Bank x Bank / Privacy policy

Privacy policy

Updated 28 October 2026. The current closed-test release is free, with tips disabled.

Who we are

Bank x Bank is a savings-planning app operated by Nicolai Madsen, Hermodsgade 31, 3tv, 2200 København, Denmark, responsible for your personal data. Contact hello@bankxbank.com. The app is for people aged 16 and over. We do not hold money or connect to your bank.

What we use and why

• Account and plans: your email, sign-in identifiers and metadata, verification status, and the plans, contributions and preferences you enter. Google sign-in may supply your name and profile-photo URL; the app does not fetch or display that photo. Apple sign-in may use a private relay email address. We use these to provide and synchronise your account and plans under our agreement with you.
• Payment-enabled versions only: Tips are disabled in the current free closed test and RevenueCat is not initialised by that build. In earlier payment tests, or where tips are offered, Apple or Google handles payment. RevenueCat validates purchases and refunds and provides reporting using receipts or purchase tokens, transaction details, an account-linked identifier, device/platform information and connection activity. Country may come from the transaction or be inferred from an IP address; we do not request GPS location. RevenueCat may receive information when support products load even without a purchase. Our records contain a support identifier, transaction-reference digest, product, amount, currency, date and payment/refund status. We do not collect card or bank-account details.
• Support and security: messages you send us and technical information such as IP addresses, request details and operational logs. We use these to answer requests, secure the service, prevent duplicate payments and recover from failures.

We rely on our agreement for necessary service and payment processing, legitimate interests for security, general enquiries and proportionate service/purchase reporting, and legal obligations for required financial records and privacy requests. Account information is needed for account features; tips and reminders are optional. We do not sell personal data, use it for advertising or make automated decisions with legal or similarly significant effects.

Your device and the website

Plans, preferences and sessions are cached on your device. Sign-out clears the app's known account cache and reminders. An offline device may retain data until it reconnects or you remove its app data. Optional reminders may show plan names and amounts on the lock screen; control these in device settings.

The website has no advertising scripts or analytics cookies. Its planning example runs locally and resets on reload. Hosting processes technical requests; verification/reset pages use the code in your email link to complete the action.

Service providers and transfers

We use Google Firebase for sign-in, storage, hosting and backend services; RevenueCat for purchases; Apple and Google for store payments and provider sign-in; one.com for support and account emails; and Dinero for necessary bookkeeping records.

The production database is in Frankfurt; separate testing infrastructure includes Switzerland and the US. Providers may also process data outside the EEA, including in the US. Safeguards include applicable Standard Contractual Clauses and, for eligible Google transfers, the EU–US Data Privacy Framework. Contact us for copies or details. See Firebase privacy information, RevenueCat's DPA and one.com's DPA.

Retention and deletion

• Account and plans: kept while your account exists. Completed deletion removes active account data and the support identity mapping and requests RevenueCat customer deletion. Incomplete deletions are investigated.
• Limited payment records: kept during account use for support progress, refunds and duplicate prevention; retained for 90 days after completed account deletion, then deleted. Inconsistent records are held only as needed for investigation, with weekly review.
• Recovery and security: production database backups last 14 days and point-in-time history seven days; the closed test uses a separate database in Switzerland without point-in-time recovery. For both environments, ordinary configured Cloud logs 30 days and required audit logs 400 days. Deletions are reapplied before restored data is used. Completed-deletion markers become eligible for removal after 24 hours.
• Provider copies: Firebase documents authentication IP logs lasting a few weeks, other authentication data removal within 180 days after deletion starts, and Hosting IP data lasting a few months. RevenueCat documents customer and purchase-history deletion; this is not an immediate-erasure promise for every backup or security log. Residual records may remain for applicable security or legal obligations. Apple and Google keep separate store records.
• Email and legal records: reviewed monthly, with routine support email eligible for deletion 90 days after resolution and alerts after 30 days. one.com reports 30-day delivery logs, 14-day backups and recovery up to 30 days after permanent email deletion. Necessary bookkeeping evidence is kept separately for applicable statutory periods—five years after the financial year ends where Danish bookkeeping rules apply. Specific disputes may require limited evidence longer, with the need reviewed.

Your choices and rights

Delete your account in Settings → Delete Account or email us; see deletion instructions. You may request access, correction, erasure, restriction or portability, object to legitimate-interest processing, and withdraw consent where applicable. We may verify ownership. We normally respond within one month and explain any lawful extension within that month. You can complain to Datatilsynet or your relevant data-protection authority.

We date updates to this policy and notify existing users before material new processing purposes begin.