Privacy Policy

1 Data controller (Titolare del Trattamento)

The data controller for the personal data collected through the VolcanoTracker application and the backend service at api.volcanotracker.volcanointeractive.com is:

Given the nature and scale of our data processing activities, we are not required to appoint a Data Protection Officer (DPO) under Article 37 GDPR. For all privacy-related enquiries, please contact us directly at the email address above.

2 What data we collect and why

We collect only the data necessary to provide the VolcanoTracker service. Below is a complete description of every category of personal data we process, together with the purpose and legal basis for each.

All personal data is collected directly from you when you register for or use the service. We do not collect data from third-party sources.

We do not collect location data, contacts, browsing history, IP addresses, device identifiers beyond the anonymous sync UUID, or any other data not listed above.

3 How we use your data

Your data is used exclusively to provide the VolcanoTracker service. Specifically:

• To authenticate you and keep your session secure via encrypted JWT tokens.
• To store and synchronise your financial records across your devices.
• To generate spending analytics, budget progress, and balance history entirely within the app.
• To convert multi-currency balances using exchange rates fetched from a public API (see Section 7).
• To send transactional emails — specifically the email verification message sent when you register — in your device language, using the two-letter language code read from your device at the moment of registration (e.g. it, fr, de). This code is stored in your account record solely for this purpose. We support 20 languages; if your language is not among them, the email is sent in English.
• To send local push notifications on your device when an alert threshold you defined is crossed. These notifications are generated entirely on-device and do not involve any external messaging service.
• To optionally scan receipt photos using the AI Receipt Scanning feature. When you use this feature, your receipt image and the raw text extracted from it are processed entirely on your device and are never transmitted anywhere. Only the final structured transaction (amount, description, date, and category) — identical in form to a transaction you would enter manually — is saved to your account and synced to our server in the usual way. No third-party AI API is involved at any point. The feature requires iOS 26 or later.

We do not use your data for advertising, profiling, behavioural tracking, marketing communications, or any purpose beyond operating the service.

4 Necessity of providing data (Art. 13.2.e)

Providing your name, email address, and password is a contractual requirement necessary to create an account and use the VolcanoTracker service. Without this data, we cannot provide the service.

Financial data (transactions, accounts, budgets) is entered voluntarily by you and is necessary for the app to perform its core function. You are free to add or delete financial data at any time.

There is no statutory obligation to provide any of this data. However, refusing to provide account data means the service cannot be used.

5 Data storage and security

Your data is stored on a secure server operated by Volcano Interactive, hosted within the European Union (AWS eu-south-1, Milan), and protected by the following measures:

• Encryption in transit: All communication between the app and the server uses HTTPS (TLS 1.2+). Data is never transmitted over unencrypted connections.
• Password hashing: Passwords are never stored in plain text. They are hashed using bcrypt with a per-user salt before being stored.
• Token-based authentication: Sessions use short-lived JSON Web Tokens (JWT). Tokens are stored in the device's secure storage (iOS Keychain).
• Offline storage: A local copy of your data is maintained on your device using a SQLite database, enabling offline access.
• Access control: Server access is restricted to authorised personnel only via SSH key authentication. The application process runs under a dedicated unprivileged system user.

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay, as required by GDPR Articles 33–34.

6 International transfers (Art. 13.1.f)

Your personal data is stored and processed exclusively within the European Economic Area (EEA). Our server infrastructure is located in Italy (AWS eu-south-1, Milan).

We do not transfer your personal data to any country outside the EEA. Should this change in the future, we will ensure appropriate safeguards are in place (such as Standard Contractual Clauses or an adequacy decision) and update this policy accordingly.

7 Third parties and recipients (Art. 13.1.e)

VolcanoTracker does not share, sell, rent, or otherwise disclose your personal data to any third party. There are no recipients of your personal data other than Volcano Interactive.

The only external service the backend communicates with is open.er-api.com, a public exchange rate API used to fetch currency conversion rates. This request contains no personal data whatsoever — it is a simple HTTP GET request for a publicly available list of exchange rates.

Infrastructure provider: Our server is hosted on Amazon Web Services (AWS). AWS acts as a data processor under a GDPR-compliant Data Processing Agreement. AWS does not access or process your application data — it only provides the underlying compute and network infrastructure.

We may be required to disclose data to law enforcement or regulatory authorities if compelled by a valid legal order. We will notify you of any such request where legally permitted to do so.

7a AI receipt scanning & on-device processing

VolcanoTracker includes an optional AI Receipt Scanning feature that allows you to photograph a purchase receipt and have the app automatically extract the transaction details (merchant name, amount, date, and category).

The feature works in two stages, both executed locally on your iPhone:

• Text extraction (OCR): Apple's Vision framework reads the text in your receipt image. This processing happens entirely within the iOS system sandbox on your device.
• AI parsing: Apple's Foundation Models framework — a set of on-device language models — interprets the extracted text and produces structured transaction data (amount, description, date, and category). This model runs locally and does not communicate with any external server.

The receipt image and raw OCR text never leave your device and are discarded as soon as the transaction is confirmed. The final transaction record is then synced to our server under the same terms as any other transaction you create — see Section 2 and Section 5 for details on how that data is stored and protected.

You are free to use or not use this feature entirely at your discretion. Declining to use it has no effect on any other functionality of the app.

8 Data retention

We retain your data for as long as your account is active. If you delete your account, all data associated with your account — including your profile, transactions, accounts, budgets, categories, and alerts — is permanently and irreversibly deleted from our servers within 30 days.

You may also delete specific data items (such as individual transactions or accounts) at any time through the app without deleting your account.

Server access logs (which do not contain personal data) may be retained for up to 90 days for security and debugging purposes.

9 Your rights under GDPR

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights regarding your personal data under the General Data Protection Regulation (GDPR) and UK GDPR:

• Right of access (Art. 15): You have the right to request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): You have the right to correct inaccurate personal data. Most data can be corrected directly within the app.
• Right to erasure (Art. 17): You have the right to request the deletion of your personal data. You can delete your account and all associated data at any time.
• Right to restriction of processing (Art. 18): You have the right to request that we restrict the processing of your data in certain circumstances.
• Right to data portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, machine-readable format (JSON). Please contact us to request a data export.
• Right to object (Art. 21): You have the right to object to processing of your personal data. As we do not process your data for marketing or profiling, this right primarily applies to any future processing activities we may introduce.
• Right to withdraw consent (Art. 7.3): Where processing is based on consent, you have the right to withdraw that consent at any time. Currently, our processing is based on contractual necessity (Art. 6.1.b), not consent. Should we introduce any consent-based processing in the future, you will be able to withdraw it at any time without affecting the lawfulness of prior processing.
• Right not to be subject to automated decision-making (Art. 22): VolcanoTracker does not make any automated decisions that produce legal or similarly significant effects on you.

To exercise any of these rights, please contact us at info.volcanotracker@volcanointeractive.com. We will respond within 30 days. If the request is complex, we may extend this period by a further two months, and will inform you accordingly.

If you are not satisfied with our response, you have the right to lodge a complaint with your national data protection supervisory authority. In Italy, this is the Garante per la protezione dei dati personali.

10 Cookies and website tracking

The VolcanoTracker website (volcanotracker.volcanointeractive.com) does not use cookies, local storage, web beacons, analytics services, or any form of browser tracking.

The VolcanoTracker iOS app does not use any third-party analytics SDKs, crash reporting services, or advertising frameworks.

11 Children's privacy

VolcanoTracker is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16 years of age. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will delete it promptly.

12 Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you through the app or by email.

We encourage you to review this policy periodically. Continued use of VolcanoTracker after changes have been posted constitutes your acceptance of the updated policy.

13 Contact us

If you have any questions about this Privacy Policy or how we handle your personal data, or if you wish to exercise any of your rights, please contact the data controller: