Privacy policy.

1. Who is responsible for your data?

Lekto is a personal finance application operated by Lekto SHPK, Tirana, Albania. We are responsible for the personal data we process to provide Lekto. For privacy questions or requests, email [email protected].

This policy covers the mobile app, its cloud account service and this public website. Apple, Google and other independent services also process information under their own policies when you use them.

2. Information we process

• Account information: your name, email address, internal account identifier and account status. Email/password accounts use a hashed password. If you choose Google or Apple sign-in, we process the provider’s account identifier and the name and email it makes available, including an Apple private relay address when selected.
• Your financial entries: transactions, amounts, categories, notes, budgets, savings goals, contributions, recurring entries and related dates. These are records you enter; Lekto does not connect to your bank or receive your bank login credentials.
• Settings and synchronization: language, currency, preferences, account-specific device storage and cloud snapshot/version information used to save and restore your records.
• Access and purchase information: trial dates, complimentary access, store product identifiers, entitlement status, renewal or expiry dates and available transaction metadata. Apple or Google handles card details. Lekto does not receive your card number.
• Notifications: local reminder settings and delivery history. If team push notifications are enabled and you opt in, we also process a device messaging token, installation identifier, platform and account binding.
• Support and security: messages you send us, deletion requests, relevant administrative audit records, and technical connection information such as IP addresses and server logs needed to operate and protect the service.

We do not access your phone contacts or GPS location. Lekto does not include advertising tracking or a separate analytics SDK. Please avoid entering unnecessary personal information about other people in transaction notes or support messages.

3. Why we use your information

We use account and financial records to provide the features you request: sign-in, budgeting, savings tracking, account-specific storage, cloud synchronization and recovery. We process access and purchase information to provide trials, verify subscriptions, restore access and handle support.

Where applicable data protection law requires a legal basis, we rely on performing our agreement with you for these core services, consent for optional communications where required, legitimate interests for proportionate security, service reliability and support, and legal obligations for records we are required to retain. You can withdraw an optional notification choice in the app or phone settings.

Budget calculations support your own planning. We do not use them to make credit, lending or other decisions with legal or similarly significant effects.

4. Service providers and sharing

Access is limited to people and service providers who need it to operate, support or protect Lekto. We do not sell your personal data.

• Hosting and email providers support the cloud service, backups, account emails and support correspondence.
• Apple and Google process information when you choose their sign-in services or purchase through their stores.
• RevenueCat supports subscription and purchase verification when configured. It receives an account-derived identifier and purchase/access information. We do not send your financial ledger, name or email as RevenueCat customer attributes. See RevenueCat’s privacy policy.
• Firebase Cloud Messaging handles messaging tokens and notification delivery when optional team push is enabled and you opt in. Automatic budget reminders are scheduled locally on your phone.
• Frankfurter supplies reference exchange rates when you request a currency conversion. The request includes the currency pair, not your transaction amounts or notes. As with other internet requests, its network receives connection information such as your IP address.

Some providers may process information outside Albania or the European Economic Area, including in the United States. Where required, transfers must use an applicable lawful mechanism and appropriate contractual safeguards. Contact us for details of the providers, hosting locations and transfer arrangements applicable to your account. We may also disclose information where required by law or necessary to establish or defend legal claims.

5. Storage and security

The app keeps account-specific financial records on your device. With a cloud account, financial snapshots are also sent to the Lekto backend so they can be restored and synchronized. Cloud financial snapshots are encrypted in the database using the server’s application key. Authorized administrators can view account financial summaries for administration and support; those views are audited. This is not end-to-end encryption.

Session credentials use the operating system’s secure storage. The local financial database has no additional app-level encryption. Protect your device with a passcode and keep it updated. System backups and exported files are also subject to your device and storage settings. Signing out does not erase local records.

We use HTTPS for the production service, hashed account passwords and access controls. No storage or transmission method can guarantee absolute security.

This website may use necessary session and security cookies. It does not use advertising cookies or analytics trackers. Sending a support email uses your email service and ours.

6. Retention and account deletion

We retain active account records to provide your account and saved financial history until you delete individual records or a verified account-deletion request is completed. Archiving a goal or hiding a category preserves its history. Uninstalling the app does not delete the cloud account.

You can request deletion of your Lekto account and associated data without reinstalling the app. After identity verification and administrator review, deletion removes the account, cloud financial snapshots, social sign-in links, access grants, backend billing records, device registrations and account email records, and revokes Lekto sessions.

We may need to retain limited records for legal obligations, security, disputes or the completion of your request. A minimal deletion receipt with the request number and processing dates can remain without the deleted account identity. If personal information must be retained, we will explain the reason and applicable retention period. Copies in existing backups may remain until those backups expire under the applicable backup schedule; contact us for details. Support correspondence is kept only as needed to handle the request and related legal obligations or claims.

Where providers hold associated data on our behalf, erasure may require a separate provider request. Records Apple or Google must retain under their own legal obligations are governed by their policies. Deleting a Lekto account does not cancel an Apple or Google subscription. Manage cancellation through the store that bills you. Device copies, exports and operating-system backups must also be managed on your devices.

7. Your choices and rights

You can edit your entries and settings in the app, export your local records, and request access, correction or deletion. Depending on applicable law, you may also have rights to restrict or object to processing, receive a portable copy, withdraw consent and complain to a supervisory authority. Contact us using your account email so we can verify your request proportionately. We will explain any lawful exception and respond within the applicable legal period.

In Albania, you can contact the Commissioner for the Right to Information and Protection of Personal Data. Where applicable, you can also complain to your local data protection authority.

Lekto is not designed for children. Contact us if you believe a child has provided personal data so we can investigate and take appropriate action.

8. Contact and policy updates

Email [email protected] for privacy and general contact, or [email protected] for account and app support. The operator is Lekto SHPK, Tirana, Albania.

We may update this policy as the service or legal requirements change. The date above identifies the current version. We will provide additional notice where required for a material change.