Privacy Policy

1 Information We Collect

We collect only the information necessary to provide the Finent service.

Account information

• Email address (used as your username and for notifications)
• Password (stored as a salted cryptographic hash — never in plain text)

Financial data you enter

• Income sources: name, amount, frequency, and pay-day settings
• Expenses: name, amount, type, frequency, and due dates
• Utility expenses: name, amount, due day, and paid status

Billing information (paid plans only)

• A Stripe customer and subscription reference, the plan you're on, your subscription status, and the date your current period ends
• Not your card number or payment credentials — those are entered on Stripe's checkout and never reach Finent (see Payments)

Technical data

• Session cookies required for authentication (see Cookies)
• Brief application logs for error diagnostics, retained for 7 days (see our Data Retention Policy)
• IP addresses held in memory during rate-limiting checks; not persisted to disk

Mobile app

• A push notification token identifying your app installation, stored only if you allow notifications (see The Finent app)
• The device platform ("android" or "ios") that token belongs to

2 How We Use Your Information

• To create and maintain your account
• To display your personalised budget dashboard and calculations
• To send transactional emails: account confirmation, password reset, and bill-reminder notifications you have configured
• To diagnose and fix application errors

We do not use your data to serve advertisements, build marketing profiles, or share information with third parties for commercial purposes.

3 Email and Notifications

Finent sends transactional emails through the Gmail API (Google LLC). When we send you an email, Google processes the message content and delivery metadata (such as recipient address and timestamp) in accordance with Google's Privacy Policy.

We do not send marketing emails. You may disable bill-reminder emails at any time from Account → Bill Reminders.

Push notifications

If you use the Finent app and allow notifications, the same reminders can arrive as push notifications. These are delivered through the Expo push service (650 Industries, Inc.), which relays them to Google's Firebase Cloud Messaging. Expo receives your notification token and the contents of the notification — which for a bill reminder includes the bill name and amount — and processes it under Expo's Privacy Policy.

Turning notifications off in your device settings, or signing out of the app, stops this. Signing out also removes the token from our records.

4 Payments

If you subscribe to a paid plan, payments are processed by Stripe, Inc. Stripe receives the information needed to take payment — your email address, your card or payment details, and billing information you enter on their checkout page — and processes it under Stripe's Privacy Policy.

Finent never sees or stores your card number or payment credentials. Card entry happens on Stripe's own hosted checkout page, not on Finent. We store only a Stripe customer reference, your subscription status, the plan you're on, and the date your current period ends — enough to know whether your subscription is active.

Stripe never receives your financial records: your incomes, expenses, and pay-period data are not shared with them. If you stay on the free plan, no data is sent to Stripe at all.

5 Data Sharing

We do not sell, rent, or trade your personal information. The only external services that touch your data are the Gmail API used for email delivery, the Expo push service if you enable notifications in the app, and — if you subscribe — Stripe for payment processing, all described above.

None of them receives your budget. Your incomes, expenses, sinking funds and pay-period history are never sent to a third party, with the single narrow exception of a bill's name and amount appearing in the text of a push notification you asked us to send.

If Finent is hosted by a cloud provider, that provider may have incidental access to encrypted data at rest in the ordinary course of operating their infrastructure. Their own data-processing terms apply.

6 Data Security

We apply industry-standard measures to protect your data:

• All traffic is served over HTTPS with secure, HTTP-only cookies
• Passwords are hashed with bcrypt and a random per-user salt. Accounts carried over from the original version of Finent may still hold a PBKDF2 hash; those are upgraded to bcrypt the next time you sign in
• Login attempts are limited by a rate-limiter and account lockout policy
• Optional two-factor authentication (2FA) is available on your account
• In the mobile app, the budget saved on your device for offline use is encrypted (see The Finent app)

No system is completely immune to attack. If you discover a security vulnerability, please report it responsibly before public disclosure.

7 Your Rights

You may also correct inaccurate data at any time by editing your entries directly within the application.

Both are available from Account → Personal data on the website, and you can delete your account from inside the mobile app at More → Delete my account. See Delete your account for the full list of what deletion removes.

8 The Finent App

The Finent mobile app talks to the same account and the same data as the website. Everything above applies to it. Three things are specific to using the app on a phone.

Your budget is saved on your device

So the app opens on your figures instead of a spinner — and stays usable with no signal — a copy of the screens you have viewed is stored on your phone. That copy is encrypted with a key held in your device's operating-system keystore — the Android Keystore, which uses secure hardware where the device provides it — so it cannot be read by copying the app's files off the device.

It is discarded after 24 hours, and erased whenever you sign out or a different account signs in on the same phone. It is never uploaded anywhere, and it is excluded from your device's cloud backups.

To be straightforward about the limit: this protects your data if the phone is lost, stolen, or examined while locked. It is not designed to defeat someone who has compromised the device while the app is running, because the app itself must be able to read its own cache.

Sign-in tokens

Your sign-in tokens are stored in the device's secure keystore rather than ordinary app storage. Signing out removes them, and deleting your account invalidates them everywhere — every other device you were signed in on is signed out too.

Notifications

Push notifications are optional and off until you allow them. See Email and Notifications above for who handles them.

9 Cookies

Finent uses a minimal set of cookies that are strictly necessary for the application to function. We do not use advertising, analytics, or tracking cookies.

10 Children's Privacy

Finent is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal data, please contact us so we can remove it.

11 Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. Continued use of Finent after changes are posted constitutes your acceptance of the revised policy.