Privacy Policy

Account information: When you register, we collect your first name, email address, and a hashed password. Optionally, you may provide a phone number and profile photo.

Financial data: Expenses, income records, budget limits, savings goals, subscription details, and transaction categories that you enter manually into Finchie.

Device and session data: Device type (Android/iOS), device ID, IP address, and session tokens used to secure and maintain your login.

Support communications: Messages you send through the in-app support form or website contact form, including your name, email, and message content.

Usage data: Interaction signals within the app (e.g. features used, frequency of visits) to improve the product experience.

We use your data to: provide and maintain the Finchie service; generate personalised AI insights and spending analysis; send transactional emails such as verification codes and budget alerts; respond to support requests; detect and prevent fraud or abuse; and improve our product based on aggregated usage patterns.

Your financial data is used exclusively to power features within your Finchie account. It is never sold to third parties, used for advertising, or shared with data brokers.

Premium subscribers have access to Finchie's AI Advisor, which analyses your financial data (expenses, income, budgets, and savings patterns) to generate personalised insights and recommendations.

AI-generated insights are processed using your data within our secure infrastructure. We do not send your raw financial data to third-party AI providers — all analysis occurs within Finchie's own systems.

AI responses are for informational purposes only and do not constitute financial advice. See our Terms of Service for more detail.

Cloudflare Turnstile: We use Cloudflare's privacy-preserving CAPTCHA service to protect forms from automated abuse. Cloudflare may process your IP address and browser signals to verify you are human. See Cloudflare's Privacy Policy.

Cloudinary: Profile photos are stored and served via Cloudinary's image hosting service. Only photos you explicitly upload are sent to Cloudinary.

Google Sign-In: If you choose to sign in with Google, we receive your name and email address from Google's OAuth service. We do not access your Google account beyond these fields.

Email delivery: We use a third-party email provider to send verification codes, password resets, and budget alerts. The provider receives your email address and the content of the message being sent.

Hosting: Finchie's servers are hosted on Render.com. Your data resides in MongoDB Atlas databases within secure data centres.

We retain your account and financial data for as long as your account is active. If you delete your account, we permanently delete your personal data and financial records within 30 days, except where retention is required by law.

Support ticket records may be retained for up to 12 months to help resolve follow-up queries.

Depending on your jurisdiction, you may have the right to: access a copy of your personal data; correct inaccurate data; request deletion of your data; object to or restrict certain processing; and request data portability.

To exercise any of these rights, contact us at hello@getfinchie.com or use the in-app account deletion feature under Settings → Account.

If you are located in the European Economic Area or the United Kingdom, you have the right to lodge a complaint with your local data protection authority.

Our marketing website uses only essential session cookies. We do not use advertising trackers or third-party analytics cookies. The Finchie app does not use cookies; it uses secure token-based authentication stored on your device.

We protect your data using industry-standard measures: HTTPS encryption for all data in transit; bcrypt hashing for passwords (with server-side pepper); short-lived access tokens and rotating refresh tokens; optional multi-factor authentication (TOTP); and rate limiting to prevent brute-force attacks.

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we take every reasonable step to protect your information.

Finchie is intended for users aged 18 and over. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of significant changes via the email address associated with your account. The "Last updated" date at the top of this page reflects the most recent revision.

If you have any questions about this Privacy Policy or how we handle your data, please contact us at hello@getfinchie.com or use the contact form on our About page.