1. Data controller
The data controller is Fabio Domenico Cuttaia, Via Villaggio dei Fiori 6, 92027 Licata (AG), Italy, Italian tax code CTTFDM94P23E573A, contactable at fabiocuttaia37@gmail.com.
2. Data we collect
NorthStar is designed to collect only what is necessary:
- Account data: email address and, when Google sign-in is used, the name and profile image supplied by Google.
- Financial data entered by you: transactions, net worth, goals, mortgage data and other information you add. It is stored locally and, if you create an account, synchronised through a protected connection with Supabase so it is available on your devices.
- Minimal technical data: when the app fails, an error identifier, account ID and, when available, email may be sent to Sentry. Amounts, balances, transaction names and other financial data are never sent to Sentry.
- Subscription data: subscription status and a transaction identifier supplied by the payment provider. We never see or store your card details.
3. Legal basis and purposes
- Performance of a contract (GDPR Art. 6(1)(b)): to provide the service, synchronise data and manage subscriptions.
- Legitimate interests (Art. 6(1)(f)): minimal technical diagnostics and fault prevention.
- Consent (Art. 6(1)(a)): optional, non-essential features as explained in the Cookie Policy.
4. Where your data is stored
In guest mode, data remains in your browser/device storage. If you create an account, a copy of your workspace is stored using Supabase Inc. infrastructure. Data is transmitted over protected connections. Transfers outside the EEA are handled as described in section 8.
5. Service providers
- Supabase — database hosting and authentication.
- Sentry — technical error monitoring, without financial data.
- Google — only when Google sign-in is used.
- Stripe — web subscription payments.
- Apple / Google Play — in-app purchases in store-distributed versions.
6. Retention
We retain cloud data while your account is active. When you delete your account and cloud data from the app, cloud data is permanently deleted. Local-only data remains on your device until you delete it or uninstall the app.
7. Your rights
You may request access, rectification, deletion, restriction, portability and objection under GDPR Articles 15–22. You can export data or delete your account directly in the app. Other requests may be sent to fabiocuttaia37@gmail.com; we aim to respond within 30 days.
8. International transfers
Where providers process data outside the EEA, transfers rely on Standard Contractual Clauses or another lawful safeguard.
9. Children
NorthStar is not intended for anyone under 18 and we do not knowingly collect children's data.
10. Changes
We may update this policy. Material changes will be communicated through the app or by email before taking effect.