Clast Privacy Policy

Last updated: August 25, 2026. This Privacy Policy explains how Individual Entrepreneur Vladislav Kalashnikov handles information in the Clast iPhone app and on the related support pages at vldklsnkv.me. Contact: hi@vldklsnkv.me, +995 575 753 648.

Data stored on your device. Clast stores the financial information you enter, including transactions, accounts, categories, budgets, recurring items, preferences, and assistant chat history, in the app’s local storage on your device. Clast does not require a Clast account. Local backup files are created only when you export them or enable the app’s automatic local backup feature, and you control where exported files are subsequently stored or shared.

Optional account and sign-in. You can use Clast in guest mode without creating an account. If you choose Sign in with Apple or Google, the selected identity provider and Supabase Auth may process and store an account identifier, email address, and name when the provider makes those details available. Clast uses this information only to authenticate you, restore your session, and protect the account; it is not used for advertising or tracking.

AI-assisted features. Before Clast sends information to third-party AI services for the first time, it asks for your permission. If you allow it and choose to use the assistant, receipt recognition, screenshot recognition, or AI-assisted file import, the content you submit may be sent for processing. This can include prompts, receipt or screenshot images, extracted statement text, transaction details, category names, currency settings, and relevant conversation context. Requests are processed through our service infrastructure, OpenRouter, and model providers selected through OpenRouter. Do not submit information that is not necessary for the requested feature.

Subscription information. Purchases are processed by Apple through the App Store. We do not receive your payment card details. Clast receives subscription entitlement information from Apple and may send a pseudonymous app account identifier and subscription verification information to our service infrastructure to confirm access to paid online features and prevent abuse.

Device permissions. Clast accesses the camera, photo library, files, or notifications only when you use a related feature or grant permission. Photos and files selected for AI-assisted extraction may be transmitted as described above. You can manage permissions in iOS Settings.

Support communications. If you contact support, we process the contact details and message content you provide in order to respond, troubleshoot issues, prevent abuse, and maintain necessary business records. Please do not send passwords, bank credentials, payment card details, or full unredacted financial records.

Optional app analytics. Product analytics are disabled by default and can be enabled or disabled in Clast Settings. When enabled, Clast sends a limited set of product-interaction events to PostHog, such as app and session starts, onboarding completion, sign-in provider, guest mode, paywall views, and whether a transaction was created. These events use a pseudonymous installation identifier and session identifier. They do not include financial amounts, transaction descriptions, comments, account identifiers, names, or email addresses. Clast disables IP-based geolocation for these events and does not use them for advertising or tracking.

Website data. The portfolio and support website does not create user accounts. If you submit its feedback form, Supabase stores the answers you provide and may process IP address and user-agent data for security and spam prevention. The website is hosted on Vercel and uses Vercel Analytics, Vercel Speed Insights, Google Analytics, and PostHog to measure usage and performance. PostHog Session Replay masks form inputs; captured network-request names are stripped of query strings and fragments.

Service providers. We use service providers only for the purposes described in this policy and require them to protect personal information consistently with this policy and applicable law. These providers include Apple and Google for optional sign-in, Apple for subscriptions, Supabase for authentication, service infrastructure, and website feedback, PostHog for optional app analytics and website analytics, Vercel and Google Analytics for website hosting and measurement, and OpenRouter and its selected model providers for AI processing.

Retention and deletion. Information stored only on your device remains there until you delete it in Clast, delete local backup files, or remove the app, subject to iOS backup behavior. Optional authentication information remains in Supabase while your account is active and for any limited period required for security, legal compliance, or backup recovery. You may request deletion of your Clast account and associated authentication data using the contact details below. Clast requests that OpenRouter route AI requests only to providers that do not collect prompts or responses and support zero-data-retention processing; OpenRouter and providers may still retain limited metadata, security, or abuse-prevention data under their terms. App and website analytics, feedback, and support records are retained only as reasonably necessary for the stated purpose, legal compliance, security, and legitimate business interests.

Security and international processing. We use reasonable technical and organizational safeguards, but no system is completely secure. Online features and service providers may process data in countries outside Georgia or your country of residence, where privacy laws may differ.

Your choices and rights. You can use guest mode instead of signing in, sign out of an optional account, disable product analytics, refuse AI processing or withdraw previously granted AI permission in Clast Settings, revoke device permissions in iOS Settings, manage or cancel subscriptions through Apple, and delete local data from the app. Depending on applicable law, you may request access, correction, deletion of your account and associated authentication data, restriction, or information about personal data we control by contacting us.

Controller and contact. The controller is Individual Entrepreneur Vladislav Kalashnikov, Georgia, Tbilisi, Krtsanisi District, Nino and Ilia Nakashidze Street, N 1, Apartment N3, Building N3. Privacy requests can be sent to hi@vldklsnkv.me or made by phone at +995 575 753 648. We may update this policy when Clast, its providers, or legal requirements change; the current version will remain available on this page.