Privacy Policy

cofr is operated by Felix Hernandez Vieyra, an individual ("Operator," "we," "us," "our"), reachable at me@felix-hzv.dev.

For the purposes of data protection law, the Operator is the data controller for personal data processed in connection with the hosted Service at cofr.cash.

This Privacy Policy applies to the hosted Service at cofr.cash and any associated transactional communications (e.g. verification emails).

It does not apply to self-hosted instances of cofr. If you deploy cofr on your own infrastructure, you are the data controller for that deployment and are independently responsible for applicable privacy obligations.

We collect only the data necessary to operate the Service:

We do not collect payment information (there is no paid tier requiring card details), location data, biometric data, or browsing history outside the Service.

We use the data we collect for the following purposes only:

• Authentication: verifying your identity on login and maintaining your session
• Operating the Service: storing and serving your financial data, calculating balances and summaries, applying exchange rates
• Transactional email: sending account verification emails and password reset links via Resend. No marketing emails unless you explicitly opt in (no opt-in mechanism currently exists)
• Error tracking: detecting and diagnosing bugs via Sentry in production environments only
• Security: rate-limiting authentication endpoints using your IP address to prevent brute-force attacks

We do not use your data for advertising, profiling, training machine learning models, or any purpose not listed above.

We take security seriously and apply the following controls:

• Encryption at rest: Personal identifiers (name, email, display name) are encrypted field-by-field using Fernet (AES-128-CBC with HMAC-SHA256) before being written to the database. The encryption key is never stored alongside the data.
• Encryption in transit: All connections to cofr.cash use TLS. Unencrypted HTTP is not accepted.
• Password storage: Passwords are hashed with bcrypt and never stored in recoverable form.
• No tracking infrastructure: No advertising pixels, no third-party analytics, no data broker integrations.

While we implement industry-standard safeguards, no system is completely immune to breaches. In the event of a breach affecting your personal data, we will notify affected users as required by applicable law.

We do not sell, rent, or trade your personal data. We share data only with the following sub-processors required to operate the Service:

We may disclose personal data if required by law, court order, or governmental authority. We will make reasonable efforts to notify you before doing so, unless legally prohibited.

If you deploy cofr on your own server, the Operator has no access to, knowledge of, or control over any data processed on that instance. You are the sole data controller and are independently responsible for compliance with privacy and data protection laws applicable in your jurisdiction.

This Privacy Policy does not cover self-hosted deployments in any way.

We retain your data as follows:

• Active accounts: retained for as long as your account exists
• Soft delete: your account becomes immediately inaccessible. Data is retained and restored if you log in again within a reasonable period
• Hard delete: permanently and irreversibly removes your profile, all transactions, all financial accounts, and all auth connections. No recovery is possible after this action. Available in Settings → Danger Zone
• Export jobs: export artifacts are held in-memory only and automatically deleted after 30 minutes
• Email suppression list: SHA-256 hashed email addresses from bounces and complaints are retained to prevent re-sending to invalid or opted-out addresses. These hashes cannot be reversed to identify you

You have the following rights with respect to your personal data:

• Access: view all your financial data and account information in the dashboard at any time
• Export (portability): download your data as CSV, XLSX, PDF, or a full ZIP archive from Settings → Export. Formats are open standards. Your data is not locked to cofr.
• Correction: edit your profile, transactions, and preferences at any time
• Deletion: permanently delete your account and all associated data from Settings → Danger Zone

To exercise any right that cannot be completed within the application, contact us at me@felix-hzv.dev. We will respond within 30 days.

If you are located in the European Economic Area (EEA) or United Kingdom, the following additional rights and information apply.

Legal basis for processing: We process your personal data on the basis of contractual necessity (Article 6(1)(b) GDPR): your data is processed to provide the Service you signed up for. Rate-limiting and security operations are processed on the basis of our legitimate interests (Article 6(1)(f) GDPR) in protecting the Service and its users.

Your additional rights under GDPR include:

• Right to restrict processing
• Right to object to processing based on legitimate interests
• Right to lodge a complaint with your local supervisory authority (e.g. your national Data Protection Authority)

International transfer notice: the hosted Service stores data on DigitalOcean infrastructure in Sydney, Australia. Australia is not recognised as adequate by the European Commission under Article 45 GDPR. By creating an account and explicitly accepting this Privacy Policy at registration, you provide specific, informed consent to this international transfer under Article 49(1)(a) GDPR. If you do not consent, you should not use the hosted Service. You may instead self-host cofr on infrastructure in your preferred jurisdiction.

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA, effective January 1, 2023):

• Right to know: you may request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to correct: you may request correction of inaccurate personal information we hold about you (most data can be corrected directly within the app)
• Right to delete: you may request deletion of your personal information (available directly via hard-delete in Settings)
• Right to limit use of sensitive personal information: under CPRA, financial transaction history and account balances qualify as sensitive personal information. We use this data solely to operate the Service for you and do not use it for any secondary purpose. You may contact us to exercise this right.
• Right to opt out of sale: we do not sell your personal information. This right is not applicable.

We do not discriminate against users who exercise their CCPA/CPRA rights.

We do not use tracking cookies or advertising cookies. We store the following data in your browser's local storage:

None of these items are shared with third parties or used for tracking across other websites.

cofr is not directed at children. If you believe that a child has created an account on the Service, please contact us immediately at me@felix-hzv.dev and we will promptly delete the account and all associated data.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will make reasonable efforts to notify you via the email address on your account before the changes take effect.

Your continued use of the Service after the effective date constitutes your acceptance of the updated Policy.

For privacy-related questions, data access requests, or to report a concern:

Felix Hernandez Vieyra
me@felix-hzv.dev

We aim to respond to all privacy inquiries within 30 days.