Foreday Privacy Policy

Effective 15 October 2026.

This Privacy Policy explains how Evenstead Software Pty Ltd (“we”, “us” or “our”) handles personal information when you use Foreday and its related account and support services.

Foreday is a budgeting app for people aged 16 and over in Australia and the United States. Personal information means information that identifies you or can reasonably be linked to you.

Current service and launch features

Foreday is in development and is not yet publicly available to download. This policy covers the development service and the features described below as they become available. Sign-in, budget storage and synchronisation, sharing, exports and manual problem reports are available in development builds. Sign-in methods may include email/password, Google and Apple; the methods available to you are shown in your app.

Subscriptions, paid-access recovery and automatic deletion after that recovery period are planned for public launch and are not active in the current development service. The subscription and recovery provisions below apply when those features are activated. In-app account deletion is also planned for public launch; during development, send account and data-deletion requests to support@evensteadsoftware.com. Publishing this policy does not activate these features or start a subscription or recovery clock.

We do not sell your personal information, display advertising in Foreday or use your information for marketing tracking.

Information we collect

The information we collect depends on how you use Foreday.

Account information. Your email address, account identifier, sign-in method, verification status and profile information provided by your sign-in provider, such as your display name. Our authentication provider processes your sign-in credentials. Passwords are not included in budget records or exports.

When you use Google or Apple sign-in, we receive the identity information made available by that provider. This can include a provider identifier, name, email address and verification information. An Apple private relay email address may be used instead of your personal address. Linking a sign-in method associates it with your existing Foreday account; it does not automatically combine different people's accounts or budgets.

Budget information. Information you enter or import, including budget, account and envelope names; balances; income and pay schedules; transactions, payees, amounts and dates; notes; allocations; recurring payments; reconciliation records; and budgeting plans. We also process record identifiers, changes and synchronisation information needed to keep your budgets consistent across devices.

Sharing and invitation information. Budget membership, invitation and join-request details, relevant email addresses, approval status and timestamps. Another person may provide your email address when inviting you to a budget, even if you do not yet have an account. Members may also enter shared records containing information about you.

Purchase information. When you purchase a subscription through Apple or Google, we receive information needed to verify and manage your access, such as purchase identifiers, subscription status, product, expiry, trial and refund information. The app store handles your payment details; we do not receive the complete payment-card details you provide directly to it.

Support information. Your contact details, messages, attachments and correspondence when you ask for help, report a problem or make a privacy request.

In-app problem reports include your description, optional reproduction steps, verified account email, account identifier, app version and platform. Device model and operating-system version are included only when you choose to share them. These reports do not automatically include budget records, logs, screenshots or attachments. Information you type into the report is included.

We use your verified account email for support correspondence and to send a confirmation with your ticket reference. This confirmation does not repeat your report text or budget information.

Technical information. Information processed by our service providers to operate and secure Foreday, including IP addresses, app and platform identifiers, authentication activity and service logs. We explain any additional optional diagnostic collection when it is offered, including the information sent and how to change your choice.

Firebase App Check processes app/device verification information and security tokens to help protect the support service. The current Android app does not include Google Analytics, Firebase Crashlytics or automatic upload of crash logs. Device details in a manual problem report are a separate optional choice.

Foreday does not connect to your bank. Your budget is based on information you provide. Please avoid including bank passwords, full payment-card details, government identity numbers or unnecessary information about other people in budget notes or support messages.

Some descriptions you enter may reveal sensitive information, such as health details. Use only the detail you need. Where applicable, our Consumer Health Data Privacy Notice explains how we handle that information. We obtain additional consent where required by law.

You choose what budget details and optional information to provide. We need certain account information to create and secure your account, and we may be unable to provide a feature or respond to a request without the information necessary for it.

Why we use your information

We use personal information to:

• Create, verify, secure and recover your account.
• Store your budgets, perform calculations and synchronise changes across devices.
• Provide sharing, invitations, reminders, widgets, exports and recovery.
• Verify subscriptions, restore purchases and manage access.
• Respond to support and privacy requests, investigate faults and maintain the service.
• Detect misuse, protect accounts, meet legal obligations and resolve disputes.

We limit our use of information to these purposes and other uses permitted by law or agreed with you. Where an optional use requires consent, we provide a separate choice.

Account verification and subscription access may involve automated checks of account and purchase information. These checks can affect trial eligibility, access and the recovery period described below. Contact us if you believe an access decision is incorrect so that we can review it.

Shared budgets and Only you

Members of a shared budget can access its shared information, including existing shared history. This includes shared account and income-schedule information, along with names or identifiers associated with relevant activity. Being the owner of an account within a shared budget does not make its details private.

Only you restricts other budget members’ access to the records covered by that setting, including access by the budget owner. Those records are still processed by Foreday and its cloud service providers and may be stored on your devices.

Moving money between private and shared areas, or covering an overspend from shared funds, can affect shared amounts. Some activity identifiers and timestamps also remain part of the shared system. Only you does not conceal every effect on the shared budget.

Changing a setting, leaving a budget or removing a member does not recall information someone has already viewed, exported or independently copied. Membership does not give anyone access to another person’s Only you records.

When information is disclosed

We disclose information for the purposes described in this policy, including in the following circumstances.

To service providers. We use Google Firebase and Google Cloud for authentication and cloud budget processing, and Google Workspace for support and privacy-request correspondence. These providers receive the information needed to perform their services, including private budget records where relevant. We require appropriate safeguards from providers processing personal information on our behalf.

We also use Google Cloud to store private support tickets and Resend to send in-app problem reports to our support mailbox and confirmations to your verified account email. Resend receives the report text, reply and confirmation addresses, ticket reference and the app or optional device details included in the report. Budget records are not automatically sent to Resend.

Through features you use. Other budget members and invitation recipients receive information through the sharing features described above. A storage or messaging service you select receives the files or messages you choose to export or send.

For app distribution and subscriptions. Apple and Google process information in connection with app distribution and store purchases. Their own privacy notices explain their handling of information provided directly to them.

For legal and security purposes. We may disclose information where required or permitted by applicable law, to respond to a valid legal request, protect rights or security, or obtain professional advice subject to appropriate confidentiality obligations.

If the business changes. Information may be transferred as part of a lawful business transfer or reorganisation, subject to applicable law, existing privacy commitments and any required notice or consent.

We limit operator access to legitimate support, maintenance, security and legal needs.

Bug reports and development tools

We use Notion to manage issues and feature requests, and AI tools to help investigate bugs. Before copying a report into either service, we remove identifiable customer information and real budget content. These tools receive sanitised examples rather than customer emails, actual financial records, identifiable screenshots or account credentials.

GitHub hosts our source code. Customer budget records, support attachments and credentials are excluded from repository commits.

Please send only the information needed to explain a problem. A full budget export is not required for an ordinary bug report.

International processing

Our cloud budget database is hosted in Sydney, Australia. Firebase Authentication processes information in the United States.

Support tickets are stored in Sydney. Resend stores email and log data in the United States; its Tokyo sending region does not mean that report data is stored in Japan.

Information may also be processed in other countries where our service providers operate, subject to the arrangements for the relevant service. This includes overseas processing of support correspondence. A database location in Australia does not mean that all information remains in Australia.

We assess the safeguards that apply to overseas handling and take the steps required by applicable privacy law.

Protecting your information

We use technical and organisational measures appropriate to the information we handle, including authenticated access and separate access rules for shared and private cloud records. Our Firebase services use encryption in transit and at rest. Only you is an access restriction between budget members; it is not end-to-end encryption.

Local copies support offline use and recovery. Exported JSON files can contain your own private budget information and are not encrypted by Foreday’s export feature. Protect your devices and choose appropriate storage for exports.

Widgets and reminders may display budget information. You can manage their visibility through Foreday and your device settings.

No storage or transmission method is completely secure. Contact us if you suspect unauthorised access to your information.

How long we keep information

The paid-access row below describes the planned subscription service. During development, budgets do not expire because a subscription ends, and there is no automatic 30-day account or budget-deletion timer.

We retain personal information for as long as it is needed for the purposes described in this policy, including providing the service, meeting legal requirements and addressing a specific security or legal need. We delete or de-identify information when it is no longer needed.

The following rules apply:

Closing a budget or deleting an entry in the app is not a complete erasure request. Cloud records can retain deletion markers, previous record content, operation receipts and history needed for sync and recovery. Local recovery snapshots and independently saved backups can also retain earlier information. These records do not currently have a general automatic expiry schedule. Contact us to request erasure rather than relying on a budget being closed, an entry disappearing from view or an app being uninstalled.

Support-ticket expiry is scheduled when a report is resolved; automatic database cleanup follows that timestamp and may not be immediate. Resolving tickets and removing corresponding support-mailbox copies are manual operator steps. Our 12-month support schedule is separate from any provider's retention.

Keeping a record for a legal or security purpose does not justify retaining your entire personal budget. Retention of shared records does not override a legal right requiring deletion, including applicable health-data rights.

Our support-ticket and mailbox retention is separate from Resend's provider retention. Resend states that email and log data is retained for 30 days and backups for seven days. See Resend's security information. We include relevant service-provider copies when handling deletion requests.

Deleting your account

At public launch, you will be able to initiate account deletion in Foreday or contact support@evensteadsoftware.com if you no longer have access to the app. In-app account deletion is not yet available in the development service. You can request deletion now by following our account and data-deletion instructions or emailing us. You do not need an active paid subscription to request deletion.

We verify your request, explain its effect and timing, and coordinate deletion of your account and relevant records across your budgets, including budgets you have left or closed. An explicit account-deletion request is handled promptly and is not automatically held for the 30-day subscription recovery period.

Requests currently require manual review and action; there is no automated end-to-end account erasure service. We will identify relevant account, budget, invitation and support records, explain any necessary retention or shared-record treatment, and confirm the outcome. Another member's private information is not provided to you as part of this process.

Provider backups and recovery systems may take additional time to erase information. We distinguish removal from the active service from final backup deletion and comply with applicable deadlines. For example, Firebase’s published authentication deletion process can take up to 180 days after deletion is initiated. This is separate from Foreday’s recovery period and does not describe every provider’s retention schedule. See Firebase’s privacy information.

Signing out, uninstalling Foreday, leaving or closing a budget, cancelling a subscription and deleting an account are separate actions. Follow the app store’s instructions to manage or cancel your subscription.

Account deletion does not recall independently saved exports or screenshots. Disconnected devices cannot receive new cleanup instructions until they reconnect. These limitations do not remove our obligations to delete information under our control or notify recipients where required by law.

Your choices and rights

You can choose what budget information to enter, which budgets to share, which eligible records to mark Only you, and whether to use reminders, widgets or exports.

Contact Support@EvensteadSoftware.com to request access to your personal information, correction, a usable copy or deletion, or to raise a privacy complaint. Your in-app export may not include all account, invitation or support information covered by an access request.

Depending on the law that applies, you may also have rights to withdraw consent, obtain information about recipients, use an authorised agent, object to certain processing or automated decisions, or appeal a decision about your request.

We verify identity proportionately and protect information belonging to other people. We respond within the applicable legal timeframe and explain any permitted extension or refusal. We do not unlawfully discriminate against you for exercising a privacy right.

To appeal a refusal, reply to our decision or email us and request a privacy appeal. We will review the decision and explain the outcome and any available regulator complaint route. You may also contact the Office of the Australian Information Commissioner, where it has jurisdiction, or the relevant US state privacy regulator or attorney general.

Advertising and tracking choices

We do not sell personal information or share it for cross-context behavioural advertising. We do not use Foreday to track your activity across other companies’ websites or apps for marketing, or allow advertising providers to collect information through Foreday for that purpose.

Browser Do Not Track signals do not change these practices. Where applicable law requires us to recognise another privacy preference signal, we honour it.

Younger users

Foreday is intended for people aged 16 and over. If you believe an account belongs to someone younger than 16, please contact us. We will take appropriate steps to restrict use and delete information as required by law.

The development app does not currently collect a date of birth or automatically verify age. The intended minimum age is not a claim that every account has passed an age check.

For users aged 16 or 17, we limit processing to the requested service and other permitted purposes, obtaining additional consent where required. Sharing a budget with a parent does not automatically give that person access to Only you information.

Changes to this policy

We update this policy when our practices or legal requirements change. The published policy will show its effective date. For material changes, we provide an appropriate in-app or email notice and obtain any consent required before a new use begins. Continued use does not replace consent where the law requires it.

Website and invitation pages

Our Website Privacy Notice explains Cloudflare hosting, website requests, the fictional website demo and invitation-page handling. Visiting the website does not sign you in to Foreday, connect to your budget or start a subscription.

Contact us

For privacy questions, requests or complaints, contact:

Evenstead Software Pty Ltd

Email: Support@EvensteadSoftware.com