Privacy Policy
Last updated: October 13, 2026
The short version: we collect only what’s needed to run Lilac: your account details and the money information you choose to add. We never connect to your bank, never sell your data, never show ads and use no tracking cookies. You can delete everything from inside the app.
1. Who we are
Lilac (“we”, “us”) provides the Lilac app and website and is responsible for your personal data as described here. You can reach us anytime at [email protected].
2. What we collect
- Account details: your name and email address, and your password, which is stored only in a securely hashed form that we can’t read.
- What you add to Lilac: income and spending entries (name, amount, category, date), your budgets, bills, savings amount and goals, and a profile photo if you choose to add one.
- Your preferences: the language you use Lilac in, saved on your account so our emails come in it, and choices like light or dark appearance, saved on your device.
- Subscription details: which plan you chose, your trial dates and whether your subscription is active. Payment card details are handled by the app store or payment provider and are never seen or stored by us.
- Waitlist: if you leave your email on our website to hear when the iPhone and Android apps are out, your email address. If you took our money quiz and left your email before October 13, 2026, the answers you gave were saved with it.
- Money quiz: the answers you give in the quiz on our website are kept only on your device, so Lilac can start your plan from them when you open the app. They aren’t sent to us unless you create an account and save that plan.
- Website visits: we count, without cookies and without anything that identifies you, the steps people take on our website: a visit, the quiz opened, started and finished, and the app opened. Each count records only the step, the page, the language and the site or link people came from.
- Logging in on a computer with your phone: when you use the QR code, we briefly keep the code, the computer’s browser and system (for example “Chrome on Windows”, shown on your phone before you approve) and a one-time sign-in token. The camera is used only on your phone, to read the code; no image or video is recorded or sent to us.
- Technical data: basic information our hosting provider records to keep the Service secure and working, such as IP address, device and browser type and the time of requests.
We don’t ask for your bank login, we don’t read your bank or card transactions, and we don’t use advertising or cross-app tracking.
3. How we use it
- to create and secure your account and let you log in, including on a computer when you approve it from your phone;
- to calculate your figures (such as safe to spend today), show your history, budgets and goals;
- to manage your free trial and subscription;
- to send emails you need, such as account confirmation, password reset and, if you joined the waitlist, our launch email;
- to understand, in totals, how people use our website, so we can improve it;
- to keep the Service safe, fix problems and comply with the law.
We process your data to provide the Service you asked for (performance of a contract), for our legitimate interest in keeping it secure and working, with your consent where we ask for it (such as the waitlist), and where the law requires.
4. Who we share it with
We don’t sell or rent your personal data. We share it only with service providers that help us run Lilac, under agreements that protect it:
- Supabase, which hosts our database and login, on servers in the United States (North Virginia);
- Resend, which delivers our account emails (such as confirmation and password reset), on servers in the United States;
- Cloudflare, which hosts our website and web app and forwards emails sent to our contact address;
- Stripe, our payment provider for the web app, when you subscribe to Lilac Plus there; Apple or Google when you subscribe through their stores;
- Google Fonts, which our website loads its font from, which means your browser contacts Google’s servers.
Lilac AI (a Lilac Plus feature) answers inside Lilac from your own numbers; your messages aren’t sent to an outside AI provider. If that ever changes, we’ll update this policy before it does.
We may also disclose data if required by law or to protect the rights and safety of our users and the Service.
5. International transfers
Our servers are in the United States, so your data may be processed outside the country where you live. Where the law requires, we rely on appropriate safeguards for these transfers, such as standard contractual clauses.
6. How long we keep it
We keep your data while your account is open. When you delete your account (Profile → Delete account), your account and everything in it are removed from our database straight away. Copies in our hosting provider’s backups are deleted automatically on their regular schedule, normally within 30 days. Waitlist emails are kept until the iPhone and Android apps launch and then deleted if you don’t create an account, unless you ask us to remove them sooner. Computer log-in codes expire after 3 minutes and work only once; old ones are cleared out as new codes are made. Website visit counts contain nothing that identifies you.
7. Security
Data is encrypted in transit (HTTPS) and at rest by our hosting provider. Each account can only access its own data, enforced in the database itself. No system is perfectly secure, but we work to protect your information and will notify you and the authorities of a breach where the law requires.
8. Your rights
Depending on where you live (including under Brazil’s LGPD, the EU and UK GDPR and California’s CCPA), you can ask to access, correct, download, delete or restrict the use of your personal data, object to certain uses, and withdraw consent. You can edit your name and delete your account directly in the app; for anything else, email us at [email protected] and we’ll reply within the time the law requires. You can also complain to your local data protection authority (in Brazil, the ANPD).
9. Children
Lilac isn’t meant for children under 13, and we don’t knowingly collect their data. If you believe a child has given us personal data, contact us and we’ll delete it.
10. Changes
If we change this policy in a meaningful way, we’ll tell you in the app or by email before the change takes effect. The date at the top shows the latest version.
11. Contact
For questions about this policy or to make a privacy request, email us at [email protected]. We’ll get back to you as soon as we can.