Privacy Policy

1 Introduction

Welcome to OhMyCent, an AI-powered household finance management platform. OhMyCent is developed and operated by Ryan, an independent software developer based in the Philippines.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the OhMyCent web application at ohmycent.com. We are committed to protecting your personal data in full compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173).

By using OhMyCent, you consent to the data practices described in this policy. If you do not agree, please discontinue use of the service.

2 Data We Collect

To deliver our household finance services, we collect the following categories of personal information:

• Account Information: Your name and email address used during registration.
• Financial Data: Household income, expense transactions, budget limits, savings goals, recurring bills, investment records, and debt obligations you enter or import.
• Uploaded Files: Receipt images (JPEG, PNG) and PDF documents uploaded for OCR extraction and expense categorization.
• AI Interaction Data: Conversation messages sent to the AI Financial Advisor, used solely to generate responses within your session.
• Payment Information: Subscription billing is processed by Lemon Squeezy (our payment processor). We do not store full credit card numbers on our servers.
• Device & Usage Data: Browser type, device type, IP address, pages visited, and session duration — collected for security and service improvement.
• Biometric Credential Identifiers: If you register a passkey (Face ID / Touch ID), only the public key and credential identifier are stored. Your biometric data never leaves your device.

3 How We Use Your Data

We use the information collected for the following purposes:

• To provide, operate, and maintain the OhMyCent service
• To process receipt uploads and extract structured transaction data via AI/OCR
• To power the AI Financial Advisor with contextual household data
• To send automated bill reminders via the webhooks you configure
• To manage your subscription, billing, and account status
• To send transactional emails (password resets, backup deliveries, subscription confirmations)
• To detect, investigate, and prevent fraudulent or unauthorized use
• To comply with applicable laws and regulatory requirements

4 Data Storage & Security

We implement industry-standard security measures to protect your data:

• Encryption at Rest: Sensitive values (API keys, webhook tokens, 2FA secrets, recovery codes) are encrypted using AES-256.
• Encryption in Transit: All data is transmitted via TLS/HTTPS enforced through Cloudflare.
• Session Security: Sessions are encrypted with secure, HTTP-only cookies. CSRF tokens protect all form submissions.
• Access Controls: Household data is strictly scoped per account. No user can access another household's data.
• Two-Factor Authentication: We support TOTP 2FA (Google Authenticator) and FIDO2 biometric passkeys.
• Infrastructure: Hosted on secure cloud infrastructure protected by Cloudflare DDoS mitigation.

While we implement robust safeguards, no method of transmission or storage is 100% secure. We encourage strong passwords and enabling 2FA.

5 Third-Party Services

OhMyCent integrates with the following third-party services under limited circumstances:

• AI Providers (OpenRouter, Google Gemini, OpenAI, Anthropic): AI features (receipt OCR structuring, transaction categorization, and financial insights) are processed via secure third-party AI APIs (such as OpenRouter) or your personal API keys configured in AI Settings. Prompts contain only necessary transaction context to fulfill your request. Each provider's privacy policy applies to data they receive.
• Lemon Squeezy (Payment Processor): Handles subscription billing as Merchant of Record, subject to their own privacy policy and PCI-DSS compliance.
• Resend / SMTP Providers: Used to send transactional emails securely.
• Discord / Telegram (Webhooks): Only if you configure webhook URLs. Bill reminders are sent to channels you designate.
• Google Fonts: Font assets are loaded from Google's CDN for typography.

We do not share, sell, rent, or trade your personal data with any third party for marketing purposes.

6 Your Rights Under R.A. 10173

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights:

To exercise any of these rights, email [email protected]. We respond within 15 business days.

7 Data Retention

• Active Subscription: All data is retained while your account and subscription are active.
• After Cancellation: Data remains accessible until your paid billing period ends, then is scheduled for deletion within 30 days.
• Account Deletion: Using "Delete Household" in the Danger Zone permanently and irreversibly deletes all data immediately.
• Backup Files: Auto-generated backup archives are stored for up to 30 days before pruning.

Aggregated, anonymized usage statistics (no personally identifiable information) may be retained indefinitely for service improvement.

8 Cookies

OhMyCent uses the following types of cookies:

• Session Cookies: Strictly necessary for authentication. Encrypted, HTTP-only, expire on logout.
• CSRF Tokens: Protect form submissions against cross-site request forgery attacks.
• Preference Cookies: Store your theme preference (light/dark mode) locally in the browser.

We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies.

9 Children's Privacy

OhMyCent is designed for adults managing household finances. The service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors.

If you believe a minor has created an account, please contact us at [email protected] and we will delete the information promptly.

10 Changes to This Policy

We may update this Privacy Policy periodically. When we make significant changes, we will:

• Update the "Last Updated" date at the top of this page
• Display an in-app notification to all active users
• Send an email notification for material changes affecting your rights

Your continued use of OhMyCent after the effective date constitutes acceptance of the updated policy.

11 Contact Us

• General Support: [email protected]
• Privacy & Data Requests: [email protected]
• Developer: Ryan — Independent Software Developer, Philippines
• Response Time: Within 15 business days for privacy requests; 24 hours for general support.

You may also submit a complaint to the National Privacy Commission of the Philippines at www.privacy.gov.ph.