Nag Budget Privacy Policy

Effective 17 September 2026 · Last updated 8 October 2026

Nag Budget handles spending records you type yourself, and it shows those records to people you choose. So this page lists, item by item, what we take, where it is stored, and who can see it. Anything not listed below is not collected.

If it leaves your device, it is collected. Even content you typed yourself counts as collected once it is stored on our servers. Values that stay inside the app and never reach a server (which tab you last viewed, whether you dismissed a banner) are therefore not in the table below. Those live on the device and disappear when you uninstall the app.

Who runs this

App name	잔소리가계부 (Nag Budget)
Package name	com.zucchini.gonari
Developer and operator	Zucchini (the "Company")
Data protection officer	Jiseong Hong
Contact	zucchini.help@gmail.com · kiniinsight@gmail.com

This policy applies to the Nag Budget app provided by the developer Zucchini. The developer name and contact registered on Google Play are as above.

1. What we collect and where it is stored

Item	When	Where it is stored
Email, name, profile photo URL, unique identifier (uid)	When you sign in with Google	Firebase Authentication
Anonymous identifier (uid)	When you start without signing in	Firebase Authentication
Display name, friend code	Created on first launch; the name can be changed	Cloud Firestore
Expense and income entries (text, amount, category, date, time, the raw line you typed)sensitive	When you type them	Cloud Firestore
Nags (a line left on an entry)	When you type them	Cloud Firestore
Ledger name, member list, invite code, join requests	When you create or join a ledger	Cloud Firestore
Friend list, friend requests	When you request or accept with a friend code	Cloud Firestore
Push notification token	When you allow notifications	Cloud Firestore (inside that ledger document)
List of people you blocked	When you block someone	Cloud Firestore (an area only you can read)
Abuse reports (reporter, subject, reason)note	When you report	Cloud Firestore. See section 8
Usage events (screen views and similar)	Automatically while you use the app	Firebase Analytics
Usage steps (when you first used each screen or feature, and the days you opened the app in your first 14 days)	Automatically while you use the app. Once per step, with no amounts or text	Cloud Firestore (under your account)
Advertising identifier	Automatically. See section 2	Firebase Analytics, Google AdMob
Ad request data (advertising identifier, device and app information, approximate region inferred from IP, ad impressions and clicks)	When ads are on and an ad card appears on screen. See section 2	Google AdMob
Ad privacy consent choice	Before the first ad in regions that require consent (such as the EU)	The device and Google AdMob
Crash reports (stack trace, device model, OS version)	When the app crashes	Firebase Crashlytics

We do not access the camera, location, photo library or contacts, and we do not request those permissions. The app asks for internet access and notifications, the advertising ID permission (AD_ID) used by the ads SDK, and microphone and speech recognition permission, asked only when you turn on Voice input in Labs and tap the mic (6-1).

2. Ads and the advertising identifier

The app may show ads (from 30 September 2026). Ads appear only as a single card below the statistics cards and in the middle of the entry list. There are no ads on the screens where you write or edit entries. Ads are chosen and served by Google AdMob.

Your spending and income entries, nags and budget contents are never used for ads and never sent to AdMob. AdMob only receives the "ad request data" listed in section 1.
AdMob uses the advertising identifier (AD_ID) to choose ads (personalized ads), to limit how often the same ad appears, and to count impressions and clicks. Firebase Analytics also uses it to group usage from the same device.
In regions that require consent, such as the EU, Google's consent form is shown before the first ad. If you do not consent, you get non-personalized ads or no ads.
No ads are shown for the first few days after you sign up.
You can reset or delete the advertising identifier any time in Android Settings, under Privacy and then Ads. Deleting it turns off personalized ads; the app keeps working.
How Google handles advertising data: policies.google.com/technologies/ads

3. About financial information

Expense and income records are financial information and more sensitive than ordinary notes.

We store only the values you type. We do not connect to banks, card issuers or brokerages.
We do not retrieve balances, transaction histories, card numbers or account numbers, and we do not read your text messages or notifications.
There is no payment feature, so we do not take payment details.

4. Who can see your records

This is the heart of the app. It exists to show your records to other people, so you set the audience and the server rules enforce it. Anyone outside that audience is blocked at the rules layer.

Where the record lives	Who can see it
Your personal ledger	You, and friends you accepted
A shared ledger	The approved members of that ledger
A pending join request	The ledger name and member count only. Entries and nags stay hidden.

A friendship requires both sides to accept. Knowing a code is not enough.
Remove a friend and they can no longer see your records.
Leave a shared ledger and you stop seeing what comes after. Entries you already wrote there stay with the ledger.
This scope is enforced by server security rules, not by the app screen. Modifying the app does not make out-of-scope records download.

4-1. When the operator looks at records

Records stored on the server can technically be opened by the operator. So we have set out when that happens and how it is logged.

We do not read contents in the normal course. To check how the service is doing we only count numbers such as sign-ups and the number of entries.
Contents (what you spent on and how much) are opened only in these two cases:
- To investigate and fix an error, such as a line split the wrong way or totals that do not add up
- When you ask us to check as part of a support request
We look only at the records needed for that purpose, and do not copy or keep them elsewhere.
We log the date, the account and the reason each time. On request we will tell you the entries in that log about your account.
Record contents are never used for ads or any other purpose (see section 2).

5. What leaves when a notification is sent

When you record an expense, people in the same ledger get a notification. For that, the app sends only what is needed to compose the notification to a server the Company operates (kiniinsight.com).

What is sent: the ledger identifier, a one-line summary (60 characters at most), the amount, and whether it is an expense or income.
The server checks that you are a member of that ledger and then hands it to the Expo push service.
Income never triggers a notification. This is not an app for announcing earnings, and someone else's income showing up as a notification goes beyond the shared scope.
Turn notifications off and this transmission stops as well. You can do that in device settings at any time.

6. Splitting your line happens on the device

When you type one line such as "lunch gimbap 4500, taxi yesterday 12000", the app splits it into several entries and assigns categories. That processing runs on the device using rules, and no text is sent anywhere for this purpose.

If this interpretation ever moves to an external AI model, we will state here what is sent and tell you inside the app before it happens.

Exception: only for the operator (admin) accounts, a typed line is sent to an external AI model (Anthropic Claude) to test the quality of the split. No other user's text is sent.

6-1. Voice input (Labs, only if you turn it on)

If you turn on Voice input in Labs on your profile and tap the mic in the input field, your phone's speech recognition turns what you say into text while you speak. We do not receive or store the audio. The text only goes into the input field, and it is saved like any other entry only when you tap send.

Speech recognition is handled by your phone's speech service (usually Google on Android), and the audio may be sent to that service to do it. That processing follows that service's privacy policy. Turn Voice input off in Labs to stop using the microphone.

7. Third parties and processors

Recipient	What	Why
Google (Firebase Authentication)	Account details, unique identifier	Sign-in
Google (Cloud Firestore)	All records, ledgers, friends, push tokens	Storage and sharing
Google (Firebase Analytics)	Usage events, advertising identifier	Usage analysis
Google (Firebase Crashlytics)	Crash reports	Crash tracking
Google (AdMob)	Ad request data, advertising identifier, consent choice	Showing and measuring ads
Expo (Expo Push)	Push tokens, notification text	Notification delivery
Vercel	The server those notification requests pass through	Server operation
Your phone's speech recognition service (Android: usually Google)	Audio while you speak with Voice input on	Turning speech into text. The audio never reaches us

We do not sell personal data. The only data that goes out for ads is the AdMob row above; your entries do not. Cloud Firestore is hosted in a United States region, so records are stored outside the Republic of Korea.

8. Retention and deletion

Records are kept until you delete them. We do not auto-delete on a schedule.
Deleting a record removes it immediately.
Deleting a ledger removes its entries, nags and invite code with it.
Closing your account deletes the account and your personal records. The procedure is on the Delete My Data page.
Where the law requires retention, we follow that period.

9. Your rights

Access and correction: available in the app at any time. Tap an entry to edit or delete it.
Changing the audience: narrow it any time by removing a friend or leaving a ledger.
Account closure: do it yourself in the app under profile, then delete account. It shows what will go before it goes. The Delete My Data page describes the same steps.
Withdrawing permission: notification permission can be turned off in device settings. Only notifications stop; everything else keeps working.
For anything the steps above do not cover, write to the contact below.

A warning about starting without signing in. Records written that way are still stored on the server, tied to an anonymous account held on the device. Uninstall the app or change devices and that account, and its records, cannot be recovered. Linking a Google account in your profile carries the records at that moment over to that account.

9-1. Abuse reports are handled separately

Reports are not deleted. A report names both the reporter and the reported person, so if either side could delete it, reporting would be useless. Server rules stop both parties from reading or deleting one, and a report survives account closure.

The only purpose is handling harassment. We use them for nothing else.
A report contains the identifiers of both people, the reason, and the reported text.

10. Security

Every record is restricted to the audience described in section 4 by server security rules.
Traffic between the app and the server is encrypted (HTTPS).
A notification request is only processed after the server confirms the requester is a member of that ledger.
An invite code can be looked up only by someone who already knows it; the collection of codes cannot be enumerated.

11. Children

The service is not directed at children under 14, and we do not knowingly collect their personal data. If we learn of such a case we delete it without delay.

12. Contact

Data protection officer: Jiseong Hong
Email: zucchini.help@gmail.com · kiniinsight@gmail.com

For a complaint or consultation about a privacy violation in the Republic of Korea, you may contact:

Personal Information Infringement Report Center (privacy.kisa.or.kr / 118)
Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972)
Supreme Prosecutors Office Cyber Investigation Division (spo.go.kr / 1301)
National Police Agency Cyber Bureau (ecrm.police.go.kr / 182)

13. Changes

When this policy changes we publish it here with an effective date. Material changes, such as new collected items or a new third party, are also announced inside the app.