Join the waitlist

← Home

Privacy policy

How we handle personal data for Buckery in the UK, Ireland, the US, Canada, and Australia.

Last updated: 2 November 2026.

Who we are

The controller is Ingenium Software Engineering Limited. Registered office: Belmont Suite, Paragon Business Park Chorley New Road, Horwich, Bolton, England, BL6 6HG. Company number: 13334667. ICO registration number: ZB147122.

Privacy email: privacy@buckery.app. You can also use the contact form and say it is a privacy request.

The rules

We follow the privacy law of each market we serve. Analytics cookies stay off until you agree, where the cookie policy says we ask first.

United Kingdom

UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The regulator is the Information Commissioner’s Office (ICO). Our ICO registration number is ZB147122. The Privacy and Electronic Communications Regulations (PECR) also apply to cookies and electronic mail.

Ireland

The EU General Data Protection Regulation (GDPR). The regulator is the Data Protection Commission.

United States

For California residents, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Canada

The Personal Information Protection and Electronic Documents Act (PIPEDA). The regulator is the Office of the Privacy Commissioner of Canada.

Australia

The Privacy Act 1988 and the Australian Privacy Principles. The regulator is the Office of the Australian Information Commissioner (OAIC).

What we collect

  • Your account email, when you create an account.
  • Your social login profile — name, email, and avatar — when you sign in with Google, Microsoft, Apple, or Facebook.
  • Budget data you save to an account, stored in Cloudflare D1. That is the buckets, amounts, timings, debts, and What-Ifs in the model.
  • Your email, if you join the waitlist.
  • Google Analytics 4 usage data, and only after you consent.

A copy of the model can also stay in the browser until you clear it. We do not sell personal data, and we do not ask for special category data.

Why we use it

  • Account, profile, and budget data. To provide Buckery. Lawful basis: contract (UK GDPR Article 6(1)(b)).
  • Waitlist. To write to you about Buckery. Lawful basis: consent (Article 6(1)(a)). You can withdraw that consent at any time. Withdrawing it does not affect an email we have already sent.
  • Analytics. To see how the website is used. Lawful basis: consent (Article 6(1)(a)), and PECR. This stays off until you accept.
  • Payments. To take payment for a plan, when Stripe is switched on. Lawful basis: contract. We do not take payment yet, and we will not store your full card number.
  • Messages you send us. To reply. Lawful basis: legitimate interests (Article 6(1)(f)) in answering you.

Who we share it with

These organisations process personal data for us:

  • Cloudflare — hosting, and Cloudflare D1 for budget data saved to an account.
  • Resend — account emails, such as a sign-in link.
  • Formspree — the waitlist and the contact form on this website.
  • Google, Microsoft, Apple, and Facebook — sign-in, when you choose that provider. We receive the profile they return.
  • Google Analytics 4 and Google Tag Manager — only after you consent.
  • Stripe — payments, coming later. Not used yet.

How long we keep it

  • Account, profile, and budget data: while the account exists. After you delete the account, we remove them from the live database. Backups are kept for 30 days after deletion.
  • Waitlist email: deleted 12 months after launch, or when you unsubscribe.
  • Analytics cookies: see the cookie policy. Google Analytics 4 data is kept for 14 months.
  • Messages you send through the contact form: kept for 12 months.
  • Sign-in session: 7 days, in the cookie __Secure-better-auth.session_token.
  • Sign-in presence: 7 days, in the cookie buckery.session. The value is 1. It records that the sign-in cookie is present. It is not the session token.

Your rights

You can ask us for:

  • access to the personal data we hold about you
  • rectification, if it is wrong
  • erasure
  • restriction of processing
  • portability of data you provided, where the basis is contract or consent
  • objection, where the basis is legitimate interests
  • withdrawal of consent, where we rely on consent

To delete an account, and the model stored with it, use the data deletion page. We aim to reply within one month. We do not usually charge a fee.

Rights in Ireland, California, Canada, and Australia

Use the privacy email or the contact page for access, correction, deletion, or a question about transfers. The same contact details work across these markets. We aim to reply within one month.

In Ireland, the GDPR gives you the same kinds of rights listed above, including access, rectification, erasure, restriction, portability, objection, and withdrawal of consent.

If you are a California resident, CCPA/CPRA gives you the right to know what personal information we collect, the right to delete it, the right to correct it, and the right to opt out of the sale or sharing of personal information. We do not sell personal information, and we do not share it for cross-context behavioural advertising. You can still send an opt-out request. We will not discriminate against you for exercising these rights.

In Canada, PIPEDA gives you the right to access the personal information we hold about you, and to challenge its accuracy. In Australia, the Australian Privacy Principles give you the right to access and correct your personal information.

International transfers

Some of these processors are in the United States. When personal data leaves the UK or Ireland, we use the transfer tools that apply: a UK or EU adequacy decision, the UK–US data bridge when the recipient is certified under the UK Extension to the EU–US Data Privacy Framework, the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses. Certified under the UK Extension: Cloudflare, Resend, Google, Microsoft, and Stripe.

Apple, Meta (Facebook sign-in), and Formspree are not certified under the UK Extension. Transfers to them use the UK IDTA, or the Addendum to the EU Standard Contractual Clauses.

Transfers from Canada follow PIPEDA. Transfers from Australia follow Australian Privacy Principle 8.

Complaints

You can complain to us first at the privacy email. You can also complain to the regulator for your market:

  • United Kingdom: the Information Commissioner’s Office at ico.org.uk. Our ICO registration number is ZB147122.
  • Ireland: the Data Protection Commission at dataprotection.ie.
  • California: the California Privacy Protection Agency at cppa.ca.gov, or the California Attorney General at oag.ca.gov/privacy/ccpa.
  • Canada: the Office of the Privacy Commissioner of Canada at priv.gc.ca.
  • Australia: the Office of the Australian Information Commissioner at oaic.gov.au.

The other pages

The terms cover how Buckery may be used. The cookie policy lists the cookies.