Bolso Privacy Policy

Last updated: October 13, 2026 Version: 1.3

Three-line summary

1. Bolso is a personal-finance app that runs on your iPhone, iPad and Mac. We have no server. Your data lives on your device and, if you turn iCloud on, in your own iCloud account.
2. The app does no tracking, has no analytics and sells no data. We do not receive your financial data, attachments or preferences. Sync and sharing you enable use Apple’s iCloud/CloudKit services (section 3). The public website measures visits without cookies — that is section 13, and it does not apply to the app.
3. You are in full control. Export (with valid Pro or trial access), delete, disable sync or leave a family share at any time — without contacting us.

1. Who we are

Bolso is an app for iPhone, iPad and Mac maintained by the team behind Bolso, in Portugal.

For privacy-related questions please reach out at privacy@getbolso.com (public email).

2. What data the app processes

The app processes the data you enter and the technical data needed for trial access, purchases and update checks described below.

2.1 Financial data you enter

• Records (expenses, income and account-to-account transfers)
• Scheduled payments and recurrences
• Accounts (name, bank, balance, currency, icon)
• Payees (name, contact details, account number, notes)
• Categories and subcategories
• Budgets, budget alerts and monthly overrides
• Shared expenses (payer, participants, percentages/amounts)

2.2 Attachments (receipts)

• Each record accepts up to 5 attachments, 10 MB each at most.
• Images are normalised to JPEG; PDFs are preserved.
• Text recognition (OCR) runs entirely on your device with Apple's Vision framework, in European Portuguese and English. Attachments never leave your device or your iCloud account.

2.3 Local preferences

• Visual theme (light/dark/system)
• Bookkeeping month start day
• Haptic toggle
• Preferred forecast period
• Last-used account
• Profile name (used only for identification within family sharing, if you opt in)

These preferences always stay private to your device, even when family sharing is active.

2.4 Trial state

The 7-day trial is voluntary: it starts only when you choose to start it in the app and activation is confirmed. It uses one window for the same iCloud account across iPhone, iPad and Mac; installing or opening the app does not start a new period.

• The app stores an activation record in your iCloud account’s private CloudKit database, in the iCloud.com.fabiogomes.bolso container. It includes the policy version; the creation date assigned by CloudKit determines the start. The app also checks the CloudKit account/creator identifier.
• To validate time and access, the app creates or updates a separate private time-attestation record, with a policy version and a random validation value (nonce). It uses the modification date and creator information assigned by CloudKit. This validation can occur when checking access, not only when you choose to start the trial.
• The device Keychain stores evidence scoped to the account, container and environment: activation attempt, known activation and previously validated time progress. On iPhone, it may also store transition evidence for the previous trial. This local data is not part of the app’s financial backups.
• Private activation and time records are not shared as financial data. In family sharing, participants receive the owner’s access-validity information in the share, including subscription and any trial, with a local cache to validate access to the shared workspace (section 3.3).

Activation and validation depend on the availability of the iCloud account and Apple services. The app may require an internet connection or another check when it cannot confirm access.

3. Where the data lives

3.1 On your device

Financial data is stored locally on your device, subject to operating-system protections. Trial access state also uses iCloud and Keychain, as described in section 2.4.

3.2 In your iCloud account (if enabled)

If iCloud sync is on in system Settings, financial data (excluding the local preferences listed in 2.3) is synced into your own private iCloud account, in the iCloud.com.fabiogomes.bolso container.

• Sync is handled directly by Apple through CloudKit.
• We never have access to that iCloud account or to your data. Apple stores synced data encrypted in transit and at rest, under iCloud's security model.
• If you disable iCloud, local data remains subject to the app’s access rules; the common trial and sharing depend on the validation described in section 2.4. If you toggle it back on, Apple resyncs from your account.

3.3 In family sharing (if enabled)

Family sharing relies on CKShare, Apple's CloudKit sharing primitive. When you share your workspace with someone:

• A private invitation is created. Only people with the link can accept it, and you, as the owner, can revoke it at any time.
• Only financial data flagged as shareable is visible — personal preferences (theme, profile, forecast) stay private to each participant.
• The owner’s valid Bolso Pro or trial access covers family editing in the shared workspace, subject to each participant’s permission. Without confirmed valid owner access, participants cannot edit; their personal trial or subscription does not replace the owner’s.
• To leave the share, you can end it from Bolso Settings or from system Settings > iCloud.

The app never makes lists, aggregates or reports about the people sharing with you available to anyone outside that share.

4. Permissions the app asks for

4.1 Camera

• Purpose: scan receipts as attachments to records.
• Only when: you tap "Add attachment > Take photo".
• Authorisation prompt: The camera is used to scan receipts and attach them to your records.

4.2 Face ID / Touch ID

• Purpose: optional, you enable it under Settings > Security.
• Who handles it: Apple's LocalAuthentication framework. Biometric data never leaves the Secure Enclave on your device — the app only receives an "authenticated / not authenticated" signal.
• If you disable biometrics in system Settings, Bolso's lock turns itself off safely and the app remains accessible without it.

4.3 Notifications

• Purpose: receive CloudKit pings when there is pending sync. Notifications never contain financial data, only an indication that there are changes to fetch.
• You can disable them in Settings > Notifications > Bolso.

4.4 iCloud

• Purpose: sync, family sharing (section 3), and trial access and time validation (section 2.4).
• How you control it: Settings > iCloud > Bolso (in system settings) or in the app's settings.

5. In-app purchases

The Bolso Pro subscription (monthly or yearly) is processed by Apple's App Store through the StoreKit 2 framework.

• We never receive, see or store your payment data (card, IBAN, tax ID, billing address). All of that is handled by Apple.
• The app receives verified transactions and access information from Apple: product, validity and any revocation dates, ownership type and identifiers needed to validate the purchase. This information is used to decide Pro access.
• Restores use AppStore.sync(). We do not bill anyone directly.

The voluntary 7-day trial is app-managed, using private iCloud/CloudKit records and local Keychain evidence (section 2.4). It is not an App Store subscription trial offer and does not start automatic billing.

6. App communications, without tracking or analytics

The app:

• Does not use third-party analytics, tracking or crash-reporting SDKs.
• Uses Apple’s CloudKit and StoreKit for sync, sharing, trial access, time attestation and purchases.
• Queries https://itunes.apple.com/lookup, over HTTPS, for public app update metadata. The request includes the public app identifier, application type and store country (or device region). It does not include financial data, attachments or your account identifiers. The connection communicates the IP address and normal technical network-request metadata to Apple; we do not claim that these are anonymous or that Apple does not retain them.
• Does not use advertising identifiers (IDFA), fingerprinting, cookies, web beacons or any equivalent technique.

The PrivacyInfo.xcprivacy shipped with the app explicitly declares:

• NSPrivacyTracking: false
• NSPrivacyTrackingDomains: empty
• NSPrivacyCollectedDataTypes: empty
• Only Required Reason API declared: UserDefaults (reason CA92.1 — store user preferences)

What this section describes is the app. Measurement on getbolso.com is in section 13 and does not change what the app does.

7. Exercising your rights (GDPR)

Even though you do not have an account with us, we honour the rights granted by the EU General Data Protection Regulation:

In-app export requires valid Pro or trial access. This does not limit your legal rights of access and portability; for questions about exercising them, contact privacy@getbolso.com.

Because we have no server, there is no formal "request" to file with us — control sits entirely on your Apple account and inside the app. If you still want to validate conduct, write to privacy@getbolso.com and we will reply within 30 working days (the GDPR limit).

You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt.

8. Data retention

Financial data lives on your device and/or your iCloud account. You can manage it through the available options:

• If you delete the app: removal of local data depends on the operating system.
• If you delete Bolso from your iCloud account: Apple removes the synced data.
• If you use the app's "Delete all data" action: it wipes both local and iCloud.

“Delete all data” is for financial data; it does not delete private activation/time records or Keychain trial evidence. These have no automatic deletion period defined by the app and may persist after the app is deleted. Removal of iCloud data is managed by Apple. Deleting financial data does not reset eligibility for a new trial.

We keep no copies on any server, because we have no server.

9. Children

Bolso is intended for users aged 4 and over (App Store rating). It does not knowingly collect or request personal data from children under 13. If a child in that range is using the app, we recommend setup happens with adult supervision — the app only processes data that is entered manually.

10. Security

• The app honours Apple’s operating-system security model: in-transit and at-rest encryption (CloudKit), Secure Enclave protection for biometrics, and the proper Data Protection Class applied to the Keychain and the local database.
• In shared zones (Family Sharing), Apple validates access; only active participants whose invitations were accepted can read or write.
• We never ask for passwords or financial data via email, social media or support channels. If you receive a message claiming to come from us asking for any of those, do not reply.

11. Changes to this policy

If the way the app handles data changes in a material way (e.g. adopting a new service, integrating with a third party, or processing new data types) we update this page and bump the version (field at the top). For meaningful changes we also notify you through the app itself before the new version takes effect.

12. Contact

• Privacy and GDPR rights: privacy@getbolso.com (public email)
• General support: support@getbolso.com (public email)
• Website: https://getbolso.com/ (public site)

13. The getbolso.com website

The sections above describe the app. The site you are reading (getbolso.com) is something else: a presentation page, with no account and none of your financial data.

To see which pages lead someone to open Bolso on the App Store, the site measures the visit with PostHog, in the European Union region, in cookieless mode.

• This measurement uses no cookies, localStorage or sessionStorage. Cookieless mode alone is not a guarantee of anonymity.
• No session replay, no advertising identifier and no automatic capture of clicks.
• We do not collect a name, an email, an account, or anything you type into the calculators. Those sums run in your browser and the figures never leave it.
• What is recorded is small: the page viewed, an interaction with part of the site (a tab, the screen carousel, opening a table) and a click on an App Store link. That click is not an install — if an install happens, only Apple knows.
• Without cookies, PostHog computes a hash on its servers using the IP address, browser user agent, hostname, project and a random value that changes daily. This identifier can associate events within the same day; we treat it as pseudonymous, without guaranteeing anonymity or absence of correlation. The provider receives IP and user agent for that calculation. We do not claim that no infrastructure component retains them or specify a retention period that has not been confirmed.
• Requests from the site go to getbolso.com/ingest, on the site's own domain, and from there to PostHog in the EU.
• This measurement is not integrated into the app. The app still has no analytics, as section 6 describes.

For a question about this measurement: privacy@getbolso.com.