Privacy Policy
Last updated October 26, 2026.
This page exists in Portuguese and English. The English version governs until the Portuguese version has been reviewed.
Who is responsible for your data
Antonio Carlos de Andrade d'Avila Pacca, CPF 099.740.057-95, at Rua Sd. Constantino Maroqui, S/N, Q57 L6-A, Pedra de Guaratiba - CEP: 23025-170, Rio de Janeiro, Brazil, is the controller of the personal data described here. For anything about your data — a question, a request, a complaint — write to privacy@napgrow.com and a person reads it.
What this covers, and what applies today
Today, NapGrow is not open, and the only personal data we hold is a waitlist email address. If you joined the waitlist, skip to The waitlist and stop: nothing else in this policy applies to you yet.
The rest describes what we will hold when accounts open. It is published now so you can read it before deciding to sign up rather than after.
The waitlist
You gave us an email address so we could tell you when NapGrow opens. That is the only purpose, and submitting the form is your consent to it.
We ask you to confirm by clicking a link in an email, so an address nobody confirmed never joins the list. The list is held by an email service on our behalf — named in Who processes data for us — and the record of your confirmation lives there. Every email carries a one-click unsubscribe, the confirmation email included. Leaving removes your address.
We do not use the waitlist for anything else, do not add it to any other list, and do not pass it to anyone.
What we collect once you have an account
Who you are. An email address, a display name if your sign-in provides one, and an internal identifier linking your account to the identity provider. That is the whole of it. We never receive your password — see Security.
What you record. This is the bulk of it, and it is all data you typed or imported yourself: accounts and their names, transactions with their dates and amounts, free-text notes and memos, the names you give entries, categories and budgets, recurring items, tags, and the names of people you record — a cardholder, a household member, someone you pay or who pays you. If you record a card, we hold a nickname, the last four digits and an expiry date. We never hold a full card number and never a security code.
Who did what. When someone edits a note, an entry's name or a tag on an already-recorded transaction, we keep what it said before, what it says now, who changed it and when. The point is that a shared ledger should be auditable — if your business partner relabels a transaction, that is visible. We keep the source of each recorded transaction too: whether it was typed in, imported from a file (and which file), or written by the system.
Technical records. Our servers and the services we use keep operational records — requests, errors, timings — to keep the thing running and secure.
What we never collect
This list is as much a part of the design as the one above.
- We do not connect to your bank, and we never ask for banking credentials. NapGrow has no bank connection and no account-aggregation feature. You record what you spent; nothing reaches out to your bank on your behalf. We expect to let you import a statement file — CSV, OFX or PDF — that you download from your bank and give to us; that is a file you chose to hand over, not a standing connection to your account, and we will still never hold a credential for it.
- No advertising, no tracking, no data sale. We run no ads, we have no advertising partners, and we do not sell, rent or trade your data. There is no tracking cookie, no advertising pixel and no third-party analytics in the application.
- No full card numbers, and no security codes.
- No profiling of you to make automated decisions about you.
Why we are allowed to process it, purpose by purpose
| What we do | Why we need to | Lawful basis under LGPD |
|---|---|---|
| Run your account and keep your records | It is the service you asked for | Performance of a contract (Art. 7, V) |
| Compute balances, budgets, projections and reports | Same — it is what the product is | Performance of a contract |
| Share your records with members of your workspaces | You chose to invite them | Performance of a contract |
| Keep an edit history, and a record of cross-workspace reads | So a shared ledger can be audited and a boundary crossing can be accounted for | Legitimate interest (Art. 7, IX) |
| Keep operational records; prevent abuse and fraud | Security of the service and of your data | Legitimate interest; legal obligation where one applies |
| Email you about the waitlist | You asked us to | Consent (Art. 7, I) |
| Take payment | To charge you for a plan you chose | Performance of a contract |
| Keep records we are legally required to keep | Tax and accounting obligations | Compliance with a legal obligation (Art. 7, II) |
Who processes data for us
We keep the list short on purpose, and here it is in full.
| Service | What it does | What it sees |
|---|---|---|
| Our identity provider | Sign-in and two-factor | Your email, your password (as a hash) and your two-factor factors. No financial records, ever |
| Vercel | Hosts the website and the application | Requests to the app; operational records |
| Prisma Postgres | Hosts the database | Everything you record, as stored data |
| Expo (EAS) | Builds and delivers the mobile app | No account data |
| Kit | The waitlist email list | Your email address, if you joined the waitlist |
| Stripe (from launch) | Takes payment | Your billing details. We never see or store your card number |
| Sentry | Error reporting, so we can find and fix faults | What broke and where in our code, the page or request it happened on, your IP address, an identifier for your workspace, and your browser, device, language and time zone |
Each of them processes on our instruction and for no purpose of its own. We update this list when it changes.
Two of the things the error reporter sees are an identifier for your workspace and your IP address. Together they let it see the same workspace reporting from the same address more than once. We send them so we can tell an error that affects one workspace from one that affects everybody, and recognize a fault that keeps coming back.
Data leaving Brazil
Your data is stored in the United States, in Northern Virginia, and the servers that run the application sit in the same region. There is no cloud database region in Brazil at our provider, so this is not a preference — it is where the service can run. Sign-in is handled from the United States as well, and error reports in Iowa rather than Northern Virginia.
That makes running NapGrow an international transfer of personal data under LGPD Art. 33. Each of the companies above processes your data for us under a written agreement with standard contractual clauses, which is the basis for the transfer, and none of them may use your data for a purpose of their own.
One thing we keep in-house deliberately: the record of reads that cross between workspaces stays in our own database rather than going to any outside logging service, because sending it out would itself be a transfer of exactly the data that record is about.
What other people can see
Inside a workspace, every member sees everything in it. Every account, every transaction, every amount, every note. There is no setting that hides one from another member, and the reason is in the terms: the ledger is double-entry, so money in a "hidden" account still moves figures that everyone else can see. Hiding the label while the amount moved would be a worse outcome than not offering it.
So the privacy boundary is the workspace, not the account. What you do not want someone to see belongs in a workspace they are not in. This is the single most important thing to understand about privacy in NapGrow, which is why it appears in both documents.
Membership roles control writing, not reading — who may record against which accounts, who may manage the budget, who may invite people.
Reading across workspaces needs permission from both sides. A combined report over two sets of books only works if each workspace has approved it; approval can be withdrawn and can expire; and every crossing is recorded, with who read, when, and under which approval. We keep those records for 24 months.
When someone names you as the payee of a recurring payment, you are told, and nothing is credited to your books until you accept. If you dismiss it, that is your own record and the person who sent it is not told you dismissed it.
Cookies and what is stored on your device
No tracking, no advertising, no analytics cookies. Here is everything.
| Cookie | What it is for | How long |
|---|---|---|
nga_at | Holds your session token on the server side so your browser never has to | Minutes — it is refreshed |
nga_rt | Lets your session be renewed without signing in again | As long as your sign-in stays renewable, which our identity provider sets |
nga_csrf | Stops another site submitting a form as you | The life of your sign-in |
nga_oidc | Carries a sign-in in progress | 2 hours |
nga_theme, nga_locale, nga_sidebar | Remember the appearance, language and layout you chose | 1 year |
nga_site_theme | The same, on the public website | 1 year |
The preference cookies are readable by the server on purpose: it is how the page renders in the theme you picked on the very first paint, instead of flashing the wrong one. They record only what you set, are shared with nobody, and are used for nothing else.
On mobile, sign-in tokens and two-factor secrets are held in the device's own secure keystore — Keychain on iOS, Keystore on Android — and never in ordinary app storage.
How long we keep things, and what deletion really means
Read this part even if you skip the rest.
Ask us to delete your account and we mark it deleted immediately and tell you the date it becomes permanent — 30 days later. Until that date you can undo it and everything comes back, books included. After that date it happens automatically: no person decides, no ticket is raised, nothing is waiting on us.
What happens then is anonymization, not erasure, and we would rather say so plainly than use a word that is not true.
Your identity goes: your email address, your display name, the link to your sign-in, and your own name wherever it appears in a workspace. What stays is the arithmetic — the transactions and balances, stripped of anything that identifies you. We keep those rather than delete them, and the reason is retention rather than inability: the anonymized arithmetic is our own business record, and we keep our records. While you have an account you may delete your own entries whenever you like, posted ones included — so what changes when you leave is not what you are able to remove, but what we keep once you have gone. LGPD recognizes this, in that anonymized data is no longer personal data.
Deleting a whole workspace is different: that genuinely removes its books. If you want the records gone rather than un-attributed, deleting the workspace is the action that does it. If you solely own a workspace with other members in it, you will be asked to hand it to someone before you can confirm — we will not strand other people's books.
If you start setting up and stop, we keep what you entered — a workspace name and address, a language, a currency — for 7 days, so you can come back and finish. After that it goes, and nothing of it was ever a workspace.
A few things survive, each for a stated reason: the record of cross-workspace reads (24 months, so a boundary crossing stays accountable after the fact), the edit history of shared records, and a workspace's short URL name, which is never reissued to anyone else. None of them is re-attributed to you once your identity is gone.
Records about people other than you — a name you typed on an entry, a cardholder's name, a note mentioning someone — belong to the workspace rather than to you, and go when the workspace goes.
Your rights
Under Article 18 of LGPD (Law 13.709/2018) you can ask us to:
- confirm whether we process your data, and get access to it;
- correct anything incomplete, inaccurate or out of date;
- anonymize, block or delete data that is unnecessary, excessive or processed unlawfully;
- delete data we hold on your consent, or withdraw that consent;
- tell you who we have shared your data with;
- tell you what happens if you refuse consent;
- give you a copy of your data to take elsewhere.
Write to privacy@napgrow.com. We will answer without undue delay. Deleting your account — and undoing it — you can do yourself from your account settings. For a copy of your data, ask us at that address and we will send it to you.
Separately from that right, a workspace's owner can download a copy of everything recorded in that workspace, from its settings, without asking us. That is the workspace's records rather than one person's: a workspace holds entries, names and notes that several people may have written, which is why only its owner can take it and why it does not answer a request about your own data. If you are a member rather than an owner, or you want your own data rather than a workspace's, the address above is still how to ask.
If you are not satisfied with how we handled a request, you may complain to the ANPD, Brazil's data protection authority.
If you are in the European Economic Area, the United Kingdom or Switzerland, write to the same address and we will give you the same rights set out above, which match the ones your own law gives you. We do not market NapGrow in those regions.
Security
The specific things we do, rather than a paragraph of adjectives:
We never receive your password. Sign-in is handled by an identity provider; no NapGrow screen accepts a password, a reset link, a one-time code or a passkey. A breach of our systems would expose no password, and a breach of the provider would expose no financial records.
Your browser never holds a session token. The exchange happens on our server and the token stays in a cookie that page scripts cannot read, so a script injected into a page cannot steal your session. On mobile, tokens live in the platform keystore rather than in app files.
Your data is encrypted in transit and at rest, and backed up daily, by the database service that holds it. Access across a workspace boundary is approved by both sides and recorded.
No system is perfectly secure and we do not claim otherwise. If a breach puts your data at risk, we will tell you and the ANPD as the law requires.
Children
NapGrow is not for people under 18 and we do not knowingly collect their data. If you believe a child's data has reached us, write to us and we will remove it.
Changes to this policy
We will update this page as the product changes, and the date at the top will say when. If a change matters to you, we will tell you rather than leaving you to notice.
Getting in touch
privacy@napgrow.com — for any question or request about your data, including everything in Your rights. A security researcher should write to security@napgrow.com.