Privacy Policy

This policy explains what Relorum, operated by Tim Afanasiev, collects about you, why, and how it is kept, whether you are on the waitlist or using the product itself. It should be read alongside the Terms of Service.

Waitlist. Just the email address you give us, to notify you when access opens.

Account. First and last name, email address, and a bcrypt-hashed password. Sign-up currently requires a valid invite code, which we check but do not otherwise link to your identity beyond confirming it was used.

Items you track. Whatever you enter yourself: names, categories, prices, cadence, stock levels, and notes for subscriptions, bills, warranties, and consumables.

Bank data, if you connect an account. Account details (IBAN, holder name, currency), balances, and transaction records (amount, date, counterparty, description, merchant category) retrieved through Enable Banking. We only request this if you explicitly start a bank connection.

Session data. A single random session token stored in an HTTP-only cookie so you stay signed in. We store only a one-way hash of that token, not the token itself.

We do not run any analytics or advertising trackers. Vercel Analytics is included in the codebase but is disabled and does not run. We do not use Google Analytics, ad pixels, or cross-site tracking of any kind, and we do not sell or rent your data to anyone.

Bank connections go through Enable Banking, a PSD2-licensed account information service provider — Relorum never sees your online banking credentials, and consent to share data is given directly to your bank through Enable Banking’s flow, for a period of up to 90 days that you choose and can renew. You can revoke that consent at any time from Relorum or directly with your bank; once revoked, we stop pulling new data but the history already imported stays in your account until you delete it or your account.

We use this data only to categorize your spending, match it to items you track, and show it back to you. We never use it to initiate payments or transfers — Enable Banking’s information-only scope makes that impossible even if we wanted to.

To provide the Service you signed up for: running your account, tracking the items and spending you add, matching transactions to the right item, and reminding you before something renews or runs out. We rely on your consent for bank connections specifically, and on the necessity of processing to perform our contract with you for the rest.

Relorum runs on infrastructure we operate directly, backed by a PostgreSQL database, rather than a third-party analytics or no-code platform. Passwords are hashed with bcrypt before storage; session tokens are hashed before storage; bank data is stored only for accounts that have connected a bank.

Enable Banking, as the processor that retrieves bank data on our behalf under your consent, and infrastructure providers we use to host the Service (e.g. hosting and email delivery), bound to process data only on our instructions. We do not share your data with advertisers, data brokers, or anyone else, and we do not sell it.

We keep account and tracked-item data for as long as your account is active, and bank transaction history for as long as it remains useful for the categorization and tracking features it supports, unless you delete it sooner. Deleting your account deletes this data, other than what we are required to retain by law.

If you are in the EU/EEA, the UK, or anywhere with similar protections, you can ask us to access, correct, export, or delete your data, or to restrict or object to how we process it. Send requests to [email protected]. You can also revoke a bank connection at any time, and you can lodge a complaint with your local data protection authority if you believe we have mishandled your data.

Relorum is not directed at children and is not intended for use by anyone under 16.

We may update this policy as the Service changes. If a change is material, we will update the date above and, where practical, let you know in the app or by email.

Questions about this policy, or requests about your data, can be sent to [email protected].