FinX privacy and security
Where FinX stores your financial data in each mode, what the app and the managed server at myfinx.app send to other services, how your account is protected, and how to export or delete your data.
Where your data is stored
| Mode | Your financial data | Who runs the server |
|---|---|---|
| Local mode | Only in the app database on your phone | No server |
| Managed hosting | In a PostgreSQL database on the FinX server at myfinx.app, plus a cache on your phone | IT-BAER |
| Self-hosted | On your own server, plus a cache on your phone | You |
Sign-in tokens and your own AI API key are kept in Android encrypted storage (AES-256-GCM). On the managed server, Bank Sync access URLs are encrypted with AES-256-GCM. FinX does not add its own encryption to the transaction database on the phone or on the server. The managed hosting server is located in Germany, and its storage is encrypted at rest.
Encryption in transit
- All connections to myfinx.app use HTTPS. The site sends HSTS for 2 years, so browsers connect only over HTTPS.
- The Android app connects to servers only over HTTPS, also to a self-hosted server.
- The website sends a Content Security Policy, does not allow other sites to frame it, and blocks camera, microphone and location access in the browser.
Account protection
- Passwords are stored as bcrypt hashes, never in plain text. A password must be 8 to 100 characters long.
- The app signs in with an access token that is valid for 1 hour and a refresh token that stays valid for 90 days after its last use. Refresh tokens are stored as hashes, and the reuse of an old refresh token is detected.
- An account can have up to 10 active sessions. A new sign-in beyond that ends the oldest session.
- Sign-in and registration allow 15 failed attempts in 15 minutes. Further attempts are blocked for the rest of that period.
What is sent to other services
| Recipient | What it receives | When |
|---|---|---|
| Firebase Crashlytics (Google) | Crash reports from the Android app | In all modes |
| RevenueCat | Purchase and subscription status from Google Play | In all modes |
| myfinx.app (FinX) | Anonymous upgrade-screen events: a random device ID, the app version, the mode, the event and the screen it came from | Local mode, managed hosting and setup, never with a self-hosted server |
| OpenRouter, routed only to Mistral with zero data retention | The text, voice transcript or receipt photo of an AI request | Managed hosting, only after you accept the AI data consent |
| OpenAI, Anthropic or OpenRouter | The AI request, sent directly from your phone | Only if you add your own API key |
| Public OpenStreetMap Overpass servers | Your location and a search radius | Only if you turn on location reminders |
The app shows no advertising and does not use the Android advertising ID. The website myfinx.app runs no analytics.
AI features
- AI features stay off until you accept the AI data consent in the app. Without consent, no notification text, receipt photo or voice transcript is sent for AI processing.
- Voice entry uses the Android speech recognizer. FinX sends only the text transcript, never audio.
- On managed hosting, AI requests go through OpenRouter to Mistral endpoints with zero data retention.
- With your own API key, requests go directly from your phone to the provider you chose.
Export and delete your data
- Android app: FinX Pro exports a full JSON backup to your Downloads folder and imports it again.
- Web app: export your transactions as CSV. You can import CSV or JSON files.
- Delete your account in the Android app or the web app under Settings. You confirm with your password. Your transactions, sources and targets are deleted with the account.
The privacy policy has the full details. Questions? Use the contact form.