privacy policy

Information we collect

Depending on how you use neewo, we may collect:

• Account information: your name, email address, password hash, email verification status, and account timestamps. We do not store your password in readable form.
• Encrypted financial records: ciphertext containing the income, expenses, contributions, assets, liabilities, currencies, tags, groups, dates, rates, payments, relationships, forecast data, and preferences you choose to enter or import. We can observe limited record metadata such as opaque identifiers, record type, ciphertext size, version, and timing, but not the encrypted contents.
• Authentication and technical information:session tokens, IP address, browser or device information, and security and rate-limit records used to sign you in and protect the service.
• Messages you send: your name, email address, message, referring page, and browser information when you submit feedback or request support.

Anonymous and account use

You can use core features without an account. In that case, your financial entries and preferences are encrypted and stored locally in your browser. They are not synced to neewo's account database unless you choose to create or sign in to an account and migrate them.

When you use an account, neewo stores account information and encrypted financial records so they can be saved and synced. CSV imports, exports, calculations, and forecasts are processed in your browser after the vault is unlocked. Exported JSON and CSV files are readable plaintext, so you must store them securely and review imported data before relying on it.

How we use information

We use information to:

• provide cashflow, net-worth, organization, and forecast tools;
• create and maintain accounts, sessions, and saved preferences;
• process imports, exports, currency conversions, and forecasts;
• send requested password-reset or verification messages;
• prevent abuse, detect compromised passwords, and secure neewo;
• respond to feedback and improve technical reliability and usability without analyzing your financial entries; and
• comply with law and enforce our terms.

Cookies and browser storage

Neewo uses essential cookies to maintain signed-in sessions and protect authentication. It also uses browser storage for anonymous financial data, interface preferences, cached exchange rates, and other settings needed for the app to work. Anonymous financial data is encrypted with a non-exportable device key stored by the browser. Clearing browser storage may permanently remove anonymous data that has not been migrated to an account.

When information is shared

We do not sell or rent your personal or financial information, and we do not use it for targeted advertising. Infrastructure providers may store encrypted financial records and operational metadata but do not receive the decryption key from neewo. Other service providers receive only what their function requires: Resend handles account email delivery, Have I Been Pwned receives a partial password-hash prefix for production breach checks, and Frankfurter supplies exchange rates without receiving your financial entries. The deployment's infrastructure providers are Vercel, Neon, and Resend.

We may also disclose information when reasonably necessary to comply with law, respond to valid legal process, prevent fraud or harm, protect users and the service, or complete a merger, acquisition, financing, or sale. If ownership changes, this policy will continue to apply to transferred personal information unless you are notified otherwise.

Security and retention

Account financial records use end-to-end encryption: a random vault key encrypts record contents with authenticated AES-256-GCM in your browser. Your password-derived key and one-time recovery key each wrap that vault key. Neewo stores only the wrapped keys and encrypted records, and cannot decrypt them. Account credentials and technical metadata are not end-to-end encrypted. We also use one-way password hashing, restricted session cookies, rate limiting, and compromised-password screening in production. No system can guarantee absolute security, including against malicious code delivered to an unlocked browser.

Neewo does not retain your recovery key. If you forget or reset your password without it, encrypted financial data cannot be recovered by neewo. After you unlock the vault, this browser stores its vault key in browser-managed storage so refreshes and later visits remain unlocked while your account session is active. Logging out removes that remembered key. Anyone with access to an unlocked browser profile may be able to view the financial data.

Account metadata and encrypted financial records are kept while your account is active or as needed to provide the service. Deleting your account removes the account and its linked encrypted financial, session, and feedback records from the active database. Anonymous feedback is retained as needed to respond, maintain service records, and prevent abuse. We may retain limited information when required by law, to resolve disputes, or in time-limited backups.

Your choices and rights

Account settings let you update your email or password, replace your recovery key, export readable copies, reset financial data, and delete your account. Anonymous users can remove locally stored data through browser controls. Depending on where you live, you may also have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information. We will verify requests where appropriate and will not discriminate against you for exercising applicable privacy rights.

Children

Neewo is not directed to children, and we do not knowingly collect personal information from children who cannot lawfully consent to its processing. If you believe a child has provided personal information, contact us so we can review and remove it.

International processing

Neewo and its listed service providers may process information in countries other than your own. The legal transfer mechanism and safeguards applicable to a request depend on the operator and provider locations. Contact us for the current transfer details that apply to your information.

Changes to this policy

We may update this policy as neewo changes. We will post the updated version here, revise the effective date, and provide additional notice when required by law or when a change is material.

Contact

Email neewo.stabilize929@simplelogin.com for privacy questions or requests, or use the feedback page. Please do not include passwords or unnecessary financial details in your message.