Privacy Policy

Who we are

Titily was created and is managed by BT SOFTWARE LTDA, Brazilian corporate taxpayer ID (CNPJ) 35.817.526/0001-43, with business address at Rua Elio del Chiaro, 355, São José dos Campos - SP. For privacy requests and data subject rights, email admin@titily.com.br.

Data we collect

• Account: name, email, optional phone number, coupon entered at signup, password (stored as a one-way hash), preferred language and time zone.
• Finances you enter: entries (amount, date, description, category, payment method, merchant), budgets, cards and statements, investments, recurring bills and installments. Titily does not connect to banks and never asks for bank passwords.
• Household: household name, currency, financial month, free-access terms and coupon, members and invitations sent (including the invitee's email).
• Devices and access: device model or browser, operating system, IP address, sign-in date and time, active sessions and the device's push notification token.
• Notifications: notifications generated for you and your channel preferences.
• AI assistant, when used: your typed request or voice recording, transcript, reply and the details needed to identify your household's categories, payment methods, accounts and period.

We do not collect biometric data: Face ID and fingerprint are checked by your phone, and Titily only receives the system's "confirmed" answer. Receipt reading (OCR) happens on your phone or in your browser; the photo is not sent to our servers.

How we use it

• To create and maintain your account and household and show your numbers.
• To send required emails: email confirmation, password reset, invitations and security alerts.
• To send notifications and summaries you can turn off anytime in Settings.
• To prevent fraud and abuse: sign-in rate limits, account blocking and access logs.
• For support, operations and improving the service.

We do not sell your data, show ads or use your financial data for advertising.

AI assistant pilot

The assistant appears only for enabled households after you accept its use. If you send audio, the recording goes to OpenAI for transcription. The text or transcript and the necessary household context are sent to interpret your request. Titily stores the protected conversation and operation result so you can continue, review and undo entries; check amounts, dates and payment methods.

You can keep logging manually without the assistant. AI can misunderstand a request and asks for clarification when details are missing.

Access by the Titily team

To provide support, investigate issues and keep the service secure, Titily's administrative team can view account data, including entries and budgets. Access is limited to very few people, requires two-step verification, and every view is recorded in an audit log showing who accessed what and when.

Who we share it with

We use providers that process data on our behalf, under contract and only to deliver the service:

• Railway — application and database hosting (United States).
• Zoho Mail — transactional email delivery and contact mailboxes.
• OpenAI — audio transcription and interpretation of typed or spoken requests when you use the assistant pilot.
• Google Firebase Cloud Messaging and Apple Push Notification service — mobile notifications.
• Browser push services (Google, Mozilla, Apple, Microsoft) — web notifications, if you turn them on.
• The contact mailbox provider, when it receives messages sent to admin@titily.com.br.

Members of the same household see each other's entries, budgets and names. We may also share data when required by law or by a competent authority.

International transfers

Some providers are located outside your country. In those cases we rely on appropriate safeguards, such as contractual clauses and providers with adequate protection standards.

How long we keep it

• Account and household data: for as long as the account exists.
• When you delete your account: the account is removed; some records may be retained for legal or security reasons. If you are the only member of the household, its entries, budgets and categories are erased too. Backups may remain for a limited period under the hosting provider retention policy.
• Technical access records: for the period needed for security and applicable legal obligations.
• Audit logs are retained for security and legal obligations.

Your rights

Under Brazil's LGPD (article 18), you can: confirm whether we process your data; access and get a copy; correct it; request anonymization, restriction or deletion; port it; learn who we share it with; and withdraw consent.

You can do much of this yourself: edit your profile in Settings, export your entries as CSV on the web portal and delete your account under Settings › Delete my account. For anything else, write to admin@titily.com.br. You may also complain to the Brazilian data protection authority (ANPD).

Security

We use encrypted connections (HTTPS) for all traffic, hashed passwords, expiring sessions, lockout after failed attempts, two-step verification for administrators and isolation of each household's data. No system is 100% secure; if an incident puts you at risk, we will notify you and the authorities as required by law.

Cookies and local storage

The web portal uses a single essential cookie for your session and stores your chosen language and, if you use AI, your consent and pending-request state in the browser. We do not use advertising or third-party tracking cookies.

Children

Titily is intended for people aged 18 and over. Minors should only use it with a parent or legal guardian, within a household created by them.

Changes to this policy

We may update this policy. If a change is significant, we will let you know in the app, on the web portal or by email before it takes effect.