Reshta Get the app

Privacy policy

Last updated: 1 October 2026

The short version. Without an account, your records stay on your device. With an account and Reshta Pro, they also sync through my server in Ireland, so they reach your other devices. No ads, no tracking, no analytics, and I never sell your data. You can export or delete everything at any time.

1. Who I am

Reshta is made and run by one person, Mykyta Soloviov, based in the United States. Every privacy question or request goes to [email protected].

2. What I collect

On your device

Your categories, transactions and tags are stored in a database on your device and, like other app data, are included in your device's iCloud or computer backups. Settings such as display currency, time zone and theme are never sent to my server. App Lock asks iOS to check Face ID, Touch ID or your passcode; Reshta never sees them. Without an account, the app's only contact with my server is downloading exchange rates.

Your account

An account is optional; you need one only to sync. It holds your email address (and a new one you asked to switch to, until you confirm it), your password as a one-way hash that can't be reversed, an account ID, when you last signed in, and the account's status. On your device, sign-in tokens are kept in the iOS Keychain, which never syncs them to iCloud or moves them to another device.

Sync

While you're signed in with an active Pro subscription, your categories, transactions (amounts, notes, dates and tags) and tags are uploaded to my server and sent to your other signed-in devices. Without Pro, nothing you enter is uploaded. For sync to work, the server also keeps a random ID for each device's database, and short notes about changes it couldn't accept, which are deleted after 30 days.

Logs and error reports

Every request to my server, from the app or this website, is logged with your IP address, device and app or browser details, the address requested and the time. A few log lines also hold your account ID, or your email address if an email to you fails to send. When something fails on the server, an error report goes to Sentry with technical details and possibly your account ID. Request contents are never included, and email addresses are masked.

Apple

Apple handles Pro payments, so I never see your card or billing details. The app asks Apple, on your device, whether you have Pro, and never sends the answer to my server. If you turned on “Share With App Developers” (Settings › Privacy & Security › Analytics & Improvements), Apple also sends me crash reports and usage statistics that don't identify you.

What I never collect

Reshta never connects to your bank or asks for bank details, and never accesses your location, contacts, photos, camera or microphone. It uses no advertising or tracking identifiers, and this website sets no cookies of its own.

3. Why I use it

  • To provide Reshta — your account, sync, and the emails that verify your address or reset your password. I never send marketing email.
  • To keep it secure and working — logs, rate limits and error reports.

Under the GDPR, the first is needed to provide the service you asked for, and the second is my legitimate interest. I don't sell your data, use it for advertising, or profile you.

4. Who handles it, and where

Only these providers, each only as far as its job needs. All but Apple are bound by data processing terms to protect it.

  • Amazon Web Services, Ireland — the server, database and backups.
  • Cloudflare — carries all traffic to the server and this website and filters attacks, so it sees your IP address and requests. It may set one strictly necessary security cookie.
  • Mailgun (Sinch), EU — sends the verification and password-reset emails.
  • Sentry, EU (Germany) — stores server error reports.
  • Apple — distributes the app and handles payments, under its own privacy policy.

I maintain the server from the United States. Cloudflare, Sentry and Apple operate worldwide; where they move EEA or UK data elsewhere, their terms protect it with Standard Contractual Clauses or the EU–US Data Privacy Framework.

5. How long it's kept, and deleting it

  • On your device — until you delete it. Signing out, deleting your account and deleting the app all remove your records from the device (your own device backups aside).
  • On my server — your account and synced records, until you delete them. Notes about rejected changes, 30 days. Logs are deleted automatically as newer ones replace them.
  • Backups — hourly database backups for 30 days, daily disk snapshots for 7 days.

Menu › Data › Delete All Data deletes your records from the device and, if you're signed in, from your account, which stays. Menu › Profile › Delete Account deletes the account and everything in it from my server and signs you out everywhere. Both take effect at once and can't be undone; copies in backups and in the sync service's storage are erased within 30 days. Deleting your account doesn't cancel Pro: cancel it with Apple.

6. How it's protected

  • Encrypted connections between your device and my server; the database and its backups are stored encrypted.
  • Passwords stored only as bcrypt hashes; sign-in sessions that expire and can be revoked; rate limits against abuse.
  • Each account can reach only its own records, both through the server and through sync.
  • Files you take out of the app aren't covered. An export is plain CSV that anyone who opens it can read. A backup file is encrypted, but anyone who has it can restore it in Reshta, so keep both safe.

7. Your rights, and changes

You can see, change, export and delete your data in the app at any time, or email me to do it for you. If you're in the EEA or UK, you also have the right to access, correct, delete, restrict, object to the use of and take a copy of your data, and to complain to your data protection authority.

When this policy changes, the date at the top changes too. Questions go to [email protected].