Svodly Privacy Policy

This English translation is provided for convenience only. The Russian version at https://svodly.ru/legal/privacy is the legally binding text and prevails in case of any discrepancy.

1. General provisions

1.1. This Privacy Policy (hereinafter, the “Policy”) describes what personal data the Operator processes in connection with the use of the Svodly software, the Svodly cloud service (api.svodly.ru), the web application (app.svodly.ru), the marketing website (svodly.ru), the documentation website (docs.svodly.ru), the automatic update service (updates.svodly.ru) and related services.

1.2. The Policy has been drawn up in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (hereinafter, “Law 152-FZ”).

1.3. Personal data operator:

• Individual Entrepreneur Denis Vladimirovich Alekhin (IE Alekhin D. V.).
• OGRNIP (primary state registration number of an individual entrepreneur): 326774600408601; TIN (INN): 502480379785.
• Contact for personal data processing matters: hello@svodly.ru.

1.4. By using the Software and the services, you confirm that you have read this Policy. Data processing that requires consent (website analytics, telemetry) is carried out only on the basis of separately expressed consent (the cookie banner, a toggle in the app settings); the service signal about a web version storage failure (section 3.6) does not require consent and contains no identifiers. Local use of the Software (without connecting to the Svodly cloud and without opt-in telemetry) does not result in financial data or account data being transferred to the Operator; during the automatic update check of the desktop version, only technical data are processed (section 3.5).

2. Processing principles

2.1. Svodly is designed on the local-first principle: your financial data (books, accounts, categories, transactions, budgets, counterparties) are stored on your devices. When synchronization with the Svodly cloud is enabled, a copy of the data is also stored on servers and in object storage that the Operator rents from a hosting provider in Russia (section 6.3) — without client-side encryption; in transit, the data are protected by TLS. This is not zero-knowledge: the Operator technically has access to the content when necessary (for example, upon official requests from competent authorities). Do not use Svodly for secrets — it is a financial application, not a secret manager.

2.2. Minimization: the Operator processes only the data that are necessary for a specific stated purpose.

2.3. Transparency: the full list of the data processed, the purposes and the retention periods is set out in sections 3–5.

2.4. The User retains control: when an account in the Svodly cloud is deleted, the associated data are deleted from the Operator's live systems (see section 7). Copies of the data contained in backups made for the fault tolerance of the service remain in them until the backups are replaced as scheduled: daily backups are kept for 14 days, monthly backups for 12 months, and yearly backups without a time limit. Backups are not used for any other purposes.

2.5. Data stored only on the User's devices are not accessible to the Operator: the Operator cannot view, restore, correct or transfer them to anyone. Their safekeeping and protection are ensured by the User (section 9.2).

3. What data are processed

Categories of personal data subjects: visitors to the svodly.ru and docs.svodly.ru websites, Users of the Svodly cloud service, persons contacting the Operator by email, persons whom Users invite to shared books by email (section 3.2), persons whose information Users enter in books (section 3.11), and also Users' counterparties who are individual entrepreneurs and whose information is obtained from open state registers (EGRUL / EGRIP, the Unified State Register of Legal Entities / Unified State Register of Individual Entrepreneurs) when the autofill feature is used (section 3.8).

3.1. Data processed during registration and sign-in to the Svodly cloud

• Email address — needed for signing in, password recovery and sending technical notifications.
• Password hash (the scrypt algorithm with an individual salt, with no possibility of recovering the password from it) — for authentication.
• JWT tokens (access + refresh) — for maintaining the session; they have a limited validity period (retention periods are given in section 5). They are stored on the User's device (section 8.2).
• Session information on the server: an irreversible hash of the refresh token, the application type (web, desktop, mobile), User-Agent, the time of sign-in and of last activity — to show the User the list of their devices on the “Sync” screen and to let them revoke the access of any of them.
• Device identifier (device_id, UUIDv7, generated by the app) — to distinguish the User's devices in the book's change feed during synchronization.
• Information from a third-party authorization service — if the User signs in via Yandex ID, VK ID or, in the iPhone and Mac apps, via Apple (or previously signed in via another authorization service): the User's identifier in that service, email address, name and a link to the profile picture (Apple does not provide a profile picture). The Operator receives them from the service at the request of the User; the password for the third-party service is not transferred to the Operator. The Operator does not transfer information about the User or the User's data in Svodly to the authorization service.
• Sign in with Apple (iPhone and Mac apps): instead of their own email address, the User may choose a private address issued by Apple — Apple forwards the Operator's emails sent to it to the User's real mailbox. Apple provides the name only at the first sign-in. In addition, the Operator receives from Apple and stores an Apple refresh token: when the account is deleted, the Operator returns it to Apple to revoke Svodly's access to the User's Apple ID (Apple requires this of apps with Sign in with Apple). The Operator transfers no other information about the User to Apple.
• Incomplete registration: until the address is confirmed with the code from the email, the email address, the password hash and the code hash are stored in a temporary record (the period is given in section 5).

3.2. Data generated when working with the Svodly cloud

• Book content (manifest, snapshot, attachments). Stored as plain JSON on the servers and in the object storage of the hosting provider (section 6.3); protected by TLS in transit. The Operator has the technical ability to read the content.
• Book metadata: book_id, owner_user_id, book type, used_bytes (size), number of transactions, last_modified_at, as well as the book manifest — its name and the list of devices from which it is synchronized. They do not contain amounts or the content of transactions.
• Members of shared books (shared access): book_id ↔ user_id, role (owner / member) and access rights. Used for access control. Members of a shared book see each other's email addresses; the name a member sets for the book and the author label on transactions are stored as part of the book content and are visible to all its members.
• Invite tokens for invitations to shared books. Random single-use strings with a limited validity period (periods are given in section 5).
• Invitation by email. If the User sends an invitation by email, the invitee's address they specify is used only to send that email and is not stored on the server (the technical logs contain an irreversible hash of the address). From the email and the invitation page, the invitee learns the inviter's email address and the name of the book. By sending an invitation, the User confirms that they are entitled to give the invitee's address to the Operator.
• Book connection log: account and book identifiers, application type, the method and time of the first download of the book to a device — for diagnosing synchronization.

3.3. Technical data in HTTP requests to the API

• The client's IP address — recorded in the nginx access logs and used for limiting the frequency of requests (rate limiting) on sensitive operations.
• User-Agent — recorded in the nginx access logs; used for debugging and compatibility.
• Request address (path), method and status, duration — for observability (Prometheus + Loki). The account identifier is recorded in error messages and in the logs of certain features. The logs do not contain email addresses, passwords, session tokens or blob content. The request address may include a book invitation code (section 3.2) and a counterparty's TIN (section 3.8).

3.4. Data processed on the svodly.ru and docs.svodly.ru websites

• Yandex.Metrika (svodly.ru only) — visit statistics (see section 6.1). It is loaded only after the User's explicit consent via the cookie banner on the first visit to the site. Until consent is obtained, the tracker is not connected and Yandex cookies are not set. If the User clicked “Reject” or closed the tab without making a choice, Yandex.Metrika does not work on their device. After consent, it collects: IP, User-Agent, Referer, click events, mouse movements (Webvisor), keystrokes in forms. The data are processed on Yandex's side under its own policy.
• VK pixel (Top.Mail.Ru counter) (svodly.ru only) — visit statistics and evaluation of the effectiveness of advertising campaigns in VK services (see section 6.6). It is activated by the same cookie banner and the same consent as Yandex.Metrika: before consent (or if “Reject” is chosen), the pixel is not loaded. After consent, it collects: IP, User-Agent, Referer, the addresses of the pages viewed. The data are processed on VK's side under its own policy.
• Web server logs of both sites (IP address, User-Agent, page address, referral source, advertising campaign tags in the address) are kept for security and debugging and are also used for aggregate statistics of visits and of click-throughs to app stores. For statistics, the IP address is replaced with a surrogate visitor identifier calculated by an irreversible transformation; no cookies are used for this, and such information is not transferred to third parties.
• Web fonts are served from the Operator's own domain (self-hosted); third-party CDNs (including Google Fonts) are not used, and visitors' IP addresses are not transferred to third parties when fonts are loaded.

3.5. Data transmitted during automatic updates

When the desktop application checks for updates (updates.svodly.ru), the server sees:

• The client's IP address (a standard HTTP request).
• The current version of the application, the update channel (stable / beta / nightly), the platform target (windows-x86_64 / linux-x86_64 / …).

Not transmitted: email, User identifiers, book content.

3.6. Telemetry (with consent)

Disabled by default. When the User enables it in the settings, the app periodically sends a fixed set of fields to api.svodly.ru/v1/telemetry:

• the application version,
• the update channel,
• the operating system and processor architecture (for example, windows-x86_64, android-arm64; for the web version, the literal web, without information about the OS and browser),
• the interface language,
• a hash of the device identifier (SHA-256, an irreversible transformation); the Operator does not match it with the account,
• optionally, the name of a technical event from a closed list (for example, “the local storage of the web version was reset by recovery”) — without any details, page addresses or content.

Not transmitted: financial data and email. The Operator does not use the device hash to identify the User.

The exception is the web version's service signal. If the local storage of the web version is damaged and the app has restored it or has switched to working in memory, it reports this to the Operator regardless of the telemetry toggle. The signal contains only the application version, the update channel, the literal web, the interface language and the name of an event from a closed list — without the device hash or other identifiers. The legal basis is the legitimate interest of the Operator and Users in detecting data loss (Article 6(1)(7) of Law 152-FZ).

3.7. Cash receipt scanner (information from the automated information system of the Federal Tax Service of Russia)

The “Receipt scanner” feature is used at the User's initiative and is available when the Svodly cloud is connected. When it is used:

• Cash receipt details from the QR code (fiscal drive number, number and fiscal sign of the fiscal document, amount, date and time, transaction type) are transmitted from the User's device to the Operator's server and then to the automated information system of the Federal Tax Service of Russia (the Federal Tax Service “Open API” platform) to obtain information about the receipt (section 6.4).
• Receipt information received from the Federal Tax Service of Russia (the seller's name and TIN, the list of items, amounts) is returned to the User's device and saved in the User's book: locally and, when synchronization is enabled, as part of the book content (section 3.2).
• Recognition of the QR code (from the camera or from an image) is performed on the User's device; the images themselves are not transmitted to the Operator.
• Receipt details and content are not stored on the Operator's server: the server performs transit transmission. Only the account identifier and an irreversible hash of the request (without the receipt details and content) are recorded in the technical logs — for diagnostics and rate limiting.

3.8. Counterparty card autofill (EGRUL / EGRIP)

The feature for autofilling a counterparty by TIN is enabled by the User separately. When it is used:

• The counterparty's TIN entered by the User is transmitted to the Operator's server and then to the information provider (section 6.5) to search for the record in the open state registers EGRUL / EGRIP.
• The card obtained (name, OGRN (primary state registration number) / OGRNIP, KPP (tax registration reason code), address, head, status) is returned to the User. To speed things up, the card is saved in the Operator's server cache (the period is given in section 5). For counterparties that are individual entrepreneurs, the card contains the surname, first name and patronymic of the individual entrepreneur; this information comes from open state registers, the maintenance and disclosure of which are provided for by Federal Law No. 129-FZ of 8 August 2001.
• In the log of the feature itself, the server records the account identifier and an irreversible hash of the TIN. The request address in which the TIN is transmitted gets into the general technical logs (section 3.3) and is stored as part of them (the period is given in section 5).

3.9. Email (hello@svodly.ru)

If the User writes to this address, the Operator receives the sender's email address and the text of the message. This information is used to consider the inquiry and respond to it. The retention period is given in section 5. Do not include in your inquiries passwords, confirmation codes, bank card details or other information that is not needed for the response. If you contact the Operator via third-party platforms (messengers, social networks, app stores), your messages are also processed by these platforms — on their terms.

3.10. Recognition of a transaction from voice and photos

The features for voice input of a transaction and recognition of a document from a photo are enabled by the User at their own initiative and are available when the Svodly cloud is connected. When they are used:

• An audio recording of a phrase (no longer than 10 seconds) dictated by the User, or a document image selected by the User, is transmitted from the device to the Operator's server and then to the recognition provider (section 6.7) for conversion into text.
• The recognized text, as well as the names of the categories, counterparties, projects and accounts of the User's book, are transmitted to the provider for text labeling (which part of the phrase is the amount, the date, the category, the counterparty). Only names are transmitted — without amounts, balances or transaction content. The email address and account and device identifiers are not transmitted to the provider: requests are made from the Operator's service account.
• The transaction draft is returned to the device and shown to the User on the confirmation screen. The draft is never written to the book without the User's confirmation.
• Voice is not used to establish identity. The audio recording is processed solely as a source of text; the Operator does not identify or authenticate the User by it, so no processing of biometric personal data (Article 11 of Law 152-FZ) takes place. Recordings are not transferred to the Unified Biometric System.
• Audio recordings and images are not stored on the Operator's server: the server performs transit transmission. Only the account identifier, an irreversible hash of the input data, its size and the processing result are recorded in the technical logs — without a transcript of the speech and without the document content.
• The provider is prohibited from using the transmitted content to improve its services: the prohibition is set in every request (section 6.7).
• What to dictate or photograph is decided by the User. Do not dictate or send for recognition information that does not relate to the transaction: other people's personal data, bank card details, passwords and codes, identity documents.
• Service counters linked to the account are stored on the Operator's server: the number of recognitions for the current day (to enforce the daily limit) and category selection counters (the category identifier in the book, without names, amounts or transaction content) — to make the feature cheaper in the future. The periods are given in section 5.

3.11. Information about third parties in the User's books

What to enter in books is decided by the User. If the User enters information about other people — counterparties, employees, family members, debtors, creditors — the User determines the scope of such information and the purposes of its use. The Operator processes it on behalf of the User (Terms of Use, clause 4.4): it stores it only as part of the book content (section 3.2) for synchronization and shared access, and does not check it or use it for its own purposes. The User is responsible for being entitled to enter such information, to transfer it for storage and, with shared access, to show it to other members of the book.

4. Purposes and legal bases of processing

5. Retention periods

6. Transfer of data to third parties

The Operator engages the following persons in processing and transfers data to the following recipients:

6.1. Yandex.Metrika (svodly.ru website only)

• Purpose: visit statistics, understanding the demand for pages, navigation diagnostics (Webvisor).
• Activation: only after explicit consent via the cookie banner on the first visit to the site. By default (before consent), the tracker is not loaded.
• Data transferred after consent: IP address, User-Agent, Referer, page events (clicks, scrolls, cursor movements and form input via Webvisor).
• Cookies: Yandex.Metrika sets its cookies (_ym_uid, _ym_d, _ym_isad) only after the User's consent.
• Jurisdiction: Russia. Yandex's servers are in the Russian Federation.
• Policy: https://yandex.ru/legal/confidential/.
• How to withdraw consent: clear the localStorage of the svodly.ru site (the svodly:cookie-consent key) or the entire localStorage in the browser settings for this domain — on the next visit the cookie banner will appear again, and you can choose “Reject”. In addition, you can use content blockers.

6.2. reg.ru (domain email, SMTP mail.hosting.reg.ru)

• Purpose: sending system emails (email confirmation during registration, password recovery, invitations to shared books, technical notifications).
• Data transferred: the recipient's email address, the subject and body of the email (contains a one-time code or link; an invitation email also contains the inviter's email address and the name of the book; it does not contain a password or financial information).
• Jurisdiction: Russia.
• Policy: https://www.reg.ru/legal/.

6.3. Hosting providers

• The Operator rents servers and object storage from the hosting provider FirstVDS; the equipment is located in data centers in the territory of the Russian Federation. Databases containing personal data are located in the territory of the Russian Federation (Article 18(5) of Law 152-FZ).
• Database backups are stored in the same object storage and additionally on the Operator's own equipment in the territory of the Russian Federation (periods are given in section 2.4).
• The hosting provider has the technical ability to access data on its servers and the server logs — a standard infrastructure trust model.

6.4. Federal Tax Service of Russia (cash receipt information)

• Role: a government authority — the operator of the automated information system containing cash receipt information (the Federal Tax Service “Open API” platform). It is not a processor acting on behalf of the Operator.
• What is transferred: cash receipt details from the QR code scanned by the User (section 3.7) — solely at the request and in the interests of the User, to obtain information about the receipt.
• Jurisdiction: Russian Federation.

6.5. EGRUL / EGRIP information provider — DaData

• Purpose: searching for a counterparty card by TIN in open state registers (section 3.8).
• What is transferred: only the TIN entered by the User.
• Provider: the DaData service (Data Q LLC).
• Jurisdiction: Russia.
• Policy: https://dadata.ru/privacy/.

6.6. VK pixel / Top.Mail.Ru (svodly.ru website only)

• Purpose: website visit statistics and evaluation of the effectiveness of advertising campaigns placed by the Operator in VK services (VK Ads).
• Activation: only after explicit consent via the cookie banner on the first visit to the site — the same consent mechanism as for Yandex.Metrika (section 6.1). By default (before consent), the pixel is not loaded.
• Data transferred after consent: IP address, User-Agent, Referer, the addresses of the pages viewed.
• Cookies: the counter sets its cookies (tmr_* identifiers) only after the User's consent.
• Counter operator: VK LLC.
• Jurisdiction: Russia.
• Policy: https://vk.com/privacy.
• How to withdraw consent: the same way as for Yandex.Metrika — see section 6.1.

6.7. Yandex Cloud (speech recognition and recognition of text in images, language model)

• Purpose: converting a phrase dictated by the User into text, recognizing text in a photo of a document and labeling the recognized text into a transaction draft (section 3.10).
• What is transferred: the audio recording or image submitted by the User; the recognized text; the names of the categories, counterparties, projects and accounts of the User's book.
• What is not transferred: the email address, account and device identifiers, account balances and transaction history. Requests are made from the Operator's service account, so the provider does not associate them with a specific Svodly User.
• Prohibition on data use: each request carries a prohibition on using the transmitted content to improve the provider's services (x-data-logging-enabled: false); audio and images are processed in transit and are not saved on the Operator's side.
• Provider: Yandex.Cloud LLC.
• Jurisdiction: Russia.
• Data processing terms: https://yandex.ru/legal/cloud_dpa/ru/.

Third-party authorization services (Yandex ID, VK ID and, in the iPhone and Mac apps, Apple) through which the User, at their own choice, signs in to the account are not processors acting on behalf of the Operator and do not receive information about the User from the Operator: the Operator only receives profile information from them (section 3.1), and when the account is deleted it returns to Apple the refresh token Apple issued, to revoke access.

All third-party processors and data recipients are under the jurisdiction of the Russian Federation. No cross-border transfer of personal data takes place.

The Operator does not transfer data:

• to advertising networks and data brokers — except for the web analytics counters listed in this section (Yandex.Metrika — 6.1, VK pixel — 6.6): they are connected only with the User's consent and receive data to the extent described in those sections;
• to user profile aggregators;
• to government authorities — except in the cases expressly provided for by the legislation of the Russian Federation; the transfer of receipt details to the automated information system of the Federal Tax Service of Russia (sections 3.7 and 6.4) is carried out solely at the request and in the interests of the User.

7. Rights of the personal data subject

In accordance with Articles 9, 14, 17, 20 and 21 of Law 152-FZ, the data subject has the right to:

• obtain confirmation of the fact that their personal data are being processed and information about such processing (Article 14);
• access the data being processed;
• demand the clarification, blocking or destruction of inaccurate / incomplete / outdated / unlawfully obtained personal data (Articles 14 and 21);
• withdraw consent to processing based on consent (Article 9) — after withdrawal, the Operator stops such processing; processing on other legal bases (performance of a contract, legitimate interests) may continue to the extent permitted by law;
• appeal against the Operator's actions or omissions to Roskomnadzor or to a court (Article 17).

Additionally, beyond the requirements of the law, the app allows you to export financial data at any time via the built-in export (CSV / XLSX).

7.1. How to exercise these rights

To protect data from being disclosed, changed or deleted at someone else's request, the Operator may request additional information confirming that the request comes from the data subject (Article 14(3) of Law 152-FZ).

8. Cookies

8.1. On the svodly.ru website

• Cookie banner on the first visit. The site shows a banner asking for consent to analytics cookies. Until explicit consent is obtained (clicking “Accept”), analytics cookies are not set.
• Technical consent key in localStorage (svodly:cookie-consent, values accepted / rejected) — needed to remember the User's choice so that the banner is not shown again. This is not a cookie in the HTTP sense but the site's local storage; the data are not sent to the server. It is considered necessary technical storage and does not require separate consent.
• Yandex.Metrika cookies (_ym_uid, _ym_d, _ym_isad) — for statistics. Set only after explicit consent via the banner. Lifetime — up to 1 year. Managed by Yandex (see clause 6.1).
• Top.Mail.Ru (VK) cookies (tmr_* identifiers) — for statistics and evaluating the effectiveness of advertising. Set only after explicit consent via the banner. Managed by VK (see clause 6.6).
• The site does not set any other cookies.

8.2. In the Svodly cloud (api.svodly.ru)

• The API does not use cookies for authentication. JWT tokens are transmitted in the Authorization: Bearer … header and stored on the User's device: in the web version, in the browser storage (localStorage, or sessionStorage if the “Remember on this device” checkbox was cleared at sign-in); in the desktop version, in the app's local database; in the mobile app, in the secure storage of the operating system.

8.3. In the desktop / mobile / web application

• The local database and localStorage store: device_id, UI settings, telemetry opt-in flags; where the cloud session tokens are stored is described in section 8.2. These are not cookies in the HTTP sense but the app's local storage.
• The device's operating system may include the app's data, including the local database with books, in its own backups and in transfers to a new device (for example, Android backup to the User's Google account). The app does not exclude the local database from such copying; whether it is enabled and where the copies are stored is determined by the device settings. The Operator has no access to such copies.

9. Security

9.1. The Operator's measures

• Financial data are protected by TLS in transit between the app and the server; on the servers and in the object storage they are stored without client-side encryption. This is not zero-knowledge: the Operator has the technical ability to access the content.
• Svodly cloud account passwords are hashed with the scrypt algorithm with an individual salt. The plain-text password is not stored.
• Data transmission between the client and the server — only over TLS 1.2+.
• Brute-force protection: rate limiting on sensitive operations (sign-in, registration, password recovery) and protection against timing attacks.

9.2. What depends on the User

• Device protection. The app does not encrypt the local database by its own means: it is protected by screen lock and device encryption, if they are enabled. Anyone who has gained access to an unlocked device sees the app's data and can act in the account.
• Password and codes. Use a separate password for the account and do not share it or the confirmation codes from emails with anyone: the Operator does not ask for them.
• Other people's and shared computers. In the web version, the session is saved in the browser. On a device used by other people, clear the “Remember on this device” checkbox when signing in and sign out of the account when you finish.
• Invitations. An invitation to a shared book opens its content to whoever uses it — send it only to people you trust.
• Backups. The Operator cannot restore data stored only on the device (section 2.5): keep copies and exports outside that device.
• Secrets. The app is not intended for storing passwords, PIN codes, CVV/CVC codes and full bank card details, keys and tokens — do not enter them into fields, notes and attachments.

The consequences of failing to observe these measures are borne by the User (Terms of Use, section 8).

10. Changes to the Policy

10.1. The Operator may amend the Policy. The current version is always published at https://svodly.ru/legal/privacy with its version number and effective date; a new version applies from the effective date stated in it, which may not be earlier than the day of its publication, and has no retroactive effect.

10.2. The User independently keeps track of the current version of the Policy. The Operator may additionally announce material changes that expand the categories of data processed or the purposes by email (for Users of the Svodly cloud), in the app or on the website; the absence of such an announcement does not affect the entry into force of the new version. If a new version introduces processing for which consent is required by law, the Operator requests it separately and does not begin such processing until consent is obtained. Continued use of the service after the changes are published means that the User has read the new version.

11. Registration in the register of personal data operators

11.1. The Operator is included in the register of operators processing personal data maintained by Roskomnadzor (notification of personal data processing under Article 22 of Law 152-FZ).

• Registration number: 77-26-557273.
• Date of registration of the notification: 15 June 2026.
• Date of commencement of personal data processing: 11 June 2026.

11.2. The record of the Operator is available in Roskomnadzor's public register: https://pd.rkn.gov.ru/operators-registry/operators-list/.

Contact

For all questions regarding the processing of personal data: hello@svodly.ru.