Español | English

Privacy Policy

Last updated:

This policy explains what personal data Monetia processes, why, where it is stored, who it is shared with and how you can exercise your rights. It applies to the Monetia website and to the Monetia app for Apple devices. The Spanish version is the primary one.

1. Data controller

The controller of your personal data is Monetia, based in Bogotá, Colombia.

Contact email for privacy and data protection matters: monetia@carlosmart.co

2. Two ways to use Monetia

  • Monetia Online: you create an account and your data is stored on Monetia's server, so you can use it from the website and from the app. Sections 3, 4, 6 and 7 are mostly about this mode.
  • iCloud (app only): there is no Monetia account. Your data is stored on your devices and in your own iCloud, and Monetia's server doesn't receive it. See section 5.

The two modes are never used together, and the app doesn't move data from one to the other.

3. Data we process in Monetia Online

3.1 Your account

  • Email address, first name and last name.
  • Your password, which is never stored in a readable form.
  • Preferences: language, time zone, main currency, theme (light or dark) and privacy mode.
  • If you use Sign in with Apple: the identifier Apple assigns to your account, your name if you share it, the email Apple gives us (which can be an Apple private relay address, @privaterelay.appleid.com, if you choose to hide your email), whether that address is private and whether forwarding is on, and an Apple token we use only to revoke access when you unlink Apple or delete your account.
  • If you turn on two-factor authentication (2FA), which is optional: your authenticator app's key and your backup codes. Monetia staff accounts that sign in to the administration panel must always use a second factor.

3.2 Financial data you enter

Monetia doesn't connect to your banks. It only stores what you record, yourself or through a tool you connect:

  • Accounts (name, type, institution, balances and, if you enter them, the last 4 digits).
  • Credit cards (issuer, network, last 4 digits, credit limit, rate, statement and due days, statements).
  • Loans (lender, loan number if you enter it, amounts, rates, payments and payment schedule).
  • Assets (type, purchase price, valuations and quantities).
  • Transactions, transfers, scheduled payments, budgets, monthly plans, categories, tags and notes.
  • Payments you log with an Apple Shortcut or automation (for example, when you pay with Apple Wallet): amount, merchant, card, currency and date.

We don't ask for bank credentials or full card numbers, and for your bank accounts we only ask for the last 4 digits. Please don't type credentials or full numbers into free-text fields such as notes or descriptions.

3.3 Technical and security data

  • Sign-ins: the email used, IP address, browser or app (user agent) and date, to block repeated attempts to guess passwords.
  • Web server logs: IP address, date, requested page, referring page (referer) and user agent of each request.
  • Application logs: the server's errors and technical events, which sometimes include an IP address.
  • Open sessions and access tokens of the app and of the tools you connect.
  • A record of each call made by a connected AI assistant (see section 6).

On your device, the Monetia Online app keeps a copy of your data to work offline, and your session tokens in the device's Keychain.

4. What we use your data for

  • Providing the service: storing your records, calculating balances, net worth, budgets and reports, and syncing them across your devices.
  • Converting amounts between currencies with public exchange rates.
  • Protecting your account: authentication, two-factor authentication, lockouts after failed attempts and rate limits.
  • Sending you necessary emails about your account, for example a notice that your two-factor authentication was reset or that your account is scheduled for deletion. We don't send advertising.
  • Handling your support requests and requests to exercise your rights.

We don't sell your data or share it with advertisers. We don't show ads and we don't track you across apps or websites. Neither the website nor the app uses third-party analytics, crash reporting or advertising tools.

5. iCloud mode

  • Your financial data is stored on your device and synced to your other devices through the private database of your iCloud account (Apple's CloudKit). Every field is stored end-to-end encrypted with keys from your iCloud Keychain.
  • Monetia has no access to that data, and the app doesn't send it to Monetia's server. It isn't shared with other people either.
  • In this mode the app doesn't download exchange rates; it only uses the ones in your own data.
  • Apple's processing of the data stored in iCloud is governed by Apple's privacy policy.

6. Connecting AI assistants (MCP)

You can connect an AI assistant that supports the MCP protocol (for example, Claude or ChatGPT) to your Monetia Online account. This feature is off by default: it only works if you turn it on (on the website in Settings; in the app under "Connect your AI") and authorize each assistant.

  • On the authorization screen you choose the permissions (scopes): read or write, separately, for accounts, cards, loans, assets, transactions, transfers, scheduled payments, categories, tags, budgets, reports and quick transactions. Read access to your profile (email, name, language, time zone, main currency and whether 2FA is on) is always included. The permission to move money between your accounts (transfers:write) is shown separately, with a warning.
  • A connected assistant can never see or change your password or your two-factor authentication, or see other users' data.
  • The data you give access to is sent to the assistant you chose. What its provider does with it is governed by that provider's privacy policy, not this one.
  • Every call is logged for security: the tool used, the app, IP address, date and outcome, and for transfers, the amounts. This log is kept for 90 days and then deleted automatically.
  • You can revoke an assistant or turn off MCP access entirely at any time. More details in the MCP security documentation.

7. Third parties involved

  • Apple: Sign in with Apple; iCloud and CloudKit in iCloud mode; and in-app purchases, which Apple processes. The app checks your purchase with Apple on the device; Monetia doesn't receive your payment details or receipts.
  • Email provider: account emails are sent over SMTP through Zoho Mail, which receives your address and the email's content.
  • Exchange-rate sources: Monetia's server downloads public rates (the currency-api dataset, on cdn.jsdelivr.net and currency-api.pages.dev, and Frankfurter). Those requests only contain currency codes and dates, never user data. The app gets rates from Monetia's server, not from those services.
  • Resources your browser loads: the website loads fonts from Google Fonts, icons from cdnjs (Cloudflare), JavaScript libraries from jsDelivr, the charts of some reports from cdn.plot.ly (Plotly) and, on the sign-in and registration pages, the Sign in with Apple script from appleid.cdn-apple.com. Your browser connects to those services, which see your IP address and user agent.
  • Hosting: Monetia's server is at DigitalOcean, in a data center in New York (United States). Monetia runs the server.
  • AI assistants you connect (see section 6).

Apart from these cases, we would only hand data to an authority when a law or a valid order requires it.

8. Cookies and browser storage

The website only uses cookies it needs to work. It uses no advertising, analytics or third-party cookies.

  • sessionid: keeps you signed in (up to 12 hours).
  • csrftoken: protects forms against forged requests.
  • messages: keeps a short notice (for example, "Changes saved") to show it on the next page; it is deleted once shown.
  • __Host-monetia_apple: only during a Sign in with Apple on the website; it lasts one hour at most.
  • The language comes from your account or your browser settings; we don't store a language cookie.
  • The browser's local storage keeps your theme and privacy mode. A service worker stores static files and the offline page, never financial data.

9. Where your data is stored and how we protect it

  • Monetia Online data is stored on DigitalOcean servers in New York (United States).
  • All communication with the server is encrypted (HTTPS).
  • We use reasonable technical and administrative measures to protect your data: restricted access to the server, passwords that are never stored in a readable form, a temporary lock after 5 failed sign-in attempts, rate limits and optional two-factor authentication. To export your data, two-factor authentication must be on.
  • We make backups so we can restore the service if something goes wrong.
  • Technical logs are deleted automatically over time.
  • In the app, the lock with Face ID, Touch ID, Optic ID or the device passcode (More › Security) is on by default and works only on your device. The app hides amounts in the app switcher and on the Lock Screen, and reminders are scheduled on your device, without a server, and don't show amounts.

No system is completely secure. If an incident affects your data, we will tell you and report it as the law requires.

10. How long we keep your data and how to delete it

  • We keep your data for as long as your account exists.
  • Deleting your account: in the app, under More › Account › Delete account…; on the website, under Profile › Delete account. Your account, all your financial data, your tokens and the records of your sign-ins are deleted immediately. Your sessions stop working and the app erases that device's Monetia Online copy. If you used Sign in with Apple, we revoke access at Apple. It can't be undone: if you want a copy, export your data first.
  • Accounts that only use Apple: if Apple tells us you disconnected Monetia from your Apple ID or deleted your Apple ID, and your account has no password, you can no longer sign in. In that case we schedule the account's deletion for 30 days later and, if your email isn't an Apple private relay address, we email you. Signing in again or creating a password before that date cancels the deletion.
  • What remains after an account is deleted:
    • The log of AI assistant calls, no longer linked to your account but with each call's IP address, until it is 90 days old and deleted automatically.
    • Records of support actions, no longer linked to your account.
    • Technical records of sessions and app tokens that no longer work, without your name or email.
    • If the deletion was automatic, a record with an internal number, the cause and the dates, without your name or email.
    • Server logs, until they are deleted as they are rotated (see section 9).
    • Backups made before you deleted your account, which may contain your data until they are deleted.
  • iCloud mode: there is no Monetia account to delete. Your data is on your devices and in your iCloud, and you control it:
    • Deleting the app from a device removes that device's copy.
    • To delete the data in iCloud, on your iPhone or iPad open Settings › [your name] › iCloud › Storage (or Manage Account Storage) › Monetia › Delete Data from iCloud. The names may vary with your iOS version.
    • To delete everything, first delete the app from all your devices, then delete its data from iCloud.

11. Your rights

In Colombia, the processing of personal data is governed by Law 1581 of 2012 (habeas data) and its regulations. As the data subject you have the right, among others, to:

  • Know, update and correct your data.
  • Ask for proof of the authorization you gave us.
  • Be informed of how we use your data.
  • Revoke the authorization and ask for your data to be deleted.
  • Access your data free of charge.
  • File complaints with the Superintendencia de Industria y Comercio (Colombia's data protection authority).

How to exercise them:

  • Access and export: on the website, under Settings › Export Data, you download a JSON file with your profile, accounts, cards, loans, assets, transactions, scheduled payments, budgets, monthly plans, categories and tags (two-factor authentication must be on). To ask for the rest of your data, write to us.
  • Correction: you can change your name, language, time zone and preferences in your profile, and edit your records at any time. To change your email, write to us.
  • Deletion: delete your account as explained in section 10.
  • Any other request: write to monetia@carlosmart.co
    We will answer within the time limits set by Law 1581 of 2012.

12. Minors

Monetia is only for people aged 18 or over. If we learn that a minor created an account, we delete it with all its data. If you think this is the case, write to monetia@carlosmart.co

13. International transfers

Your data is transferred outside Colombia:

  • Monetia Online data is stored in the United States, on the DigitalOcean server in New York.
  • Some providers that process data to provide the service may be outside Colombia: Apple (Sign in with Apple and iCloud) and Zoho (sending emails). So may the AI assistants you choose to connect.

We choose providers that offer appropriate data protection safeguards. By using Monetia you authorize this international transfer and transmission of your data, under Law 1581 of 2012.

14. Changes to this policy

If we change this policy, we will publish the new version here with its update date. If the change is important, we will also let you know by email, with a notice in the app, or both.

15. Contact

For questions about this policy or your data: monetia@carlosmart.co