Comma App is an Australian software product operated by [YOUR NAME], trading as Comma App (ABN [YOUR ABN]), based in Melbourne, Victoria, Australia.
We are subject to the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If you have a privacy question or complaint, contact us at privacy@getcomma.com.au.
Financial data (encrypted, app users only)
If you are a Pro or Lifetime user with cloud sync enabled, your transaction data is encrypted using AES-256-GCM in your browser before being transmitted to our servers. We store only encrypted blobs. We do not have access to your encryption key and cannot read the content of your financial data under any circumstances.
Account information
If you create a Pro or Lifetime account, we collect your email address for authentication and account management. This is stored in Supabase (our database provider) and is never used for advertising.
Waitlist email
If you submit your email on the Comma website to join the waitlist, we store your email address in our database and in Kit (our email marketing platform). We will use this to notify you of launch and major updates. You can unsubscribe at any time via the link in any email we send.
Website analytics
The Comma marketing site (getcomma.com.au) uses Vercel Analytics, a privacy-friendly analytics tool. Vercel Analytics does not use cookies, does not fingerprint your device, and does not track you across sites. It records aggregate page view data to help us understand traffic. No personal data is collected or stored.
What we do not collect
We do not use your data for advertising, profiling, or any purpose beyond operating the service.
Comma's AI insights feature is entirely optional and requires you to provide your own Anthropic API key. When you use this feature, your financial data is sent directly from your browser to Anthropic's API using your key. Comma's servers are never in the loop — we do not proxy, log, or receive any data from these requests.
You can disable the AI insights feature at any time in the app settings, in which case no data is ever sent to Anthropic.
Comma uses the following third-party services to operate. Each receives only the minimum data necessary to function.
We do not sell data to any third party, and we do not permit any third party to use your data for their own purposes.
Encrypted app data is retained as long as you have an active account. You can delete your account at any time from the app settings, which permanently deletes all encrypted data from our servers within 30 days.
Waitlist emails are retained until you unsubscribe. You can unsubscribe at any time via the link in any email, or by emailing privacy@getcomma.com.au.
Free tier (browser storage) — if you use Comma without an account, no data is sent to our servers. All data is stored locally in your browser's storage and can be deleted by clearing your browser data.
Financial data is encrypted using AES-256-GCM with a key derived from your password via PBKDF2-SHA256 (600,000+ iterations) — all performed in your browser using the Web Crypto API. The encryption key never leaves your device.
Our servers store only encrypted ciphertext. Even in the event of a database breach, your financial data could not be read without your password.
Account authentication is handled by Supabase, which is SOC 2 Type II certified. All data in transit is protected by TLS.
Under the Australian Privacy Act, you have the right to:
To exercise any of these rights, contact us at privacy@getcomma.com.au. We will respond within 30 days.
If you are unsatisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC).
The Comma marketing site does not use tracking cookies. Vercel Analytics operates without cookies. The Comma app uses browser local storage to persist your session and preferences — this is not transmitted to any third party.
Comma is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.
We may update this Privacy Policy from time to time. When we do, we'll update the "Last updated" date at the top of this page and — for material changes — notify account holders by email. Continued use of Comma after changes take effect constitutes acceptance of the updated policy.
For any privacy questions, access requests, or complaints:
Comma App · Melbourne, Victoria, Australia
privacy@getcomma.com.auWe aim to respond to all privacy enquiries within 30 days.