Privacy policy

tambo. is developed and operated by Patricio Albornoz, Argentina. For privacy questions or requests, contact pato@tambo.cc.

tambo. works primarily on device. Expenses, income, local accounts, monthly budgets, categories, fixed expenses, income schedules, notes, attachments, preferences, and saved exchange rates remain in the app’s storage on your device.

• The optional profile (name, surname, nickname, and photo reference) is saved using secure system storage, including Keychain on iOS. tambo. does not request a password.
• Profile photos and receipts are saved in the app’s private files.
• JSON backups leave the device when you choose to share them or save them to an external destination. They include expenses, income, accounts, categories, monthly limits, fixed expenses, and income schedules; they exclude attachments, your profile, and preferences. CSV exports contain expenses only for use in spreadsheets.

tambo. works without registration or sign-in. You can customize an optional local profile. Expense accounts organize your data on the device; they are not bank accounts or remote service accounts.

• tambo. does not maintain a server-side user account database.
• The optional Mercado Pago connection authorizes importing transactions; it does not create a tambo. account or synchronize your data between devices.

If you choose to connect Mercado Pago, you authorize access on the provider’s page through OAuth. tambo. does not receive your Mercado Pago password. You can use the rest of the app without connecting this service.

The app queries Mercado Pago’s API directly for account and transaction information, including identifiers, amounts, currencies, dates, descriptions, statuses, payment types, and refunds. It stores transactions and imported expenses or income on your device to organize your records and avoid duplicates. Your complete financial history is not sent to a tambo. server.

Access and refresh credentials, your Mercado Pago user identifier, permissions, and expiration time are saved in secure system storage. Credentials are not included in JSON backups or CSV exports. The tambo. service hosted on Cloudflare processes the codes and credentials needed to authorize and renew the connection without storing them in a server database.

If connection or synchronization fails, the app automatically sends a diagnostic report to the tambo. service on Cloudflare to investigate and fix the problem. It includes the error category and code and, when relevant, the value received in the currency field, its data type, and the payment status. Values are validated and limited before logging. Technical authorization errors are also logged.

These diagnostics do not include amounts, transaction descriptions, notes, attachments, user or payment identifiers, passwords, access credentials, or complete Mercado Pago responses. Cloudflare also processes technical connection data, such as IP address, time, and request metadata, to operate the service and limit abuse.

Cloudflare provides the authorization and diagnostic infrastructure and may process data outside Argentina, including the United States and other countries where it operates. The Mercado Pago and Cloudflare policies linked below describe their respective processing. For questions about these diagnostics or to exercise your rights, contact pato@tambo.cc.

To retrieve exchange rates, the app requests public data from DolarAPI. The request does not include your expenses, income, notes, accounts, or files. As with any internet connection, the provider and network infrastructure may receive technical data such as IP address and request time.

• The app uses system services for the camera, photos, files, secure storage, and composing email. Fixed expenses do not send notifications.

The tambo.cc website uses PostHog to understand website usage and detect errors. It may record page views, clicks, video playback, contact link opens, and technical browser, device, and connection data, such as IP address. PostHog may use cookies or local storage to distinguish visits and sessions. This data is processed through PostHog and used to improve the website and resolve technical issues.

The mobile app does not integrate PostHog or send your expenses, income, receipts, or profile to this service. Analytics applies to browsing the website. The hosting provider may also generate security and delivery logs.

You can manage cookies and storage in your browser. For questions about browsing data, its retention, or a deletion request, contact pato@tambo.cc. The PostHog privacy policy linked below describes its practices as a provider.

The website also uses the Google Ads tag for advertising measurement, with advertising and analytics storage, advertising user data, and personalization disabled. Google may receive limited cookieless signals; these are not app installs. If you arrive from our Google campaign, we store only its campaign name for the browser tab session and include it in App Store links to view aggregate results in App Store Connect. No expenses or other financial data from the app are sent.

If you email pato@tambo.cc, we receive your email address, message content, and any files you choose to attach. The feedback form also includes the expense account name, app version, device model and operating system, and language, which you can review before sending. We use that information to respond and resolve your request, keep it only as long as reasonably necessary, and will delete it upon request.

• tambo. does not sell personal data.
• tambo. uses no advertising networks.
• tambo. includes no cross-app or cross-site tracking tools.
• tambo. does not upload your complete expense and income history, notes, or attachments to the developer. Automatic diagnostics are limited to the data described in this policy; email support receives what you choose to send.

You can delete expenses, income, or local accounts in the app. Deleting an expense account removes its records and attachments, but not your profile; at least one account must remain. You can clear profile fields and remove its photo in the editor. Removing the app deletes its database and files; iOS may retain secure storage data. Exported backups must be deleted separately.

Disconnecting Mercado Pago deletes the credentials saved by tambo. for that local account and stops future synchronization. Imported records remain until you delete them. To also revoke the provider’s authorization, manage permissions in Mercado Pago. Deleting data in tambo. does not delete the originals in Mercado Pago.

Diagnostics are temporarily retained in Cloudflare Workers Logs for up to seven days, depending on the service plan. Removing the app or disconnecting Mercado Pago does not immediately delete existing technical logs. If you share a diagnostic report by email, that copy is retained under the support section.

Under Argentina’s Law 25,326, you may request access, correction, updating, or deletion of personal data controlled by the controller. Because financial information is stored locally, you can manage it directly in the app. For any additional request, contact pato@tambo.cc.

tambo. uses private app storage and secure system storage for the profile and connection credentials. It offers options to hide amounts and request device authentication when available. The operating system manages biometric data; tambo. receives the authentication result. No system is infallible. This policy may change if features or legal requirements change; the current version will be posted here.

• Argentina Law 25,326
• Rights before the AAIP
• DolarAPI legal notice
• PostHog privacy policy
• Google privacy policy
• Mercado Pago privacy center
• Cloudflare privacy policy
• Cloudflare Workers Logs retention