Privacy Policy

Finances is a personal finance tracker. You can record transactions manually or connect your own Gmail account so the app imports the notification emails your bank sends you (purchases, deposits, transfers, payments) and turns them into transactions.

The Gmail connection uses IMAP with a Gmail app password that you create, and it only reads the single label (folder) you choose — for example, a label where a Gmail filter places your bank alerts. The app also offers budgets, savings goals, scheduled payments, multiple currencies with exchange rates, and optional AI-generated email parsing rules using your own AI provider key.

• Account information. Your name and email address. If you register with a password, we store only a salted scrypt hash of it, never the password itself. If you use Google sign-in, we receive your basic Google profile (Google account ID, name, email address, email verification status and profile picture URL) and store your Google account ID, name and email address. We do not store your Google profile picture.
• Optional avatar. An icon or a photo you upload, resized to 256×256 pixels and stored with your account.
• Financial information. Data you enter or that is parsed from your bank emails: transactions (amount, currency, date, merchant or description, category, notes), your accounts and cards (name, type and the last 4 digits used to match notifications), budgets, savings goals, scheduled payments, categories, currencies and exchange rates.
• Email connection. If you connect a Gmail account: the email address, IMAP server settings, the label you selected and your Gmail app password (encrypted, see Security).
• Email messages from the selected label. For each message in that label: its message ID, sender, subject, date and text body. We store them so they can be parsed into transactions and re-processed later (for example, after you create or edit a rule). Messages outside the label you choose are never read.
• Settings. Language, time zone, main currency, email parsing rules, in-app notification state and, if you add one, your AI provider and API key (encrypted).
• Technical information. The essential cookies described below. Like most web services, the servers that host the app may keep short-lived technical logs (such as IP address and time of request) for security and troubleshooting.

We use your information only to provide and protect the service:

• to create your account, sign you in and keep your session;
• to read the selected Gmail label, parse bank notifications and turn them into transactions;
• to show your balances, statistics, budgets, reminders and in-app notifications;
• to convert amounts between currencies;
• to generate email parsing rules with AI, only if you add your own AI key;
• to keep the service secure, prevent abuse and fix problems;
• to answer you when you contact us.

We do not sell your data, use it for advertising, build marketing profiles, or use it to train AI models.

The app connects to Gmail over IMAP (imap.gmail.com) using the Gmail address and app password you provide. It opens only the label you select, in read-only mode: it never sends, deletes, moves or modifies your emails, and it does not read your inbox or any other label.

You can disconnect an email account at any time in Settings, and you can revoke the app password from your Google Account security settings, which immediately stops all access.

If you choose "Continue with Google", the app requests only the basic sign-in scopes: openid, email and profile. This information is used only to authenticate you and to create or identify your Finances account. We do not request access to your Gmail, Drive, Contacts or any other Google API through Google sign-in.

The app's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. (https://developers.google.com/terms/api-services-user-data-policy)

We do not sell information received from Google, do not use it for advertising, do not transfer it to third parties except as necessary to provide the service or as required by law, and do not allow humans to read it except with your consent, for security purposes, or as required by law.

AI is optional and off unless you add your own API key from Anthropic (Claude) or OpenAI. When an email from your selected label doesn't match any existing rule, and you ask the app to create a rule (or turn on automatic AI rules), the app sends to that provider: the email's sender, subject and text body, plus your category names, account names with their last 4 digits, and your currency codes. The provider returns a parsing rule, which the app tests before saving it.

These requests are made with your key, under your own account with that provider, so the provider's terms and privacy policy apply and usage is billed to you by the provider. Nothing is sent to an AI provider if you don't add a key.

We share information only with the services needed to run the app:

• Google — Gmail over IMAP (with your credentials) and Google sign-in, if you use them.
• Anthropic or OpenAI — only if you add your own key, as described above.
• open.er-api.com — to fetch exchange rates. Only your main currency code (for example "USD") is sent; no personal or financial data.
• Hosting infrastructure — the servers where the app and its database run, which process data on our behalf.
• Legal requirements — we may disclose information if required by law, or to protect the rights, safety and security of our users or the service.

We never sell your personal or financial data.

We use only essential cookies — no advertising, analytics or tracking cookies:

• fin_session — keeps you signed in (signed, httpOnly, expires after 30 days or when you sign out).
• fin_lang — remembers the language you chose (1 year).
• fin_oauth — protects the Google sign-in flow (httpOnly, deleted after sign-in, at most 10 minutes).

If you install the app, your browser also stores your language preference locally and caches static files (code, icons) so it loads faster. Pages with financial data are never cached on your device.

• Gmail app passwords and AI API keys are encrypted at rest with AES-256-GCM. They are never shown back to you or sent to your browser after you save them.
• Account passwords are stored only as salted scrypt hashes.
• Sessions use signed, httpOnly cookies, and connections are served over HTTPS.
• Each account's data is isolated: every record belongs to a single user and is only accessible to that user.

No method of transmission or storage is completely secure, but we work to protect your information and will notify affected users of a breach as required by law.

We keep your data for as long as your account exists. You can delete your account at any time from Settings → Account. Deletion is immediate and permanent: your profile, transactions, accounts, budgets, payments, stored email messages, rules, settings and encrypted credentials are all removed, and any email connections are stopped.

You can also remove an email connection or your AI key at any time in Settings without deleting your account. Short-lived technical logs and backups, if any, are overwritten in the normal course of operations.

You can view and edit your information in the app at any time, disconnect email accounts, remove your AI key and delete your account. Depending on where you live, you may have additional rights, such as requesting a copy of your data or objecting to certain processing. To exercise them, contact us at hello@fallxnstudio.com.

Finances is not directed to children. You must be at least 13 years old to use it, or at least 16 where local law requires it (for example, in parts of the European Union). We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.

The service may store and process your information in countries other than the one where you live. By using the service, you understand that your information may be transferred to those countries, where data protection laws may differ. We apply the protections described in this policy wherever your data is processed.

We may update this policy from time to time. We will change the effective date above and, for material changes, give notice in the app or on this page before they take effect.

Questions or requests about privacy: hello@fallxnstudio.com. FallxnStudio, operator of Finances.