Privacy Policy

Who we are

Mosa was created and is managed by BT SOFTWARE LTDA, Brazilian corporate taxpayer ID (CNPJ) 35.817.526/0001-43, with business address at Rua Elio del Chiaro, 355, São José dos Campos - SP. For privacy requests and data subject rights, email [email protected].

Data we collect

• Account: name, email, password (stored only as a one-way hash that even we can't read), preferred language, time zone and theme.
• Finances you enter: entries (amount, date, description, category, payment method, merchant), budgets, recurring bills and installments. Mosa does not connect to banks and never asks for bank passwords.
• Household: household name, currency, members and invitations sent (including the invitee's email).
• Devices and access: device model or browser, operating system, IP address, sign-in date and time, active sessions and the device's push notification token.
• Notifications: notifications generated for you and your channel preferences.

We do not collect biometric data: Face ID and fingerprint are checked by your phone, and Mosa only receives the system's "confirmed" answer. Receipt reading (OCR) also happens on your phone; the photo is not sent to our servers.

How we use it

• To create and maintain your account and household and show your numbers.
• To send required emails: email confirmation, password reset, invitations and security alerts.
• To send notifications and summaries you can turn off anytime in Settings.
• To prevent fraud and abuse: sign-in rate limits, account blocking and access logs.
• For support, operations and improving the service.

We do not sell your data, show ads or use your financial data for advertising.

Access by the Mosa team

To provide support, investigate issues and keep the service secure, Mosa's administrative team can view account data, including entries and budgets. Access is limited to very few people, requires two-step verification, and every view is recorded in an audit log showing who accessed what and when.

Who we share it with

We use providers that process data on our behalf, under contract and only to deliver the service:

• Railway — application and database hosting (United States).
• Resend — transactional email delivery (United States).
• Google Firebase Cloud Messaging and Apple Push Notification service — mobile notifications.
• Browser push services (Google, Mozilla, Apple, Microsoft) — web notifications, if you turn them on.
• The contact mailbox provider, when it receives messages sent to [email protected].

Members of the same household see each other's entries, budgets and names. We may also share data when required by law or by a competent authority.

International transfers

Some providers are located outside your country. In those cases we rely on appropriate safeguards, such as contractual clauses and providers with adequate protection standards.

How long we keep it

• Account and household data: for as long as the account exists.
• When you delete your account: the account is removed; some records may be retained for legal or security reasons. If you are the only member of the household, its entries, budgets and categories are erased too. Backups may remain for a limited period under the hosting provider retention policy.
• Technical access records: for the period needed for security and applicable legal obligations.
• Audit logs are retained for security and legal obligations.

Your rights

Under Brazil's LGPD (article 18), you can: confirm whether we process your data; access and get a copy; correct it; request anonymization, restriction or deletion; port it; learn who we share it with; and withdraw consent.

You can do much of this yourself: edit your profile in Settings, export your entries as CSV on the web portal and delete your account under Settings › Delete my account. For anything else, write to [email protected]. You may also complain to the Brazilian data protection authority (ANPD).

Security

We use encrypted connections (HTTPS) for all traffic, hashed passwords, expiring sessions, lockout after failed attempts, two-step verification for administrators and isolation of each household's data. No system is 100% secure; if an incident puts you at risk, we will notify you and the authorities as required by law.

Cookies and local storage

The web portal uses a single essential cookie that keeps you signed in securely, and stores your chosen theme and language in the browser. We do not use advertising or third-party tracking cookies.

Children

Mosa is intended for people aged 18 and over. Minors should only use it with a parent or legal guardian, within a household created by them.

Changes to this policy

We may update this policy. If a change is significant, we will let you know in the app, on the web portal or by email before it takes effect.