Last updated: April 3, 2026
This Privacy Policy describes how forvalt ("we", "us", "the App") collects, uses, stores, and protects your personal data. forvalt is a financial planning tool delivered as a Telegram Mini App.
forvalt is operated as an independent project. For privacy-related inquiries, contact us via the Telegram bot @forvalt_bot using the /support command.
When you open the App through Telegram, we receive the following from the Telegram Mini App API:
We do not access your phone number, contacts, or message history.
We process your personal data under the following legal bases (GDPR Article 6):
| Processing activity | Lawful basis |
|---|---|
| Financial planning and projections | Contract — necessary to provide the core service you signed up for |
| Syncing data across devices | Contract — necessary to deliver the service |
| AI financial advisor | Consent — initiated only when you explicitly use the feature; data sent to Groq (US) only upon your action |
| Payment processing (Stripe) | Contract — necessary to process your Premium subscription |
| Product analytics (anonymous aggregates) | Legitimate interest — improving the App. You can opt out via Profile → Data & Privacy → Analytics. We use only bucketed, non-identifiable values. |
| Customer support | Legitimate interest — responding to your support requests |
| Cross-border transfers (Belarus users) | Explicit consent — collected during onboarding as required by Law No. 99-З |
| Purpose | Data used |
|---|---|
| Financial planning and projections | Date of birth, income, expenses, goals, assets |
| Syncing data across devices | Full app state (linked to Telegram ID) |
| AI financial advisor | Financial snapshot + your questions (sent to Groq) |
| Payment processing | Telegram ID and username (sent to Stripe) |
| Product analytics | Anonymous aggregate counters and session data |
| Customer support | Telegram name and messages sent via /bug or /support |
Your financial data is stored in your browser's localStorage. This data persists until you clear your browser data or delete it through the App.
| Service | Location | Data stored | Retention |
|---|---|---|---|
| Supabase (PostgreSQL) | EU | Encrypted app state (AES-256-GCM), subscription records | Until user requests deletion |
| Redis Cloud | EU (Frankfurt) | Anonymous aggregate counters, session flags | Analytics: 48 hours. User metadata: until deletion request |
All administrative actions (e.g., granting premium, sending messages, banning users) are logged in an append-only audit table. These logs contain the admin's Telegram ID, the action performed, the target user ID, and a timestamp. Audit logs are retained for 7 years for regulatory compliance and dispute resolution, after which they are permanently deleted.
We share data with the following third-party services:
| Service | Country | What is shared | When | DPA status |
|---|---|---|---|---|
| Groq (AI processing) | United States | Financial snapshot (income, expenses, goals, assets) and your questions | Only when you use the AI advisor | Groq processes data per their Privacy Policy. Data is not retained after processing. |
| Stripe (payments) | United States | Telegram ID, username, subscription plan | Only when you subscribe to Premium | Stripe operates under their Privacy Policy and Data Processing Addendum |
| Supabase (database) | EU | Encrypted app state | On every sync | Supabase operates under their Privacy Policy and DPA |
| Redis Cloud (cache) | EU (Frankfurt) | Anonymous counters, session flags | On app open | Redis operates under their Privacy Policy |
| Telegram Bot API | Global | Messages, notifications | When you interact with the bot | Telegram's Privacy Policy applies |
We do not share data with advertising networks, data brokers, or social media platforms.
Your data may be transferred to and processed in countries outside your country of residence, including the United States (Groq, Stripe) and the European Union (Supabase, Redis). These transfers are necessary to provide the App's functionality.
For EU/EEA users, transfers to the US are covered by the service providers' Standard Contractual Clauses (SCCs) and Data Processing Agreements.
For users in Belarus, cross-border transfers are performed only with your explicit consent, obtained during the onboarding process, as required by Law No. 99-З "On Personal Data Protection".
In accordance with Law No. 99-З, you additionally have the right to:
/support.Belarus-specific restrictions:
Online payment via Stripe is not available for users in Belarus. Premium can only be activated through direct contact with the administrator.
We do not send marketing communications or track individual usage for Belarus users who have not given consent.
When you request deletion (Profile → Data & Privacy → "Delete all my data"), we permanently remove:
Aggregate, anonymized analytics counters (total opens, total goals created, etc.) are not deleted as they cannot be linked back to you.
Admin audit log entries referencing your Telegram ID are retained for the audit log retention period (7 years) for regulatory compliance, but contain no financial data.
In the event of a personal data breach that poses a risk to your rights and freedoms:
Our full breach response procedure is documented at breach-notification.html.
forvalt is not intended for users under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us via /support.
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the App after changes constitutes acceptance of the updated policy.
For any privacy-related questions, data access requests, or deletion requests:
/supportSee also: Terms of Service · Data Protection Impact Assessment