BALANCECHEAT / LEGAL

Privacy policy

How personal data may be processed when you visit BalanceCheat.

Controller

Moritz Werner
Vienna, Austria
Email: moritz@profitmacher.com

Local use of the financial model

The BalanceCheat financial model and sample-company calculations run in your browser. Models, scenarios and the balance-sheet draft can be saved locally in browser storage; some educational examples remain temporary until you explicitly save them. Theme and display preferences, local model history and Multi-Screen session information support the requested functionality. These local model data are not sent to Google Analytics. Unless you explicitly use optional AI or Publish, the application does not transmit these local model data to the website operator. Copy and download functions export data locally at your request. Clearing site data removes locally saved work. The site has no user accounts, newsletter, advertising trackers or external fonts.

Optional public model publication

Normal modeling stays local. Selecting Publish prepares a preview in your browser. Only the final, expressly confirmed Publish action uploads the selected operator inputs, structures, scenarios, calculated output tables and public description to BalanceCheat. Optional embedded comments are excluded by default. Analyze sessions, AI history, other local models and unselected content are excluded. An allowed publication becomes public in the Model Library, may be indexed by search engines and may be copied into another visitor’s browser with Fork. Opening a public page does not save a local model. Fork does so only after an explicit action and local verification.

A published snapshot is immutable. There is no publisher account or in-place editing. New publications can be withdrawn using the private management key. Administrative moderation can hide or remove content. For older publications, lost keys and statutory privacy requests, contact the controller above. Remove personal, confidential and third-party restricted information before publishing.

Publication content is processed and stored on BalanceCheat’s own hosted server and database. Server-side deterministic rules check every retained user-authored public text. Model Library moderation does not use an AI model or send user model text to an external AI provider. Ambiguous cases remain private for human review in the protected administration area. These checks cannot detect every policy violation or private detail: remove confidential and personal information before publishing. Public reports provide an additional route for raising concerns. Optional Bring Your Own AI is separate and works only when you choose to use it.

Publishing and reporting use signed source and session cookies (__Host-bc_models and __Host-bc_models_session, Secure, HttpOnly, SameSite Lax), with a 24-hour lifetime and one-hour CSRF tokens. The application stores keyed hashes of source identities and IP addresses for abuse prevention, rather than raw IP addresses in its model tables. Reports are private to administrators and do not automatically remove publications.

Publications remain available until withdrawal or administrative removal. Review content expires after 14 days, rejected content after 7 days and whole-model hidden content after 30 days. Text-only moderation does not start whole-model deletion. The hourly cleanup removes expired bodies; withdrawal/removal retains a minimal identity/provenance tombstone. Source/IP hashes expire after 30 days and publish receipts after 24 hours. Report and moderation retention is explained below.

Optional Bring Your Own AI

When using API-key chat, your prompts and requested model information pass through the Bluehost-hosted relay to your chosen provider (OpenAI, Anthropic or Google Gemini). With an external AI client, the client requests model information and actions through the MCP endpoint; your conversation stays with that client. The provider processes that information under its own account terms and data settings. For this optional AI chat, BalanceCheat does not supply or fund the chosen model. Provider API keys and chat history stay in browser memory; keys pass through the relay for each request but are not written to application storage, model files, logs or analytics.

Starting AI creates a necessary bc_ai session cookie (HttpOnly, Secure on HTTPS, SameSite Strict) for request authorization, with a one-hour server session. A connected external MCP client receives an expiring Bearer token scoped to the exposed model. The server stores the token hash, model/session identifiers, connection times, queued tool arguments and temporary tool results. It does not persist the full model. Tokens expire after one hour and can be revoked sooner. Commands expire after ten seconds; completed results are deleted when delivered. The configured five-minute cleanup job removes expired commands and sessions on its next run. Provider retention is separate from this local application lifecycle.

Optional OAuth connections use explicit consent in the same browser as your prepared model. Authorization requests expire after five minutes, one-use codes after one minute, and access after at most one hour. Only token hashes are stored. Public client registration metadata (client name and exact callback URLs) is kept to allow reconnection; it contains no provider keys or financial model. Existing cleanup also removes expired OAuth requests, codes and tokens.

Only the currently exposed browser model and its scenarios are accessible. Changing the exposed model or window revokes its external grant. No AI prompt, provider key, model value, or tool response is sent to analytics. Normal modeling remains available with AI disconnected.

Hosting and server logs

BalanceCheat is hosted using Bluehost services. When a website is delivered over the internet, the hosting infrastructure may process technical information such as your IP address, the requested page or file, date and time of access, referrer information, browser type, operating system and user agent. This processing is technically necessary to deliver the website, maintain security, diagnose errors and prevent misuse.

Where the GDPR applies, the legal basis for this technically necessary processing is the operator's legitimate interest in providing a secure and functional website (Article 6(1)(f) GDPR). Technical data may be processed by the hosting provider and service providers used by it for hosting, infrastructure, security and support.

International data transfers

Bluehost is a US-based hosting provider. The provision of hosting and support services may therefore involve processing in the United States or other countries outside the European Economic Area. Where required by applicable data-protection law, such transfers must be covered by an applicable transfer mechanism and appropriate safeguards under the provider's contractual and privacy arrangements.

Retention

The website operator does not use server-log data for advertising or user profiling. Technical logs may be retained by the hosting infrastructure for operational, security, troubleshooting and legal purposes. Retention periods depend on the applicable hosting and security configuration and should not exceed what is necessary for those purposes.

Optional Google Analytics

With your consent, BalanceCheat uses Google Analytics 4, provided by Google Ireland Limited, Dublin, Ireland, with processing by Google and its service providers, including Google LLC in the United States. The purpose is to understand page visits and meaningful product use and improve the website. Analytics is optional: before consent and after rejection, the Google tag is not loaded and no analytics events or analytics cookies are enabled.

Analytics processes pseudonymous browser/cookie identifiers, page-route and language information, timestamps, browser/device information, approximate location and a small set of actions, such as opening or beginning to edit a model, creating a scenario, applying a What-If transaction, opening another screen, randomizing an example, exporting or following a model link. Google necessarily receives technical connection data. Google states that IP addresses from EU users are used for approximate location and discarded before logging. BalanceCheat sends no financial values, user-entered model or scenario names, file names, imported content, email addresses, AI prompts or responses. URLs sent in our page events omit all query parameters and fragments; referrers are omitted. No User-ID, Google Signals, advertising personalization or automatic user-provided data collection is enabled.

The legal basis is your consent under Article 6(1)(a) GDPR and, for non-essential access to terminal equipment, § 165(3) TKG 2021. Accept and Reject are both available in the prompt. You can change your choice or withdraw consent at any time through Privacy settings in the footer. Withdrawal stops future analytics and removes accessible Google Analytics cookies from this website; it does not undo processing that lawfully occurred before withdrawal. Necessary modeling functions remain available without analytics consent.

Google may process data outside the EEA, including in the United States. Google describes its reliance on the EU–US Data Privacy Framework for covered transfers and contractual safeguards where applicable. See Google’s transfer frameworks, Google’s data processing terms and Google’s privacy policy.

Cookies and local storage

The versioned consent choice is saved locally for 180 days, after which we ask again. A material consent-policy change may also require a new choice. Necessary storage for the Model Library, local drafts, theme and Multi-Screen continues independently of analytics consent and remains until you delete it or the relevant temporary session ends. There is no advertising or marketing cookie category.

After analytics consent, Google Analytics may set first-party _ga and _ga_F0GKSY1K8G cookies to distinguish browsers and sessions. This integration requests a maximum cookie lifetime of 180 days without automatic renewal; browsers may shorten it. Small local analytics markers prevent duplicate model-open/first-edit events and have a 30-minute validity window in storage; in-memory deduplication also lasts for the open page. Withdrawal removes these markers without touching saved models. Google’s event/user-level retention follows the property’s configured retention period; standard aggregated reports are not subject to that same deletion period. Contact the controller above for information or deletion requests.

Your rights

Where the GDPR applies, you may have rights including access, rectification, erasure, restriction of processing, objection and, where applicable, data portability. To exercise a right or ask a privacy question, contact the controller at the email address above.

You also have the right to lodge a complaint with the competent data-protection authority. In Austria, this is the Austrian Data Protection Authority (Datenschutzbehörde): www.dsb.gv.at.

Changes to this policy

This privacy policy reflects the current technical setup of BalanceCheat. It will be updated if the website begins using additional services or processing personal data in additional ways.