Privacy Policy

Abofence is a free subscription management tool operated by Olgac Dolek, Germany. For the purposes of the EU General Data Protection Regulation (GDPR), we are the controller of the personal data described below. You can reach us at contact@abofence.com.

• Account data: your email address, and a password stored only as a salted Argon2id hash (we never see your password).
• Content you create: subscriptions/expenses (name, category, notes, amount, currency, billing cycle and dates) and their reminders.
• Calendar feed token: a random secret generated only if you enable calendar reminders.
• Session data: a session token (stored hashed) with an expiry date, and the corresponding httpOnly cookie on your device.
• Password reset token: if you request a password reset, a single-use token (stored only as a hash) with a short expiry.
• Technical data: your IP address and basic request metadata in server access logs, used for security and to prevent abuse.

We do not connect to your bank account and we do not collect any payment data.

• To provide the service — creating your account, storing your subscriptions and reminders, and serving your calendar feed. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To keep the service secure — server access logs to detect and prevent abuse. Legal basis: our legitimate interests (Art. 6(1)(f) GDPR).
• To understand usage — cookieless, privacy-friendly analytics on the public site (see section 4). Legal basis: our legitimate interests (Art. 6(1)(f) GDPR).

We do not use your data for advertising, and we do not sell it.

We use only strictly necessary, first-party cookies. We do not use cookies for analytics, advertising or third-party tracking, and we do not track you across other websites.

To understand traffic on the public site, we use Umami Cloud — privacy-friendly, cookieless, EU-hosted analytics. It sets no cookies, does not identify individual visitors, and does not build a profile. Because only essential first-party cookies are used, no cookie consent banner is shown.

• abofence_session — keeps you signed in. Expires after 30 days or when you log out.
• abofence_view — remembers whether you prefer the list or calendar view. Expires after 1 year.

• Hosting: the application and its database run on a server operated by IONOS SE (Germany), which processes data on our behalf under a data processing agreement.
• Currency rates: exchange rates are fetched server-side from European Central Bank data via frankfurter.dev. No personal data is transmitted.
• Transactional email: if you request a password reset, the message is delivered by Resend, Inc. (United States), which processes the recipient address and message content on our behalf under a data processing agreement and the EU–U.S. Data Privacy Framework / Standard Contractual Clauses.
• Analytics: the public site uses Umami Cloud, a cookieless analytics service hosted in the EU (Umami Software, Inc.) under a data processing agreement. It processes aggregate, non-identifying visit data and sets no cookies.
• Calendar apps: if you subscribe to your reminder feed in Google Calendar, Apple Calendar or Outlook, that provider fetches the feed (your reminders) from us when it refreshes the calendar. This is initiated and controlled by you.

Other than the transactional email provider above, we do not transfer your personal data outside the EU/EEA.

• Account and content: kept until you delete the item or delete your account, after which it is removed.
• Sessions: expire after 30 days of inactivity and are deleted on logout.
• Access logs: kept for a short period for security purposes, then rotated and deleted.

Under the GDPR you have the right to access, rectify, erase, restrict, and port your data, and to object to processing. You can export your data and delete your account at any time under Account settings in the app. To exercise any other right, contact us at contact@abofence.com. You also have the right to lodge a complaint with your competent data protection supervisory authority in Germany.

Passwords are hashed with Argon2id, session and calendar tokens are stored hashed, and traffic to the site is encrypted in transit with TLS. We regularly apply updates to the software we run. No system can be guaranteed completely secure, but we work to protect your data.

We may update this policy from time to time. When we do, we will change the “last updated” date at the top of this page.

Olgac Dolek — contact@abofence.com