Privacy and personal data policy

This policy is published by Pavel, a private individual, the owner and developer of the Pupupul service (the “service”, “we”). Contact for any questions about personal data: makesales.uz@gmail.com.

The policy explains what data we collect from users of the service, why, to whom we pass it, where we store it and what rights users have over their data. By signing up for the service, you confirm that you have read this policy and agree to the processing of your data described in it.

When you sign up and sign in:

• email and password (the password is stored only as an irreversible bcrypt hash, neither we nor anyone else can recover it from the hash);
• when signing in with Google: email, name and profile photo that Google passes to us with your consent;
• your name and company name, if you entered them in your profile settings.

Data you enter while using the service:

• names of cards and accounts that you make up (for example “Uzcard card”, “Cash”). These are your own labels, not numbers of real bank cards. The service never asks for or stores real card numbers, CVV or payment details;
• income and expense categories, amounts and comments on transactions, balance sheet items;
• emails of people you invite to a shared space and their role (full access or view only).

If you connect the Telegram bot:

• your Telegram ID and username;
• text, photos and voice messages you send to the bot so that it can recognize a transaction. We pass them to an artificial intelligence service only for recognition, we do not keep the files after processing, and the database keeps only the final transaction record you confirmed.

If you turned on notifications on a device:

• the technical subscription address issued by your browser and the notification encryption keys (with them a notification can be delivered only to that device);
• the device type, for example “Android, app” or “Windows, browser”;
• which notification types you turned on or off (one choice for all your devices);
• marks of which reminders were already sent (type, reason and time), so the same one is not sent twice.

Technical data collected automatically on any visit to the site:

• IP address, browser and device type, date and time of the visit, to protect against failures and abuse;
• an overall visit counter for the public site pages (home, articles, calculators): how many times a page was opened per day and which site the visitor came from, for example a search engine or an AI assistant. We keep only these numbers, with no IP address, browser or samsa, so they cannot be linked to you;
• which site design you chose (new or previous) and when you last used the service;
• log records of important actions with your account: export of all data, an account deletion request and its cancellation, and administrator actions with your account (section 8).

• to create and protect your account and let you, not a stranger, sign in;
• to keep and show your money records, which is the very point of the service;
• to make shared spaces and invitations of other members work;
• to run the Telegram bot, if you turned it on yourself;
• to answer your support requests;
• to send notifications, if you turned them on yourself, and only the types you did not turn off: support replies, plan and billing, service news, reminders about your records (add transactions, a payment from the payment calendar, a budget plan exceeded, card balance reconciliation), a shared goal reached and changes to your access to a space;
• to find and fix errors in the service.

We do not sell your data and do not show you ads based on your data.

The basis for processing is your consent, which you give by ticking the box when signing up, and the need to process data so that the service can provide what you asked for at all (keeping records of your transactions is impossible without storing them).

We do not pass data to third parties for their own purposes. Some data is processed by technical contractors who provide us with infrastructure and do so on our behalf, under their own contracts and security policies:

• Supabase, stores the database and handles user sign-in;
• Vercel, the hosting the site runs on;
• Resend, sends emails for email confirmation, password reset and invitations (receives your email and the email text);
• Google, if you chose to sign in with a Google account;
• Telegram, if you connected the Telegram bot;
• YouTube (Google), when you press play on a video lesson: the player loads from youtube-nocookie.com only after that press, and YouTube receives your IP address and browser details, as when you watch a video on YouTube itself. Your records are not passed there;
• notification delivery services built into browsers (Google Firebase Cloud Messaging, Apple Push Notification, Mozilla Push), only if you turned on notifications: they deliver the notification to your device in encrypted form, and only that device can read its text. They have no access to your records;
• Anthropic (the Claude artificial intelligence service), to recognize Telegram bot messages, only if you use the bot;
• AI assistants you connect to Pupupul yourself (for example, Claude by Anthropic or ChatGPT by OpenAI), only while the connection is active. The assistant receives what it requests for your request: the list of your spaces, cards and accounts, categories, projects and transactions for the given period. The assistant must record or correct transactions only after you agree, and with “Confirm assistant records” turned on a transaction appears only when you press Record in Pupupul. The assistant cannot delete transactions. You sign in on a Pupupul page, the assistant never gets your password, and we store only a fingerprint of the key issued to it. What the assistant does with this data in its chat is governed by the rules of its service. You can disconnect an assistant at any time: Account, AI assistant section, Disconnect.

We may also disclose data if the law of the Republic of Uzbekistan or a decision of an authorized state body directly requires it.

The service runs on Supabase and Vercel servers physically located outside Uzbekistan. We do not store or process biometric or genetic data and are not a telecom operator, so the mandatory localization requirement for those categories of data does not apply to the service. For other data we try to use contractors with international data protection certifications.

While your account is active, we keep the data so that the service keeps working for you.

You can delete your account yourself: “Account” → “Personal details and password” → “My data” → “Delete account”, or by writing to makesales.uz@gmail.com. Deletion has two steps:

• the account immediately goes to an archive for 30 days. You can sign in, but only to download your data or cancel the deletion, and then everything comes back as it was. Notifications and the Telegram bot are turned off right away;
• after 30 days we permanently delete the profile, sign-in, all your spaces with all their contents (cards, categories, transactions, budgets, balance sheet, items), support messages and notification subscriptions. They cannot be restored after that.

Shared spaces that you own are deleted for the people invited there too. Records you added to other people's shared spaces stay with their owners, since they are part of their records, but without a link to you.

After deletion only action log records remain (date, action and email). They are kept for a year for security and to resolve possible disputes, and are then deleted automatically. Infrastructure backups may keep data for a limited time until the backups are refreshed. We keep data longer only if the law or a state body directly requires it.

• the connection to the site always uses a secure protocol (HTTPS);
• passwords are stored only as an irreversible bcrypt hash, none of us sees your real password;
• the database is stored on encrypted disks (AES-256) at our contractor Supabase;
• data of different users and workspaces is technically separated by access rules at the database level;
• only we have access to administrative functions;
• administrator actions (viewing a user's data, changing the plan, blocking, support replies, sending notifications, publishing articles) and important account actions (export of all data, a deletion request and its cancellation, final deletion) are written to a log. A log record cannot be changed or deleted earlier than after a year, and only an administrator can read the log.

At any time you have the right to:

• find out what data of yours we store and get a copy of it;
• get your data in a machine-readable form to move it to another service;
• ask us to correct inaccurate data;
• ask us to restrict the processing of your data or object to it;
• delete your account and data (section 7);
• withdraw consent to data processing (this means deleting the account, since without data the service cannot keep your records);
• ask any question about the processing of your data.

Yourself, without writing to us: “Account” → “Personal details and password” → “My data”. There you will find the “Download all my data” button (one JSON file: profile, all your spaces with all their contents, support messages) and the “Delete account” button. You can correct your name and password there too.

For anything else, write to makesales.uz@gmail.com. We reply free of charge and no later than one month after receiving the email. If the request is complex, the period may be extended by two more months, and we will tell you about it within the first month. To avoid giving out someone else's data, we may ask you to write from the email the account is registered with.

We are an Uzbek platform, so instead of cookies we have samsa. Seriously though, samsa here means ordinary cookies: small technical records that the site keeps in your browser. On your first visit we show a notice “We collect samsa (cookies)”.

We use only the samsa without which the site does not work or is inconvenient to use. We have no advertising, analytics or tracking samsa, including from third-party services.

• Sign-in (files whose names start with “sb-”): remember that you are signed in, so that you are not asked for the password on every page. Valid until you sign out.
• pp_ui: which site design you chose, new or previous. Up to a year.
• pp_lang: which language to show the site in, Russian or English. On your first visit it is chosen by your browser language, after that by your choice. Up to a year.
• pp_dash: how you arranged the blocks on the Cashflow home screen. Up to a year.
• cf_period: which month you viewed on Cashflow, to open it again. Up to a year, the choice resets by itself when a new month starts.
• pp_support_seen: when you last saw a support reply, so that the new reply mark is not shown again. Up to a year.
• pp_demo and pp_demo_ws: only in the demo, that you are viewing the demo and which space in it is selected. One day.

A few more settings are kept in the browser memory (localStorage) and are not sent anywhere: light or dark theme, whether the balance amount is hidden, whether you have seen the samsa notice.

How to turn off samsa. In your browser settings you can delete or block samsa for pupupul.uz: the icon to the left of the site address → “Cookies and site data” (in Chrome and Edge), “Settings” → “Privacy” (in Safari and Firefox). Without the sign-in samsa the site cannot remember that you signed in, and your account will not work. Without the other samsa the site will work but will forget your choice of design and language, the screen layout and the selected month. By using the site, you agree to the use of the samsa described here.

The service may send notifications to your phone or computer only if you turned them on yourself: “Account” → “Currency, period, theme” → “Notifications” → “Turn on notifications” and the permission in the browser window. Notifications are turned on separately on each device. We send support replies to your messages, plan and billing messages, service news and reminders about your records. Reminders arrive in the morning to the owner of a space and may contain a payment name and amount, a budget category name, space names and the amount of a shared goal. Such text is visible on the device lock screen, so turn notifications on only on your own devices.

Which notifications to receive is your choice: “Account” → “Currency, period, theme” → “Notifications” → “What to send”. Each type has its own switch, the choice applies to all your devices and is kept until the account is deleted.

How to turn off notifications, in any of these ways:

• “Account” → “Currency, period, theme” → “Notifications” → “Turn off”. The subscription of this device is removed from our database right away;
• in the browser: the icon to the left of the pupupul.uz address → “Notifications” → “Block” or “Reset permission”;
• on a phone: in the system notification settings for the browser or for the Pupupul app; on iPhone you can also remove Pupupul from the Home Screen.

If the browser revokes the subscription itself (for example, you cleared the site data), we remove it from the database at the next sending. When an account is deleted, all its subscriptions are deleted too.

The service was made for users from Uzbekistan, but if you are in the European Union or the European Economic Area, the processing of your data is subject to the General Data Protection Regulation (GDPR). The controller: Pavel, owner of the Pupupul service, makesales.uz@gmail.com. We have not appointed a representative in the EU, please write to this email with any questions.

Legal bases (Article 6 GDPR):

• performance of a contract: keeping your records, account and shared spaces (point 1(b));
• consent: notifications, the Telegram bot, sign-in with Google (point 1(a)), which you can withdraw at any time;
• legitimate interest: security, the action log, protection against abuse and fixing errors (point 1(f));
• a legal obligation, if there is one (point 1(c)).

Your rights: access to data (Article 15), rectification (16), erasure (17), restriction of processing (18), data portability (20), objection to processing (21), withdrawal of consent at any time (7). We do not make decisions based solely on automated processing that have legal effects for you (Article 22). How to use your rights and how quickly we reply is described in section 9: a reply no later than one month, for a complex request the period is extended by two more months with a notice.

Complaint to a supervisory authority. If you believe we process your data in breach of the rules, you have the right to lodge a complaint with the data protection authority of the EU country where you live, work or where the breach took place (Article 77). We would be grateful if you wrote to us first: we will try to solve the issue faster.

Transfers outside the EU. The servers and companies of our contractors (section 5) are located outside the EU, in particular in the USA and the Republic of Korea. Transfers take place under the contracts and data protection policies of these contractors, which provide for the European Commission's standard contractual clauses (Article 46), and for US contractors participating in the EU-U.S. Data Privacy Framework also the European Commission's adequacy decision (Article 45).

Retention periods are described in section 7. If a data breach happens that creates a risk for you, we will inform you without delay and notify the supervisory authority within 72 hours, as the GDPR requires (Articles 33 and 34).

The service is intended for adult users keeping their personal or business records. We do not knowingly collect data of persons under 18.

If the policy changes significantly, we will warn you about it in the service itself. The date at the top of the page always shows when the current version took effect.

For any questions about this policy and your data: makesales.uz@gmail.com.