Privacy Policy

Overview

Monera is a personal finance application that helps you track and understand your spending. This Privacy Policy explains what information we handle and how.

Google Sign-In and Google User Data

Monera uses Google OAuth to authenticate you. When you sign in, Google provides the following data. Below is a precise description of each item, its purpose, and how it is handled:

• Email address— used as a unique identifier to route Google Drive API calls to the correct user's storage folder. It is never stored on Monera servers and is not shared with any third party.
• Name — received in the authentication response but not displayed or used by the application.
• Profile picture — received in the authentication response but not displayed or used by the application.
• OAuth access token — used to make authenticated requests to the Google Drive API on your behalf (reading, writing, creating, and deleting files within the Monera folder only). Stored exclusively in a secure, server-side HttpOnly cookie and never exposed to JavaScript or transmitted to third parties.
• OAuth refresh token — stored in the same HttpOnly cookie to automatically renew the access token when it expires, so you do not need to sign in again. Used only server-side; never exposed to the browser or shared with any third party.

We do not have access to any Google account data beyond what is described above.

Your Data Lives in Your Google Drive

All financial data — imported statements, categories, settings, and manual transactions — is stored in a private Monera/ folder in your own Google Drive. Monera requests only the drive.file scope, which limits access strictly to files the app itself created. We cannot read the rest of your Drive.

Specifically, Monera performs the following Drive operations:

• Creates and maintains a Monera/ folder with subfolders revolut-exports/ and app-data/
• Reads and writes JSON data files: transaction records, category overrides, settings, category rules, exclusions, and a parse cache
• Uploads CSV bank statement files you import into the app
• Deletes files when you remove data within the app

No Server-Side Database

Monera does not operate a backend database. Your financial data never passes through or is stored on Monera servers. The application server only handles authentication and serves the web application — it does not persist any personal or financial information.

Cookies and Sessions

Monera uses a secure, server-side HttpOnly session cookie to keep you signed in. This cookie contains your Google OAuth access token, refresh token, and token expiry time — used solely to authenticate Drive API calls on your behalf. It is never exposed to JavaScript and is cleared when you sign out.

Data Caching in Your Browser

Transaction data fetched from your Google Drive is held only in your browser's memory during your session (using TanStack Query) so the app does not have to re-fetch it as you navigate. It is not written to persistent storage and is discarded when you refresh the page, close the tab, or sign out.

Monera also stores your transaction-list filter preferences (search text, selected category, date range, and sort order) in your browser's sessionStorage, which clears automatically when you close the tab. This contains no financial data and is never transmitted to Monera servers.

Data Retention and Sign-Out

When you sign out, the session cookie — containing your OAuth access and refresh tokens — is cleared immediately, and the in-memory transaction cache is discarded. No personal data is retained on Monera servers after sign-out. Your financial data remains in your own Google Drive and can be deleted there at any time.

Analytics

Monera uses Vercel Analytics to collect anonymous, aggregated page-view and performance data (such as page load times and navigation paths). This service does not receive your name, email address, financial data, or any other personally identifiable information.

Google API Limited Use Policy

Monera's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: Google user data is used solely to provide and improve the features of Monera that are visible to you. It is not used for serving advertisements, is not sold or shared with third parties for any purpose, and is not used for any purpose that is unrelated to the app's core function of helping you track your personal finances.

Data Sharing

We do not sell, share, or transfer your personal or financial data to any third party. The only external services involved are Google (authentication and Drive storage, under Google's own privacy terms) and Vercel Analytics (anonymous usage metrics only, as described above).

Contact

If you have questions about this policy, you can reach us at alex12-christou@hotmail.com.