Privacy Policy

Effective date and last updated: October 1, 2026

This Privacy Policy explains how BALS DIGITAL SRL processes personal data when you use the Enough: Wealth Planner mobile application (“Enough” or the “App”) and this website, and the rights you have under the EU General Data Protection Regulation (“GDPR”) and other applicable laws.

At a glance

Your financial data stays on your device. Holdings, debts, income, spending, goals, scenarios and settings are stored only on your phone or tablet. We cannot see or access them.
No account and no bank connection. The App never asks for your name, email address or bank login.
No ads, no analytics, no tracking. The App contains no advertising, analytics or crash-reporting tools, does not use the advertising identifier and does not use artificial intelligence services.
One online service. The App contacts RevenueCat, together with Apple or Google, to sell and verify Enough Pro, using a random app user ID and purchase data — never your financial figures.
You are in control. Settings → Delete all data erases everything in the App; uninstalling it removes its data from your device.

1. Who is responsible for your data

The controller of the personal data described in this policy is:

BALS DIGITAL SRL, a Romanian limited liability company (societate cu răspundere limitată)
Registered office: Oradea, Bihor County, Romania
Trade Register no.: J5/16/2024
Fiscal code (CUI): 49356591
Email: [email protected]
Website: balsdigital.com

We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. For all privacy requests, contact us at [email protected].

2. Scope

This policy covers the Enough: Wealth Planner app for iPhone, iPad and Android, the Enough Pro subscription and the website wealthplanner.balsdigital.com. It does not cover third-party services that you use alongside the App — such as the Apple App Store, Google Play or a cloud storage service where you save a backup — which have their own privacy policies.

3. The data we process

3.1 Financial data you enter — stored only on your device

Everything you enter in the App is stored only in the App’s private storage on your device. This includes your holdings and their institutions, values and value history, contributions, deposits and withdrawals, debts, income and spending, categories, goals, scenarios and events, readings (snapshots), exchange rates, target mix, and settings such as your region, currency, inflation and tax rates and, if you enter it, your birth year. The App also keeps a few preferences on the device: whether the app lock and the monthly reminder are on, which suggestions you dismissed, a copy of your subscription status, and the version and date of the Terms of Use you accepted.

This data is not uploaded, synced or shared with us or anyone else. We do not collect, receive or store it, and we cannot access, recover or delete it for you.

If you have turned on device backups (for example iCloud Backup or a computer backup on iPhone or iPad), your operating system may include the App’s data in those backups, under the terms of Apple or of the backup provider. On Android, the App opts out of Android’s automatic cloud backup.

3.2 Backup and export files

When you ask for it, the App creates a backup file (or, with Pro, a CSV export) on your device and opens your device’s share sheet. You decide where the file goes — for example the Files app, a cloud drive, an email or a message to yourself — and that service’s terms and privacy policy then apply. We do not receive the file unless you send it to us. Backup files are not encrypted and contain all your figures, so keep them somewhere you trust. To restore a backup, the App gives you a file picker and can read only the file you select.

3.3 Purchase and subscription data

Enough Pro is sold through the Apple App Store and Google Play. Apple and Google handle the payment as independent controllers under their own privacy policies; we never receive your card or billing details.

To sell, verify and restore Pro, the App uses RevenueCat, Inc., a subscription management service that processes data on our behalf. The App contacts RevenueCat when it starts (if a connection is available), when you open the Pro screen and when you buy or restore a purchase. This happens for all users, including on the free plan, because the App checks at launch whether a Pro subscription is active. RevenueCat receives:

a random, anonymous app user ID created on your device, which is not linked to your name or email address;
the store receipt or purchase token and the related transaction information (products, purchase and expiry dates, renewal and refund status, store, country or region and currency, price);
technical data such as device type, operating system and version, App and software library version, language settings and the time the App was last used, together with the IP address from which the request is sent, which any internet service necessarily receives.

None of your financial figures are ever part of these requests. We can view this subscription information in RevenueCat’s dashboard, but it does not tell us who you are. The App stores a copy of your subscription status on your device so that Pro keeps working offline.

3.4 Device permissions

Face ID, Touch ID or fingerprint (optional). Used only if you turn on the app lock. The check is performed by your device’s operating system; the App only learns whether it succeeded. Your biometric data never leaves your device’s secure hardware and is never accessible to the App or to us. If you do not allow it, the lock is unavailable and everything else works.
Notifications (optional). Used only for the monthly reminder to update your values, if you turn it on. The reminder is a local notification scheduled on the device; no push service or server is involved. If you do not allow notifications, you will not receive reminders.

You can change these permissions at any time in your device settings. The App does not request access to your location, contacts, photos, camera, microphone, calendar, health or motion data, and does not ask to track you.

3.5 Statistics and crash reports from Apple and Google

If you have chosen in your device settings to share analytics or diagnostics with app developers, Apple and Google may provide us with aggregated statistics (such as installs and usage) and crash reports about the App. Apple and Google collect this data under their own privacy policies; we receive it in a form that does not identify you, and we use it only to fix errors and improve the App.

3.6 When you contact us

If you email us, we process your email address, your name if you give it, the content of your message and any attachments, in order to answer you. Emails sent to [email protected] are forwarded by Cloudflare Email Routing to our Gmail mailbox, provided by Google, where they are stored (see section 5). Please do not send backup files or detailed financial information unless it is necessary for your request.

3.7 What we do not collect

No account, name, email address or phone number through the App.
No bank, broker or pension logins, and no data imported from financial institutions.
No location, contacts, photos or other device content.
No analytics, advertising or crash-reporting tools inside the App.
No advertising identifier (IDFA or Android advertising ID) and no tracking across apps or websites.
No artificial intelligence services: all calculations run on your device.
We do not sell or rent personal data.

The App is not designed to process special categories of personal data (Article 9 GDPR), such as health data.

4. Purposes and legal bases

Purpose	Data	Legal basis (GDPR)
Selling, activating, verifying and restoring Enough Pro, and providing the Pro features you paid for	Purchase and subscription data, app user ID, technical data	Performance of a contract — Art. 6(1)(b)
Checking at launch whether a subscription is active, preventing fraud and abuse, keeping purchases secure	App user ID, technical data, IP address	Legitimate interest in offering a working, secure paid feature and preventing fraud — Art. 6(1)(f)
Answering your messages and requests	Contact details, message content	Performance of a contract — Art. 6(1)(b), where your request concerns the App; otherwise our legitimate interest in responding — Art. 6(1)(f)
Fixing errors using aggregated statistics and crash reports from Apple and Google	Aggregated statistics, crash reports	Legitimate interest in a stable, working App — Art. 6(1)(f)
Delivering and securing this website	Server logs	Legitimate interest in operating a secure website — Art. 6(1)(f)
Handling data protection requests, complying with the law and responding to authorities; establishing or defending legal claims	Only what is necessary	Legal obligation — Art. 6(1)(c); legitimate interest in defending our rights — Art. 6(1)(f)

We do not rely on consent for any processing of our own. The biometric and notification permissions are choices you make in your operating system; the related data stays on your device.

5. Who receives your data

RevenueCat, Inc. (United States) — subscription management, as our processor. Privacy policy
Apple (Apple Distribution International Ltd., Ireland, and Apple Inc.) — App Store distribution, payments and developer statistics, as an independent controller. Privacy policy
Google (Google Ireland Limited and Google LLC) — Google Play distribution, payments and developer statistics, as an independent controller. Privacy policy
Cloudflare, Inc. (United States) — DNS, hosting, content delivery and security for this website, and routing of emails sent to our address (Cloudflare Email Routing), as our processor. Privacy policy
Google (Google Ireland Limited, Ireland, and Google LLC, United States) — the Gmail mailbox in which the emails you send us are received and stored, as our processor. Privacy policy

We may also disclose personal data to professional advisers bound by confidentiality, to public authorities or courts when the law requires it, and to a successor in the event of a merger, acquisition or sale of all or part of our business, who must continue to protect it as described here. We do not sell or rent personal data, and we do not share it for advertising.

6. International transfers

RevenueCat and Cloudflare are based in the United States, Google processes the Gmail mailbox through Google LLC in the United States, and Apple and Google may also process data outside the European Economic Area. Where personal data is transferred outside the EEA, we rely on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework for certified recipients and/or on the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for more information about these safeguards.

7. How long we keep data

Data in the App: on your device until you delete it (Settings → Delete all data) or uninstall the App. We hold no copy.
Backup and export files: wherever you saved them, until you delete them.
Subscription data at RevenueCat: for as long as needed to provide and restore your subscription, and for up to 3 years after it ends (the general limitation period under Romanian law) to handle refunds, disputes and legal claims. It is then deleted or anonymised, unless you ask us to delete it earlier (see section 10). Apple and Google keep purchase records under their own policies.
Emails (in our Gmail mailbox): up to 3 years after our last exchange, unless a longer period is needed to establish or defend legal claims or is required by law.
Website server logs: for short periods under Cloudflare’s standard log retention. We do not use them to profile visitors.

8. Security

We use reasonable technical and organisational measures appropriate to the limited data we process. The App never transmits your financial data, and its connections to RevenueCat and the app stores are encrypted (HTTPS). Data on your device is protected by the operating system’s app sandbox and device encryption, which depend on you setting a device passcode. The App does not add its own encryption: the app lock guards the screen, not the stored data. No method of storage or transmission is 100% secure. You are responsible for the security of your device and of any backup files you create.

9. Your rights

Under the GDPR, you have the right to:

access the personal data we hold about you and receive a copy;
have inaccurate data corrected (rectification);
have your data deleted (erasure);
restrict processing;
receive your data in a portable format (portability);
object to processing based on our legitimate interests;
withdraw consent at any time, where processing is based on consent; and
not be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not make such decisions: the App’s calculations run on your device and have no legal effect.

To exercise your rights, email [email protected]. We will reply within one month; this may be extended by two further months for complex or numerous requests, in which case we will tell you (Article 12(3) GDPR). Requests are free unless they are manifestly unfounded or excessive. Because we do not know who our users are, we may need information to find your records, such as the order number from your Apple or Google receipt, and we may need to verify your identity. If we cannot identify you, we may be unable to act on the request (Article 11 GDPR).

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work. In Romania, this is the National Supervisory Authority for Personal Data Processing (ANSPDCP — Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), B-dul G-ral Gheorghe Magheru nr. 28-30, Sector 1, 010336 București, România, [email protected], www.dataprotection.ro.

10. How to delete your data

The App has no account, so there is no account to delete. You can delete your data as follows:

Everything in the App: open Settings → Delete all data and confirm. This permanently erases all the data stored by the App on that device. It cannot be undone, so export a backup first if you may need it.
Uninstall the App: this removes the App’s data, including the saved subscription status, from your device. Delete any device backups that contain it through your operating system or backup provider.
Backup and export files: delete them from wherever you saved them.
Subscription data held by RevenueCat: email [email protected] with the subject “Delete my data” and the order number from your Apple or Google receipt. We will delete the record within one month. Deleting it does not cancel your subscription, so cancel it in your store account settings first. If you later restore purchases, a new record is created from your store receipt.
Purchase records held by Apple or Google: manage them through your Apple ID or Google account, under their privacy policies.
Emails: ask us at [email protected] to delete our correspondence with you.

11. Children

The App is not directed to children under 13. Users under 16 (or the age of digital consent in their country) may use it only with the consent of a parent or guardian. We do not knowingly collect personal data from children. If we learn that we have done so without the required consent, we will delete it.

12. This website

This website does not set cookies of its own and does not use analytics, advertising or tracking technologies. It loads no third-party scripts, fonts or embedded content, and it has no forms. The site is hosted and delivered by Cloudflare, which processes standard server logs — such as IP address, date and time, the page requested, the referring page and browser type — to deliver the site and protect it from abuse, based on our legitimate interest (Article 6(1)(f) GDPR). Where needed to protect the site from abuse, Cloudflare may set a strictly necessary security cookie, which does not require consent. Links to the app stores and other websites are governed by those sites’ own policies.

13. Notice for U.S. residents

We do not sell personal information and do not share it for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you. In the last 12 months, the only categories of personal information processed through the App were identifiers (a random app user ID and IP address), commercial information (purchase history) and technical device information, used to provide the Enough Pro subscription. Depending on your state of residence, you may have the right to know, access, correct and delete your personal information, and to not be discriminated against for exercising these rights. To make a request, or to make one through an authorised agent, email [email protected].

14. Changes to this policy

We may update this policy, for example if the App starts handling data differently. The date at the top shows the current version. We will notify material changes in the App or on this website before they take effect.

15. Contact

For any privacy question or request, contact:

BALS DIGITAL SRL, a Romanian limited liability company (societate cu răspundere limitată)
Registered office: Oradea, Bihor County, Romania
Trade Register no.: J5/16/2024
Fiscal code (CUI): 49356591
Email: [email protected]
Website: balsdigital.com