Privacy policy
This is the whole account of what Okolo knows about you and what it does with it. It is short because we know little, on purpose.
Controller
Okolo is developed by Roman Podolák. Before the public launch a company will take over the service and will be named here together with a contact for questions about personal data.
An account without an identity
Creating an account makes a random 16-digit number and a pair of keys on your phone. The server knows only the number, the public keys, the day of creation and the day of the last sign-in. We store no name, e-mail, phone number or IP address.
Your financial data
Payments, accounts, budgets, notes and receipt photos are encrypted on your phone with a key only you hold (in the recovery phrase). The server keeps encrypted envelopes it cannot open. Household sharing is encrypted with a household key the server does not know either.
Bank connections
Banks are connected through a licensed account information service provider (Enable Banking Oy, Finland, PSD2 licence). You sign in at your bank; neither we nor the provider ever receive your bank password. Payment data passes through the server only at the moment it is fetched and is sealed for your phone at once; the server keeps only an encrypted connection that your phone alone can open. Consent lasts at most 180 days and can be revoked at any time in the app or at your bank.
Statements and tokens
Statement files (CSV, camt.053, OFX, MT940, QIF) are processed on your phone only. A Fio banka token stays on the phone, which calls the bank directly.
Rates, shops and maps
Exchange rates come from the European Central Bank. Shop names are completed from public OpenStreetMap data the server downloads in advance; the phone asks for a country, never for a particular shop.
What else we keep
Messages from "Write to us" (anonymous unless you attach your account number). The e-mail from the waiting list on this site: used for a single launch message and deleted afterwards. No analytics, no cookies, no tracking in the app or on this site.
Where the data is
On a server in the European Union that we run ourselves. The server keeps no access logs, so account numbers cannot be linked to IP addresses. Backups contain only encrypted data.
For how long
As long as you use the account. An account with no sign-in for two years deletes itself with everything in it. In the app you can delete the account and all data from the server at once (Security and privacy → Delete the account from the server too).
Your rights
Access, rectification, portability and erasure are all in the app (export, edit, delete), since only you can read your data. For questions use "Write to us" in the app or the contact on the Support page. You may complain to the Slovak Data Protection Office (Úrad na ochranu osobných údajov SR).
Changes
Changes are noted here with a date and announced in the app. Last change: 11 November 2026.