer is marked as a test. The purchase history stays with the store and RevenueCat even if you delete your account, so your purchase is not lost.

Notice that your Pro subscription is running

If you have a Pro subscription that renews every month or every year, the app shows a notice at least every six months saying that the subscription is running, what it costs and how to cancel it. If you are signed in, you also get it by e-mail. Norwegian law requires the notice (digitalytelsesloven, section 33), and we log each notice so we can document that it was given. The log contains:

The log never contains your name, your e-mail address or your account ID. To send the e-mail, we store the account ID and the date of the next notice separately; they are deleted when you delete your account.

If you are signed in and have allowed notifications for the app on your phone, the notice can also come as a push notification. We then store the phone's push token – the address Apple or Google uses to deliver notifications to this particular phone – together with your account ID, only to send this notice. The notice is sent through Expo (USA), which passes it on to Apple Push Notification service (iPhone) or Google Firebase Cloud Messaging (Android). It contains only the text about the subscription, nothing from your budget. The token is deleted when you sign out, delete your account or turn off notifications (the app then removes it), and when Apple or Google says it is no longer valid. You can turn off notifications for the app in your phone's settings.

The basis for sending the notice and storing the push token is a legal obligation (Article 6(1)(c)): the law requires us to notify you of a subscription that is running (digitalytelsesloven, section 33, in Norway, and similar rules in other countries). Whether the app may send push notifications is your choice, in your phone's settings. Without push, you get the notice in the app, and by e-mail if you are signed in.

The log is kept for 3 years after the subscription’s last active day, also if you delete your account, but then without anything that links it to you. The basis is our legitimate interest (Article 6(1)(f)) in being able to document that we have given the information the law requires.

Optional account and sync (Pro)

You can sign in with Apple, Google, Facebook (Meta) or e-mail. Sign-in is handled by Supabase on servers in Ireland. We then store your e-mail address, an account ID, your name if the provider shares it, your app language and, in test versions, a test flag. With Apple you can hide your e-mail address; we then see only Apple's relay address.

With Pro, your budget is synced to your account: accounts, entries, recurring items, budget, savings goals, your own categories, vendors the app remembers and the settings that follow you (payday, salary, budget). Each change is stored with when it was made and on which device. The data is encrypted in transit and at rest, and only your account can read it.

Sign-in codes and links are sent by e-mail through Resend (USA), with your address and language. The link opens our website, hosted by Vercel, which passes you on to the app. To send each e-mail only once, our server keeps only the message ID, type and status for 7 days, never the address.

You can sign out at any time; your data stays on the phone. «Delete account» removes the account and all data stored with it on our server. What stays: the purchase history with the store and RevenueCat, the counts with no name or account (deleted after 30 days and 13 months) and the services' own logs under their terms.

Widget and reminders

The widget shows figures from the data on your phone, and reminders about recurring items are set up on your phone. Nothing is sent for either.

Who we share data with

Where data goes to the USA, the providers use the EU standard contractual clauses or the EU–US Data Privacy Framework. We never sell data, and the app has no ads and no tracking.

Legal basis

How long data is kept

Your rights

You can see, correct and export all your data in the app (Me → Export data, free for everyone), and delete it (Me → Delete all data on this phone). You can object to the processing and withdraw your consent to AI reading at any time.

If you have questions, write to kontakt@nordicdigitalapp.no. The supervisory authority is the Norwegian Data Protection Authority (Datatilsynet), and you can complain to it. If you live in the EU/EEA, you can also complain to the data protection authority in your own country.

Children

Saldo Pocket is not made for children under 13, and we do not knowingly process their data.

Changes

If we change this policy, we update this page and the date at the top. If the change matters for how your data is used, we let you know in the app.