Privacy Policy

Last updated: October 8, 2026

The short version: we collect only what’s needed to run Lilac: your account details and the money information you choose to add. We never connect to your bank, never sell your data and never show ads. You can delete everything from inside the app.

1. Who we are

Lilac (“we”, “us”) provides the Lilac app and website and is responsible for your personal data as described here. A contact email for privacy requests will be published on this page before Lilac launches.

2. What we collect

Account details: your name and email address, and your password, which is stored only in a securely hashed form that we can’t read.
What you add to Lilac: income and spending entries (name, amount, category, date), your budgets, bills, savings amount and goals.
Subscription details: which plan you chose, your trial dates and whether your subscription is active. Payment card details are handled by the app store or payment provider and are never seen or stored by us.
Waitlist: if you join the waitlist on our website, your email address.
Technical data: basic information our hosting provider records to keep the Service secure and working, such as IP address, device and browser type and the time of requests.

We don’t ask for your bank login, we don’t read your bank or card transactions, and we don’t use advertising or cross-app tracking.

3. How we use it

to create and secure your account and let you log in;
to calculate your figures (such as safe to spend today), show your history, budgets and goals;
to manage your free trial and subscription;
to send emails you need, such as account confirmation, password reset and, if you joined the waitlist, our launch email;
to keep the Service safe, fix problems and comply with the law.

We process your data to provide the Service you asked for (performance of a contract), for our legitimate interest in keeping it secure and working, with your consent where we ask for it (such as the waitlist), and where the law requires.

4. Who we share it with

We don’t sell or rent your personal data. We share it only with service providers that help us run Lilac, under agreements that protect it:

Supabase, which hosts our database, login and email sending, on servers in the United States (North Virginia);
Apple, Google or our web payment provider, when you buy a subscription through them;
Google Fonts, which our website loads its font from, which means your browser contacts Google’s servers.

We may also disclose data if required by law or to protect the rights and safety of our users and the Service.

5. International transfers

Our servers are in the United States, so your data may be processed outside the country where you live. Where the law requires, we rely on appropriate safeguards for these transfers, such as standard contractual clauses.

6. How long we keep it

We keep your data while your account is open. When you delete your account (Profile → Delete account), your account and everything in it are removed from our database straight away. Copies in our hosting provider’s backups are deleted automatically on their regular schedule, normally within 30 days. Waitlist emails are kept until launch and then deleted if you don’t create an account, unless you ask us to remove them sooner.

7. Security

Data is encrypted in transit (HTTPS) and at rest by our hosting provider. Each account can only access its own data, enforced in the database itself. No system is perfectly secure, but we work to protect your information and will notify you and the authorities of a breach where the law requires.

8. Your rights

Depending on where you live (including under Brazil’s LGPD, the EU and UK GDPR and California’s CCPA), you can ask to access, correct, download, delete or restrict the use of your personal data, object to certain uses, and withdraw consent. You can edit your name and delete your account directly in the app; for anything else, contact us at the email published on this page and we’ll reply within the time the law requires. You can also complain to your local data protection authority (in Brazil, the ANPD).

9. Children

Lilac isn’t meant for children under 13, and we don’t knowingly collect their data. If you believe a child has given us personal data, contact us and we’ll delete it.

10. Changes

If we change this policy in a meaningful way, we’ll tell you in the app or by email before the change takes effect. The date at the top shows the latest version.

11. Contact

A contact email for questions and privacy requests will be added here before Lilac launches.