Privacy Policy

Cento, by Funcode SRL · Effective date: 9 October 2026

This Privacy Policy explains how Funcode SRL ("we", "us") processes personal data in the Cento mobile application ("Cento", "the app"). We are the data controller.

1. Who we are

Funcode SRL, Eugen Ionescu, Cluj-Napoca, Romania. Fiscal code (CUI/CIF): RO31945144 · Trade Register no.: J12/2104/01.07.2013. Contact for privacy questions and data-subject requests: contact@funcode.ro.

2. Local-first by design

Cento's expense tracking works offline and without an account. Your expenses, categories, people, budgets, trips and projects are stored on your device and are uploaded only if you sign in, have Premium and share a household. Some features still contact our servers or other services, a few even without signing in: AI features (receipt scanning, AI spreadsheet import, Ask Cento questions and the automatic translation of category names, each when you use it, and Premium product labelling, which runs on its own), the Premium screen, and exchange rates for other currencies. Each is described in section 3. Optional analytics runs only if you turn it on.

3. What we collect and why

• Account identity: when you sign in with Google, we receive your email address and display name through Firebase Authentication, to identify your account. On iPhone and iPad you can also sign in with Apple; we then receive the email address Apple shares with us, which may be a private relay address, and we do not store your name.
• Anonymous identity for AI features and the Premium screen: if you use AI receipt scanning or AI spreadsheet import without signing in, or open the Premium screen, we create an anonymous Firebase Authentication identity (no email, no name) with a random pseudonymous ID. It is used to count your AI scans against the limits that apply to them (a lifetime total on the free tier and a daily ceiling for every account) and so that the aggregate Premium-screen counts below can be written. If you later sign in, it becomes part of your account and keeps its scan count. It is currently not deleted automatically: it stays on our servers, with its scan count, after you stop using the app.
• Anonymous Premium-screen counts: each time the Premium screen is opened, we add one to running totals of what happens on it: which feature it was opened from, whether the prices loaded, which plan is tapped, whether you were asked to sign in and whether you did, whether a purchase was started, cancelled, failed or completed (and whether it was a free trial or paid), whether "Restore purchases" or "Join a household" was tapped, how the screen was closed, and roughly how long it stayed open (in ranges: under 5 seconds, 5 to 15, 15 to 30, 30 to 60, or longer). The totals are kept per calendar day (UTC). From app version 1.4.1 they are kept separately for Android and iOS; before that, only the Android app recorded them. They contain no account, device or advertising identifier and no time of day, so they cannot be traced back to you or to any single visit. We use them to see where people give up on the Premium screen and to improve it. They are kept for 400 days and then deleted automatically.
• Household data: when you share a household, it holds a name you choose for yourself (stored instead of your email) so members can tell entries apart, the household's name and currency, and whether a Household plan covers its members. All members can see these.
• Financial data: your expenses (item names, amounts, dates, stores, people and the labels you add), categories and category groups, people, CresCENTO transfers, budgets, trips and projects. They are synced to the cloud only when you have Premium (yours or your household's plan) and share a household.
• AI processing with Google Gemini, only for these features (each runs when you use it, except product labelling, which runs on its own with Premium):
  • Receipt scanning: the photo of the receipt and the names of your active categories (including ones you created), so the items can be sorted into them, plus the labels used on your expenses (and, in a shared household, on the household's expenses) and the app's language, so the receipt can be given one of those labels. Labels are free text written by you or the people in your household, so they can include names, for example "rechizite Ana".
  • AI spreadsheet import (Premium): the contents of the spreadsheet you choose, which can include amounts, dates, store names and people's names.
  • Ask Cento (Premium): the question you type or dictate and your device's current date, so the question can be turned into a search. The search itself runs on your device, where it also uses the stored product labels to recognise kinds such as fruit or bags: your expenses, amounts and store names are not sent.
  • Product labelling (Premium): once you have Premium, this runs automatically in the background, including for expenses you already have. It sends the names of your items (in batches, without repeats within a request), without amounts, dates, stores or people, so each can be labelled with the kind of product it is (for example fruit, dairy or a bag). The labels are stored with your expenses: on your device, in your household's synced copy if you share one, in your backups and in the CSV export. You can see and change an item's kind when you edit the expense. Receipt scans add the label from the receipt itself, so nothing extra is sent for them.
  • Category translation: the name of a category or group you create, so it can be shown in the app's other languages, together with the names of your other categories and groups, so the translation does not repeat one of them.
  The content is processed by Google in the European Union (Frankfurt, Germany) to return the result, and is not stored on our servers.
• Dictation in the Moments search: if you tap the microphone in the Moments search, your speech is turned into text by your phone's own speech recognition, on the device. The audio is not sent to us, to Google, to Apple or to anyone else, and it is not stored. The text only fills the search field, and is sent nowhere unless you then tap the Ask Cento button (✨). The microphone permission is used for nothing else.
• Exchange rates: to convert between currencies, the app downloads public exchange rates from the jsDelivr content delivery network. No account or expense data is sent, but like any website, jsDelivr receives your device's IP address, and the date when a past rate is requested.
• Subscriptions: on Android you subscribe through Google Play Billing, on iPhone and iPad through Apple's App Store. We receive and store the purchase token (Android) or transaction ID (iOS), the product, plan, expiry date and whether it renews automatically, and we verify them with Google or Apple to unlock Premium. We also keep AI usage counters (a lifetime scan total, a per-day scan count, a per-day count of Ask Cento questions and the number of item names labelled per day) to apply plan limits.
• Feedback you send: if you use the in-app feedback form, your message, the reply address you enter (if any), and a short diagnostic footer (app version and build, device model and operating system, app language and currency, and basic account status such as your plan, household mode and household identifier) are placed into an email that you review and send to us from your own email app, to help us reproduce and fix issues. You can edit or remove any of it before sending.
• Analytics & marketing measurement (optional, off until you turn it on, off again any time in Settings): while this is on, we use Google Analytics for Firebase to collect pseudonymous product-usage events, linked to a random analytics identifier rather than to your account, and to measure and improve our advertising, which can include Google Ads using this data to show Cento ads to similar people. On Android this uses the Google Play install referrer and the Android advertising ID, which you can reset or delete in your device's Google settings. On iOS no advertising identifier is read and no tracking permission is requested; instead, if you are signed in, Google's SDK matches a hashed form of your email address on your device, and the address itself never leaves it. The events never include what you spend, and no ads are shown in Cento.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Legal bases

• Contract (Art. 6(1)(b) GDPR): your account, household sharing and sync, subscriptions, and the AI features and exchange rates you use.
• Consent (Art. 6(1)(a) GDPR): analytics & marketing measurement, given by turning the option on at first launch or in Settings. You can withdraw it there at any time, which stops collection going forward without affecting what was lawfully processed before.
• Legitimate interests (Art. 6(1)(f) GDPR): the anonymous identity and usage limits that keep AI features affordable and prevent abuse, the anonymous Premium-screen counts that help us improve the app, the diagnostics in feedback you choose to send, and security. You may object as described in section 8.

5. Who processes your data

• Google Firebase: Authentication and Hosting (global Google services), Firestore (in the European Union, multi-region eur3) and Cloud Functions (European Union, europe-west1).
• Google Gemini, through Google Cloud's Vertex AI: the AI processing described in section 3, in the European Union (Frankfurt, Germany).
• Google Play Billing (Android) and Apple's App Store (iOS): subscription purchases and verification.
• Google Analytics for Firebase / Google Ads: analytics and advertising measurement, only if you turn on Analytics & marketing measurement.
• jsDelivr: public exchange rates, as described in section 3.

Your expenses, synced data and AI requests are processed in the European Union. Some of the other processing above (Authentication, Hosting, the optional analytics, app store billing and exchange rates) involves transfers outside the European Union, mainly to the United States. For Google these rely on the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses in Google's data processing terms. Funcode staff can access cloud data only when needed for support, to fix problems, or where the law requires it.

6. How we keep your data secure

We apply technical and organisational measures to protect your data. Inside the app, server-side rules restrict access to cloud data to the members of your own household. Your financial data is stored under a random pseudonymous identifier rather than your account identity or email address, so records in our database are not directly linked to you (pseudonymisation under Art. 32 GDPR). On Android, data on your device is protected by the app sandbox and your device's encryption, and it is not included in device backups. On iPhone and iPad it is protected by the app sandbox and iOS Data Protection, and it is included in your iCloud or computer backups if you use them. We recommend setting a screen lock.

7. Retention

• Cloud data is kept while your account exists. When you delete your account, your server-side data is erased. If you were part of a shared household and other members remain in it, the records you contributed (your expenses, the member name you chose, and any categories or transfers you added) stay with that household so the remaining members keep their shared history; they are erased when the household itself is deleted.
• Leaving a household, or being removed from it, works the same way: your contributions stay with the household, and a household is deleted when its last member leaves. If the household had a Household plan, a record that your place was used, and the date you left, are kept for 90 days.
• After an account is deleted we keep only its pseudonymous ID for 30 days, so it cannot be recreated by mistake. Household invite codes expire after 7 days and are deleted about 30 days after that. Purchase records are kept while your account exists.
• Our server logs, which can contain your pseudonymous ID but not your email or expenses, are kept for 30 days.
• On-device data is removed when you delete the app or its data, and also when you sign out, delete your account or leave a household.
• Analytics events, if you turned analytics on, are kept by Google Analytics for Firebase for up to 14 months and are not linked to your account. Turning analytics off stops new events immediately, erases the analytics data held on your device and resets its analytics identifier, so earlier events cannot be linked to later use. Deleting your account does the same.

8. Your rights

You have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data, and to withdraw any consent you have given. You can delete your account and erase your cloud data directly in the app (Android: Settings → Your account → Delete account; iPhone and iPad: More → your account → Delete account) and withdraw analytics consent in Settings (Android: Privacy & legal; iPhone and iPad: Privacy). For any other request, email contact@funcode.ro. You may also lodge a complaint with the Romanian supervisory authority (ANSPDCP).

9. Children

Cento is not directed at children under 16 and we do not knowingly collect their data.

10. Changes

We update this policy when what the app does changes. Changes are reflected by a new effective date here.