Vicino Labs
n.Nomio

Privacy Policy

Effective 2026-10-01Version 4.0Operator Vicino Labs

Nomio is a multi-currency budgeting app made by Vicino Labs. We'd rather be precise than vague about how your information is handled: your financial records never leave your device, and we don't run any server.

1. Data controller

Trading name
Vicino Labs (sole proprietorship, Einzelunternehmen)
Owner
Jeong-Hwan Lee
Address
Ruhrallee 41, 44139 Dortmund, Germany
Email
contact@vicinolabs.com
Legal notice
vicinolabs.com/impressum

Vicino Labs is the “controller” under the EU General Data Protection Regulation (GDPR) for personal data processed in connection with this app.

2. Summary

  • No account or sign-in. Expenses, income, accounts, budgets and receipt photos are stored only on your device — we cannot see them.
  • The free version shows Google AdMob ads. In the EU/EEA, UK and Switzerland we ask for your consent first using Google's consent form, and you can change your choice anytime in Settings › Ad privacy settings.
  • Exchange rates come from exchangerate-api.com; your device's IP address is visible to that service.
  • Google Drive backup runs only when you start it and uses a hidden, Nomio-only folder in your own Drive.
  • No analytics or tracking SDKs (e.g. Firebase Analytics). Reminders appear inside the app only — there are no push notifications.

3. Data stored on your device

  • Expense and income entries (amount, currency, category, date, note, receipt photo), accounts, assets/liabilities, budgets, savings goals, recurring transactions
  • App settings (language, base currency, theme, font size, app lock, etc.) and the most recently downloaded exchange rates
  • Whether you bought Premium (a “purchased” flag only)

This information stays in the app's private storage on your device (an SQLite database and the app folder). Nomio has no server, so we can neither see nor receive it. It is deleted when you uninstall the app or use the reset options in Settings. Legal basis: providing the app's features (Art. 6(1)(b) GDPR).

4. Exchange rates

To show current rates, the app requests rates for your base currency from exchangerate-api.com (ExchangeRate-API). The request contains only currency codes, but as with any internet request your device's IP address and basic connection data reach that service and are processed under its own privacy policy. Downloaded rates are stored on your device for offline use. Legal basis: our legitimate interest in accurate conversions (Art. 6(1)(f) GDPR).

5. Advertising (Google AdMob) and consent

The free version shows banner ads through Google AdMob, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google and its ad partners may process your advertising ID (Android advertising ID; on iOS the IDFA, only if you allow App Tracking Transparency), IP address, device and app information, and ad impression/click data.

  • EU/EEA, UK and Switzerland: before any ads are loaded, the app shows a consent form from Google's certified consent management platform (UMP, IAB TCF). Personalized ads and access to device storage happen only with your consent (Art. 6(1)(a) GDPR, § 25 TDDDG). You can use the app fully without consenting; you may then see non-personalized (limited) ads.
  • You can change or withdraw your choice anytime in Settings › Ad privacy settings. Withdrawal does not affect processing carried out before it.
  • Google may transfer data to the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework.
  • With Premium, no ads are requested at all.

More: How Google uses data from partner sites and apps, Google Privacy Policy.

6. In-app purchase (Premium)

Premium (no ads plus extra features) is a one-time in-app purchase through Google Play or the Apple App Store. Payment and payment data are handled entirely by the store — we never receive card details. The app only receives the store's purchase confirmation and stores a “purchased” flag on your device. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

7. Google Drive backup (optional)

The following happens only when you start a Google Drive backup or restore in Settings:

  • Google Sign-In confirms your Google account (email address).
  • The app saves and reads a backup file (transactions, accounts, categories, budgets, recurring rules, settings) in a hidden, Nomio-only folder in your own Google Drive (the drive.appdata scope). This permission cannot access your other Drive files, email or contacts.
  • The file travels only between your device and your Google account — never through a server of ours.

Deleting the backup: open Google Drive settings › Manage apps on the web and choose “Delete hidden app data” for Nomio. You can revoke the app's access under Google Account › Third-party connections. Legal basis: providing a feature you requested (Art. 6(1)(b) GDPR).

8. Receipt photos and amount recognition

The camera and photos are used only when you choose to attach a receipt. The photo is copied into the app folder and stays on your device; it is never uploaded. Reading the amount from the photo happens on your device (Android: Google ML Kit; iOS: Apple Vision). Google ML Kit may send Google limited diagnostic information (such as device model, app version and feature usage) to improve the service, but not the content of your photos.

9. PDF reports

When you create a monthly PDF report, the app downloads font files from Google Fonts (fonts.gstatic.com) so that all languages render correctly; your device's IP address is transmitted to Google in the process. The report itself is generated on your device, and you decide whether to share it. Legal basis: providing a feature you requested (Art. 6(1)(b) and (f) GDPR).

10. App lock, reminders and ratings

If you turn on app lock, the app uses your device's biometrics (fingerprint, Face ID, etc.) or screen lock. Biometric data is processed only in the device's secure hardware; the app receives just a pass/fail result. Budget and recurring-transaction reminders are shown inside the app only — no push notifications and no server. The rating prompt is shown and handled by Google Play/Apple.

11. Recipients and international transfers

We don't pass your financial records to anyone. Only in the cases described above do the following services process data under their own policies: Google (ads, in-app purchase, Drive backup, ML Kit, Google Fonts), Apple (in-app purchase, iOS) and ExchangeRate-API (exchange rates). Transfers outside the EU (e.g. to the USA) rely on the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses.

12. Retention and deletion

Data on your device is kept until you delete it (reset options, deleting entries, uninstalling the app). A Google Drive backup stays in your Drive until you delete it as described above. Ad-related data follows Google's retention policies.

13. Children

Nomio is not directed at children. Consent to personalized ads may only be given by people aged 16 or older (Art. 8 GDPR, as applied in Germany). If you are under 16, please do not consent in the ad consent form.

14. Your rights

  • Access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). You may object at any time to processing based on legitimate interests.
  • Withdraw consent at any time (ads: Settings › Ad privacy settings).
  • Lodge a complaint with a supervisory authority — e.g. the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW) or the authority where you live.

Because most data lives only on your device, you can view, correct and delete it directly in the app (Settings › Backup exports CSV/JSON). For anything else, write to contact@vicinolabs.com.

15. Changes to this policy

We may update this policy when the law or the app's features change. Changes and the effective date are posted on this page; significant changes are also announced in the app.

16. Contact

For questions or requests about data processing, please contact:

OperatorVicino Labscontact@vicinolabs.com