Privacy Policy

FinTrack(“FinTrack”, “we”, “us”) provides a privacy-first personal finance tracker at usefintrack.com. This policy explains what information we collect when you use our website and app (the “Service”), how we use it, and the choices you have.

For the purposes of data protection law, FinTrack is the controller of the personal information described in this policy.

Account information

When you create an account we collect your email address and, if you provide them, your name and currency preference. If you sign in with Google, we receive your name, email address, and profile picture from Google. If you use a password, it is stored in hashed form by our authentication provider — we never see it.

Financial information you enter

FinTrack works through manual entry. We store the transactions, recurring transactions, categories, budgets, and savings goals you create, including amounts, dates, categories, and any descriptions you write. We do not connect to banks or other financial institutions, and we never ask for bank credentials or account numbers. Please avoid putting sensitive details such as card or account numbers in free-text descriptions.

Billing information

Paid plans are sold through Lemon Squeezy, which acts as our payment processor and merchant of record. Lemon Squeezy collects your payment details directly; we never receive your full card number. We receive and store your plan, subscription status, renewal and end dates, and Lemon Squeezy customer, order, and subscription identifiers.

Messages you send us

If you use our contact form, we collect your name, email address, the topic you choose, and your message.

Usage and device information

When you visit our website or use the app, we and our analytics providers collect information such as the pages you view, actions you take (for example, clicking a button), your browser and device type, referring website, and an approximate location derived from your IP address. See Cookies and analytics for details.

Demo accounts

You can try FinTrack without signing up. Demo sessions use a temporary anonymous account, and any data entered is automatically deleted, usually within 48 hours.

We use the information we collect to:

• Provide the Service, including storing your entries and calculating your dashboard, forecasts, and reports.
• Create and secure your account, including sign-in and sign-in links.
• Process payments and manage your subscription through Lemon Squeezy.
• Respond to your messages and support requests.
• Send essential service messages, such as sign-in links and important account or billing notices.
• Understand how the Service is used so we can fix problems and improve it.
• Detect and prevent fraud, abuse, and security incidents, and comply with legal obligations.

We do not sell your personal information, and we do not use your financial entries for advertising or share them with data brokers. FinTrack is funded by subscriptions.

Legal bases (EEA and UK users)

We process your information to perform our contract with you (providing the Service), for our legitimate interests (securing and improving the Service, understanding usage), to comply with legal obligations (such as tax and accounting records), and with your consent where the law requires it.

We share information only with service providers that help us run FinTrack, under contracts that limit how they may use it:

• Supabase — database and authentication (stores your account and financial data).
• Vercel — website hosting and privacy-friendly web analytics.
• Lemon Squeezy — payments, subscriptions, and sales tax, as merchant of record.
• Google — only if you choose to sign in with Google.
• PostHog — product analytics.
• Microsoft Clarity — website usage analytics.
• Formspree and Airtable — receiving and organizing contact form messages.

We may also disclose information:

• If required by law, regulation, legal process, or a valid government request.
• To protect the rights, safety, or property of our users, FinTrack, or others.
• As part of a merger, acquisition, or sale of assets, in which case this policy will continue to apply to your information.
• With your consent or at your direction.

Essential

We use cookies to keep you signed in and secure your session, and your browser's local storage to remember preferences such as light or dark mode. These are required for the Service to work.

Analytics

• Vercel Web Analytics measures page views without using cookies.
• PostHog uses cookies or local storage to measure page views and product usage.
• Microsoft Clarity uses cookies to understand how visitors use our website, for example clicks, scrolling, and page layout, to help us find usability problems.

You can block or delete cookies in your browser settings, or use a content blocker. Blocking analytics will not affect how FinTrack works; blocking essential cookies will prevent you from signing in.

• Account and financial data is kept while your account is active.
• When you ask us to delete your account, we delete your account and all associated financial data within 30 days, except limited records we must keep for legal, tax, or accounting reasons (such as billing records).
• Demo account data is deleted automatically, usually within 48 hours.
• Contact messages are kept as long as needed to handle your request and for reasonable record-keeping.
• Analytics data is retained according to our analytics providers' retention settings.
• Residual copies in backups are removed as those backups expire in the normal cycle.

• Row Level Security is enforced in our database, so each account can only read and write its own records.
• Data is encrypted in transit (HTTPS) and at rest by our infrastructure providers.
• Passwords are hashed by our authentication provider and are never visible to us.
• Our internal admin tools show account and billing details (such as name, email, plan, and the number of transactions you have), not the contents of your financial entries. We do not access your entries unless you ask us to as part of a support request, or we are legally required to.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities as required by law.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and receive a copy in a portable format.
• Correct inaccurate information. You can edit most details directly in the app.
• Delete your account and associated data.
• Object to or restrict certain processing, and withdraw consent where processing is based on consent.

Paid plans can export transactions to CSV at any time from the app. To make any other request, contact usand choose “Privacy request”. To protect your account, we may ask you to send the request from the email address on your account. We respond within 30 days, or sooner where the law requires.

EEA and UK users may also lodge a complaint with their local data protection authority. California residentshave the right to know, delete, and correct personal information, and to not be discriminated against for exercising these rights. We do not sell or “share” personal information for cross-context behavioral advertising.

Our service providers may process your information in the United States and other countries that may have different data protection laws than where you live. Where required, we rely on appropriate safeguards such as the Standard Contractual Clauses offered by our providers.

FinTrack is not directed at children under 16, and we do not knowingly collect their personal information. If you believe a child has given us personal information, please contact us and we will delete it.

We may update this policy from time to time. We will change the “Last updated” date above, and if the changes are significant we will notify you by email or in the app before they take effect.

Questions about this policy or your data? Reach us through our contact pageand choose “Privacy request”.