Privacy Policy

Last Updated: October 10, 2026

Your privacy is our priority. How we handle your data depends on how you use the app.

Local Mode Privacy

When using Local Mode, your financial data never leaves your device. We do not collect, transmit, or store any of your transaction data. You have complete control and ownership. If you later buy FinX Pro and create a FinX Cloud account, the app uploads your local transactions, categories, accounts and goals to that account once, after you have signed in. Nothing is uploaded before that step.

Online Mode Privacy

Online Mode syncs your data with a FinX server. If you use your own (self-hosted) server, your data is stored only on that server, FinX has no access to it, and your privacy and data security depend on how you configure and secure that server. If you use our managed hosting at myfinx.app, see Managed Hosting Privacy below.

Managed Hosting Privacy

When using the FinX managed hosting service, your data is stored on servers located in Germany (European Union) and is fully DSGVO/GDPR compliant. Your financial data remains on EU servers, is never sold, and is shared only with the limited, purpose-specific service providers described under Data Sharing below.

---

Data We Collect

Personal Information

• Account Data (Online Mode only): Email address, name, and password (stored on the FinX server you use: your own server or our managed hosting)
• Financial Data: Transaction records, categories, budgets, and savings goals (stored on your device or on the FinX server you use, depending on mode)

AI Features (Optional — Receipt Scanning, Notification Parsing, Voice Entry & AI Chat)

FinX includes optional AI features that require your explicit in-app consent before any data is sent. Nothing is sent until you accept the disclosure shown in the app, and declining keeps the feature off.

• Receipt Scanning: When you scan a receipt or invoice, the photo is sent to a third-party AI service that extracts the transaction details (amount, date, merchant). The image is transient — it is downscaled, sent for a single extraction, then discarded. It is not stored by FinX, not attached to the transaction, and not retained on FinX servers.
• Notification Parsing: When enabled, the text of incoming transaction notifications (e.g. bank payment alerts) is sent to a third-party AI service that extracts the transaction details. The text is used for that single extraction only.
• Voice Entry: Your speech is converted to text by your device’s speech recognition service (for example Google’s, depending on your device settings). FinX never receives or stores the audio. The resulting text is sent to an AI service that extracts the transaction or goal details. You always confirm the result before it is saved.
• AI Chat (Online Mode only): When you ask the chat a question, your message and the parts of your financial data needed to answer it (for example matching transactions, category totals or account balances) are sent to an AI service. The chat history is kept only for the current session and is not stored.

All AI features are opt-in and gated behind an explicit consent dialog. FinX requests that your data not be used for model training (sent with a no-data-collection flag where supported) but cannot fully guarantee the retention practices of every provider. Advanced users may supply their own API key (BYOK), in which case requests go directly to the provider they choose.

Automatically Collected Data

• Crash reports (Firebase Crashlytics): When the app crashes, a technical report (stack trace, device model, Android version, app version) is sent to Google Firebase so we can fix the bug. It contains no transaction data, no account data and no notification text.
• Anonymous usage events (FinX Cloud server, EU): The app sends a few event names (for example that the upgrade screen was shown, closed or that a purchase started) together with a random device identifier, the app version and the mode (local, cloud, self-hosted). The identifier is generated by the app, is not linked to your account, email or Google account, and changes when you reinstall the app. No amounts, descriptions, categories or other financial data are included. Installs that use a self-hosted server send nothing.

We do not use advertising identifiers and do not track you across other apps or websites.

How We Use Your Data

Your data is used solely to provide the app’s functionality:

• Recording and categorizing transactions
• Generating reports and insights
• Tracking savings goals
• Syncing between devices (Online Mode only)
• Extracting transaction details from receipt photos, notification text or voice input, and answering chat questions, via AI (opt-in, consent-gated)
• Finding nearby shops for location reminders (opt-in, Pro)

Data Sharing

We do not sell your data, and we do not share it with advertising networks, analytics providers, or data brokers.

• No advertising networks
• No third-party analytics providers (crash reports go to Google Firebase, usage events go only to our own EU server)
• No data brokers

The only third parties that ever receive your data are the limited, purpose-specific service providers described below (subscription management, bank sync, and — only if you opt in — AI processing and map lookups for location reminders).

Subscription Management (RevenueCat)

FinX uses RevenueCat to manage optional Premium subscriptions. RevenueCat processes only billing-related metadata:

• Subscription status (active, expired, canceled)
• Purchase and renewal events
• Anonymous app user ID

RevenueCat does NOT have access to:

• Your transaction data, balances, or categories
• Your personal financial information
• Any data stored in Local Mode or on your server

For more information, see RevenueCat’s Privacy Policy.

Bank Sync (SimpleFIN Bridge)

FinX Pro subscribers may optionally connect their bank accounts via SimpleFIN Bridge, a third-party service, to automatically import transactions. When you use this feature:

• Your SimpleFIN credentials (Access URL) are encrypted at rest using AES-256-GCM on the FinX server. The encryption key is configured by the server operator.
• FinX sends requests to the SimpleFIN Bridge API on your behalf to fetch account balances and transaction data. This data is imported directly into your FinX account.
• SimpleFIN Bridge connects to your bank via your bank’s open banking API. SimpleFIN’s privacy and data handling practices are governed by SimpleFIN’s Privacy Policy.
• No financial data is shared from FinX to SimpleFIN. Data flows one-way: from your bank, through SimpleFIN, into FinX.
• You pay SimpleFIN directly ($1.50/month or $15/year). FinX does not process or handle SimpleFIN payments.
• You can disconnect your bank at any time from Settings. Disconnecting removes the stored credentials but does not delete previously imported transactions.

AI Processing (Receipt Scanning, Notification Parsing, Voice Entry & AI Chat — opt-in)

If — and only if — you opt in to the AI features, receipt images, notification text, voice transcripts or chat questions (with the financial data needed to answer them) are sent to third-party AI providers solely to extract transaction details or answer your question. This happens only after you grant explicit in-app consent, and only for the specific scan, notification, voice entry or chat question involved. FinX requests that this data not be used for model training. Receipt images are transient and are not retained by FinX. See AI Features under “Data We Collect” above for details.

Location Reminders (OpenStreetMap Overpass — opt-in, Pro)

If you turn on location reminders, the app sends your approximate current position and a search radius to public OpenStreetMap Overpass servers to find nearby shops and restaurants. These requests contain no account data and no financial data. Results are cached on your device for up to 24 hours. Your location history is not sent to FinX servers. Location reminders are off by default, need your location permission, and can be turned off at any time.

Legal Basis for Processing (GDPR Art. 6)

We process your personal data based on the following legal grounds:

• Contract performance (Art. 6(1)(b) GDPR): Processing your account data and financial records is necessary to provide the FinX service.
• Consent (Art. 6(1)(a) GDPR): Optional AI features (receipt scanning, notification parsing, voice entry, AI chat) and location reminders process your data only after your explicit in-app consent, which you may withdraw at any time by disabling the feature.
• Legitimate interest (Art. 6(1)(f) GDPR): Server logs for security and abuse prevention.

Data Controller

The data controller responsible for processing your personal data is:

Bruno Miglar
Office address: Sankt Veiter Straße 16
9020 Klagenfurt
Österreich / Austria
E-Mail: [email protected]

Supervisory Authority

You have the right to lodge a complaint with the competent data protection supervisory authority:

Österreichische Datenschutzbehörde
Barichgasse 40-42
1030 Wien
www.dsb.gv.at

Data Security

• All network communication uses HTTPS/TLS encryption
• Passwords are hashed using bcrypt
• Biometric authentication data (Face ID/fingerprint) is processed locally by your device OS and never accessed by FinX

Data Retention & Deletion

• Local Mode: Data exists only on your device. Delete the app to remove all data.
• Online Mode: You can delete your account and all associated data from Settings > Delete Account. On a self-hosted server, the server operator can also delete it directly.
• Managed Hosting: If your FinX Pro subscription expires or is canceled, your data is retained in read-only mode for 30 days. After this grace period, your account and all associated data may be permanently deleted. You can export your data at any time before deletion via Settings > Backup & Restore.

Your Rights

You have the right to:

• Access your personal data
• Export your data (Settings > Backup & Restore)
• Delete your account and all associated data
• Withdraw consent at any time

Children’s Privacy

FinX is suitable for users of all ages, including children learning to manage money. In Local Mode, no data is collected or transmitted. For Online Mode, we recommend parental supervision when setting up server connections.

Changes to This Policy

We may update this policy occasionally. Changes will be posted here with an updated date.

Contact

If you have questions about this privacy policy, contact us at:

• Email: [email protected]