Privacy and personal data policy

1. Data controller

The controller of your personal data is Duvan Vargas, an individual domiciled in Rionegro, Antioquia (Colombia), who develops and operates the Oslo Finanzas app and website ("Oslo", "we").

Contact channel for personal data: soporte@oslofinanzas.com. You can also reach us on LinkedIn: https://www.linkedin.com/in/duvandroid

2. What Oslo is and isn't

Oslo is an app to record and organize your money: your accounts and your cash, your expenses and income, your savings goals, your debts and your recurring payments.

Oslo can be used from any country. Wherever you live, the controller of your data is the same, in Colombia, and processes it according to this policy and Colombian data protection law (Law 1581 of 2012). If your country's law gives you additional rights over your data, write to us and we will handle them through the same channels.

• It doesn't connect to your bank or your wallet and never asks you for passwords, verification codes or details to get into them. What Oslo knows about your money is what you type into the app.
• It doesn't receive, hold, transfer or lend money, doesn't make payments and is not an entity supervised by the Financial Superintendence of Colombia or any other financial authority. Oslo records; the money stays in your bank, your wallet or your pocket.
• It isn't professional financial advice. Oslo gives you general guidance and good habits with your own numbers, on Today and in the chat, but it doesn't recommend a specific institution, credit or investment: the decisions about your money are yours.

3. Data we collect

Your account

• Sign-in: with Apple, with Google or with a link sent to your email. We receive your email and an identifier of your account and, if the provider shares them, your name and the link to your photo. If you use Apple's "Hide My Email", we receive the email Apple generates. We don't use passwords or SMS codes.
• Profile and settings: your name, your avatar (an Oslo character or, if you choose it, the photo from your Apple or Google account: we store only the link, the app doesn't upload photos), country, currency, time zone, language, your pay cycle (for example, twice a month or monthly) with your income, and your reminder preferences.
• Your answers when you start (optional): how you found Oslo and what you expect from the app. We use them to show you first what matters to you. You can skip them.

What you record

• Accounts: name, type (cash, bank, wallet, savings, card, loan or other), the bank if you choose one, the currency and a daily limit if you set one. Each account's balance comes from its transactions.
• Transactions: amount, currency, date, account, category and, if you write them, merchant, note and tags.
• Goals: the account you mark as a goal, the amount you want to save and, if you set it, the date.
• Debts: cards and loans with their lender, rate, installment, payment day and what is left to pay.
• Obligations: recurring payments (for example, rent or your phone plan) with their amount, how often they repeat, their next date, the account they usually come out of and how many days ahead you want the reminder.
• Your own categories, if you create them.

The assistant (with a paid plan)

If you write to Oslo's assistant, we keep your questions and its answers in your account, so you can pick up the conversation, and how many messages you've used this month, to apply your plan's limit. Before your first message, or the first reading of a report, we ask your permission to send Google's AI a summary of your money; you can withdraw it anytime in More > Help and privacy > Data and privacy. To answer, the assistant uses your records (section 8). It can make mistakes, and its answers are not financial advice.

Comments you send us

If you write to us from the app (in More > We want to hear from you, or by tapping 👎 on one of the assistant's answers), we receive by email your comment, your account's identifier and email address (so we can reply), your plan, your language, the country in your profile, your phone's system and the app version and, only if you choose to, your question and the assistant's answer. We use it to improve Oslo and to reply to you.

Photos and videos. In We want to hear from you you can attach up to 5 photos and 1 video that you choose from your gallery (the app does not ask for permission to see it: it only receives what you choose). We keep them in Firebase, in a folder of your account that only the Oslo team sees, and they reach us by email as private links that expire after 7 days, never as public files.

Purchases and subscriptions

Plans are paid through the App Store or Google Play. Oslo doesn't receive or store your card data. RevenueCat, the service the app uses to check your purchases, receives your Oslo account identifier and the purchase data the stores provide: the product, the purchase, renewal and expiration dates, the store's country and a transaction identifier. With that we know whether your plan is active. RevenueCat doesn't receive your financial records.

App crashes

If the app crashes, Firebase Crashlytics sends a technical report: what broke, the screen you were on, what you were doing, an error code, your plan, your phone's model and system, the app version and an installation identifier that Crashlytics creates. The report also carries your account identifier, so we can find it if you write to support. It never carries amounts, names, notes, shops, emails or the identifiers of what you record. It's on from the moment you install Oslo, and you can turn it off whenever you want in More > Data and privacy.

Technical log on the phone (“black box”). The app keeps on your phone its last 300 technical steps: when it opens, with which version, system, phone model and language; the screens you open; when it goes to the background and comes back; the state of your session; and the code of each error you see, with its screen. It never keeps amounts, names, notes, shops, emails or anything you type. That log is only sent to us when something goes wrong: you see an error, the app repairs your session on its own, it closed unexpectedly, or you tap “Report a problem” in Help. If you turn off crash reports in More > Data and privacy, it is only sent in that last case. What is sent carries your account identifier, so we can find it if you write to support.

How you use the app

Firebase Analytics tells us which screens you open and which steps you finish, so we know what to fix and what to improve. What travels is counts and labels from our own lists (for example, “expense” or “the plans screen opened”), your plan, the country in your profile, your language and your phone's system. Analytics does not receive your account identifier, and it never receives amounts, names, notes, shops, emails or anything you type. Google Analytics infers an approximate country and city from your IP address; the app does not ask for location permission and does not read your real location. It's on from the moment you install Oslo, and you can turn it off whenever you want in More > Data and privacy.

We also keep, in our own database, a summary of how you use Oslo: which days you open it, how many screens you see, how many times you open it and how long it stays open that day, how far you got when you started, the app's system and version, and whether you have reminders, the app lock and the light or dark theme on. This summary is linked to your account, so we can tell whether Oslo is working for you (for example, how many people come back after their first week). Only the Oslo team sees it, as totals and without your name or email, and it never carries amounts, notes, shops or anything you type. If you buy a plan or delete your account, we note only the day, the plan and how many days you had been with Oslo, without who you are. It turns off together with Analytics in More > Data and privacy, and it is deleted with your account.

Your requests and their number. When you write to us from “We want to hear from you”, your message gets a number with the date and time it arrived. We keep that number, when it arrived and whether we answered it, and you see it in More > Help and privacy > My requests. What you write reaches us by email, like any comment.

4. What we don't collect

• Oslo doesn't show ads and doesn't track you: it doesn't use your phone's advertising identifier or share data with ad networks.
• Usage analytics measures screens and steps, never your money: no amount, name, note or shop travels, and it does not carry your account identifier. You can turn it off.
• We do not access your exact location, your contacts, your camera, your microphone, your gallery, your calendar or your health data. We only receive the photos or the video you choose to send us with a comment.
• We don't ask for card details, bank passwords or identity documents.

5. What we use your data for

• To create and manage your account and let you sign in with Apple, Google or a link to your email.
• Storing your records, keeping them up to date on your phones and calculating your balances, what you have left for the day, your periods, your goals and your debts.
• Scheduling the reminders for your obligations on your phone, writing you the emails that are part of the service and, with a paid plan, sending you the summaries Oslo writes you (section 6).
• Answering your questions in the assistant, if you have a paid plan.
• Applying your plan: the free plan limits, what a paid plan unlocks and what becomes read-only if the plan expires.
• To handle your support requests and your rights as a data subject.
• Understand how the app is used, with usage data that carries none of your figures, to decide what to fix and what to improve.
• Fixing app crashes, preventing abuse and meeting legal obligations.

We don't sell your data, we don't rent it and we don't use it for advertising.

6. Reminders and emails

Reminders for your obligations are local notifications: your own phone schedules them using the dates you record, they don't go through a server and they don't include amounts. Only when your phone couldn't reach you do we send that reminder from the server, using the identifier your phone receives notices with; it carries no amounts either, because anyone can read a lock screen. Reminders on your phone are free on any plan. The app asks for permission only when you save your first obligation or turn on reminders in More > Settings > Notifications, and you can turn them off there or in your phone's settings.

Oslo doesn't send you advertising emails and doesn't give your address to anyone else to write to you. We write to you in two cases:

• Emails that are part of the service: the sign-in link, if you choose that way; your welcome when you create the account; the notice of a charge for your subscription; the notice that your plan will not renew; our thank-you when you write to us from the app (one a day at most); and the confirmation that your account has been deleted. They don't rest on your authorization but on your contract with Oslo — they are the service itself — and the deletion confirmation also answers our legal duty to reply when you ask us to delete your data. That is why they have no switch.
• The summaries Oslo writes you (your week, your month, what is due and your streak): they are a feature of the paid plans, they are not sent on the free plan and you turn them off whenever you want. Each one has its switch in More > Settings > Notifications, and every email carries a one-tap link to stop receiving it, without opening the app.

To write to you, the server reads a summary your own phone leaves in your account: your figures for the week and the month, what is due, your streak, your language, your time, your switches and the identifier your phone receives notices with. The server doesn't open your transactions for this.

7. Your authorization

By creating your account you accept this policy and authorize the processing of your data for the purposes above. The only phone permission Oslo asks for is notifications, and you can withdraw it whenever you want from your phone's settings.

When you sign in, you confirm that you're 18 or older and accept this policy. We keep a record of each authorization you give: what you accepted, in which language and when. The authorization for the AI is separate: you give it before using the assistant, and you withdraw it in More > Data and privacy as easily as you gave it.

Crash reports and usage data (section 3) are on from the moment you install the app, because they let us find and fix what breaks. By using Oslo and creating your account you authorize them, and you can turn each one off whenever you want in More > Data and privacy: the app works the same with both off.

Oslo doesn't ask you for sensitive data. If, when logging an expense, you write something that reveals sensitive information (for example, a health expense), you do so voluntarily and we treat it with the same confidentiality as the rest of your records, without using it for anything other than showing it to you.

You can revoke your authorization whenever you want by deleting your account (section 11) or by writing to us (section 13).

8. Who we share data with

We don't sell or hand over your data. We share it only, as needed, with these processors, who handle it on Oslo's behalf:

• Google Cloud and Firebase (Google LLC): sign-in (Firebase Authentication), database (Cloud Firestore), server functions (Cloud Functions), the photos and videos you attach to a comment (Cloud Storage for Firebase), the website (Firebase Hosting), crash reports (Crashlytics) and usage data (Google Analytics for Firebase).
• RevenueCat, Inc. (United States): the status of your purchases and subscriptions made on the App Store and Google Play (section 3).
• Google Cloud Vertex AI (Google LLC): the artificial intelligence model (Gemini) the assistant uses to write its answers, inside Oslo's own Google Cloud project. Only when you write to the assistant, and only if you gave permission, it receives your question, the recent conversation, your first name and a summary of your money: your accounts, goals, debts, payments, budgets and categories with the names you gave them, your latest transactions (date, amount, category and account), your country, your pay cycle, your streak and what you wrote in “What do you expect from Oslo?”. It never receives your notes, the shops of your transactions, your email or your account's identifier. Nothing is sent while you simply use the app, and the app tells you so in More > Help and privacy > Data and privacy. Under Google Cloud's terms, Google does not use that content to train its models. To answer faster it may keep it in a cache of our project that is deleted within 24 hours at the latest, and only if its automated systems detect possible abuse of its usage policies may it keep the question for up to 90 days to review it (Google Cloud documentation).
• Resend (United States): the service we send our emails with and through which your comments reach us. It receives your email address, your name and the message we write to you, with the figures of any summary you asked for; and, when you write to us from the app, your comment, the links to the photos or the video you attach (not the files) and, only if you choose to, your question and the assistant's answer, which may include figures. It receives nothing else of what you record.
• Expo (650 Industries, Inc., United States): delivers the app's updates. Each time the app checks for one, Expo receives your IP address, your phone's system and the app version; never your account or what you record.
• Apple and Google: signing in with their account and selling the plans in their stores. Apple and Google are responsible for the payment data they handle under their own policies.

We may also hand over data when required by law or by an order from a competent authority.

9. International transfer and transmission

Your data is stored on Google Cloud and Firebase servers located in the United States, and RevenueCat, Resend and Expo also process data in the United States. To answer you, the assistant uses Google's global Vertex AI service, which may process your question in other countries where Google has data centers. This is an international transmission of data to processors acting on Oslo's behalf, under contractual conditions that require them to protect your information with adequate standards. By accepting this policy you authorize this transmission.

10. How long we keep it

• Your account, your profile and your records: as long as you have an account.
• Conversations with the assistant: up to 12 months after the last message; older questions and answers are deleted automatically.
• What Google's AI receives: its cache is deleted within 24 hours at the latest; only if its systems detect possible abuse may Google keep the question for up to 90 days to review it.
• Records of your authorizations: while you have an account.
• Crash reports: Crashlytics keeps them for up to 90 days.
• Technical log (“black box”): what the app sends us is deleted on its own after 30 days, or sooner if you delete your account.
• Comments you send us, with their photos and videos: we keep them for up to 12 months, or less if you ask us to delete them.
• Usage data: Google Analytics keeps it for up to 14 months.
• Numbered requests: until 3 years after we answer them, or sooner if you delete your account.
• Usage summary in our database: while you have an account. The totals, which say nothing about any one person, are kept to compare over time.
• Purchase records: the stores and RevenueCat keep them for as long as accounting, tax and consumer protection rules require.
• When you delete your account: your data is removed from our database at that moment and, within a maximum of 30 days, from any technical copy held by our providers, except what the law requires us to keep.

11. Deleting your account

You can delete your account and all your data whenever you want:

• In the app: More > Delete account.
• On the web, without the app: at oslofinanzas.com/eliminar-cuenta, signing in with the same account you use in Oslo.

Your profile, settings, accounts, transactions, goals, debts, obligations, categories, conversations with the assistant and sign-in are deleted. If you signed in with Apple, we also ask Apple to remove Oslo's access to your Apple ID. Deleting your account doesn't cancel a subscription bought in the store: cancel it from your Apple or Google Play account too.

12. Your rights

As the data subject you have the right to:

• Know what data we have about you and how we use it. Everything you record you can see in the app.
• Update and correct your data. In Oslo you can fix or delete any record.
• Request proof of the authorization you gave us.
• Be informed about how we use it.
• Delete your data and revoke your authorization, when there is no legal or contractual duty to keep it.
• Receive a copy of your data at no cost: ask for it by email.
• File complaints with the Superintendence of Industry and Commerce (SIC), after having made your inquiry or claim to us.

13. How to exercise them

To delete your account, the fastest way is the app or the page oslofinanzas.com/eliminar-cuenta (section 11). For everything else, write to us at soporte@oslofinanzas.com with your name, your account's email, what you are asking for and how we should reply. We may ask you to confirm that you are the data owner.

• Inquiries (knowing your data): we respond within 10 business days at most. If we can't make it, we tell you why and respond within 5 more business days at most.
• Claims (correcting, updating, deleting or revoking): we respond within 15 business days at most. If we can't make it, we tell you why and respond within 8 more business days at most. If the claim is incomplete, we ask you for what's missing within the following 5 days; if you don't complete it within 2 months, it's understood that you withdrew it.

If you're not satisfied, you can go to the Superintendence of Industry and Commerce (www.sic.gov.co).

14. Children and teenagers

Oslo is only for people 18 or older: we ask when you start. It is not aimed at minors and we don't knowingly collect data from minors. If you are a parent or legal guardian and think a minor created an account, write to us and we will delete it.

15. Security

We protect your data with reasonable technical and organizational measures: encrypted connections, data encrypted at rest on Google Cloud, access rules so each person reads and writes only their own data, and restricted access to administration. Your plan's status is decided by the stores, not by the app. No system is infallible: if an incident affecting your data occurs, we will let you know and report it to the SIC as the law requires.

16. Website and cookies

This site doesn't use advertising cookies or analytics tools. It only stores in your browser the language you choose and, on the page to delete your account, the Firebase Authentication session you use to confirm it's you. Fonts are loaded from Google Fonts, which receives technical data from your browser (such as the IP address) to deliver them.

17. Changes to this policy

We may update this policy. We will publish the new version here with its date and, if the change is important (for example, a new purpose or a new processor handling your financial records), we will let you know in the app and ask for a new authorization when the law requires it.

Effective date: this policy is effective from its publication on this website.

18. Contact

• Controller: Duvan Vargas, an individual, operator of Oslo Finanzas
• Address: Rionegro, Antioquia, Colombia
• NIT (Colombian tax ID): 1067948920-5
• Phone: +57 312 840 2610
• Email for personal data: soporte@oslofinanzas.com
• LinkedIn: https://www.linkedin.com/in/duvandroid

See also the Terms and conditions.