This policy describes what the Finman personal finance app collects, where that information goes, and what you can ask us to do with it. It was written against the running code, not from a template — everything below reflects how the service at app.finman.money actually behaves.

Who operates Finman

Finman is developed and operated by INNOVA CONSULT LTD., a federal corporation in Ottawa, Ontario, Canada (corporation number 1522612-1). For any question about your data — access, correction, export or deletion — write to [email protected].

What we store

Your account

When you register we store a username, an email address, an optional full name, and your password as a bcrypt hash (cost factor 12). The plaintext password is never written to disk and cannot be recovered from what we hold — not even by us.

If you sign in with Google instead, we store your Google account identifier, the email address and display name Google returns, and your profile picture URL. We request only Google's basic profile and email scopes. We never receive your Google password, and we cannot read your Gmail, Drive or contacts.

If you sign in with Google using an email address that already has a Finman account, the two are linked rather than duplicated. Accounts created through Google have no usable password and cannot be signed into with one.

Your financial data

Everything you put into the app is stored so the app can work: accounts and balances, transactions, budgets, categories and tags, recurring payments, subscriptions, debts and their payments, savings goals, investments and portfolios, net-worth snapshots, receipts, split expenses and shared groups, family and organization membership, calendar events, notifications, reports and currency settings.

This is stored in a SQLite database on our own server. It is not sold, rented, or shared with advertisers, and there are no third-party analytics or advertising trackers in the application.

Where your data leaves our server

There are four cases. The first three only happen because you asked for the feature; the fourth is a short notice to us when an account is created.

1. AI features

When you use the AI assistant, AI insights, or receipt scanning, the relevant content is sent to a third-party AI provider to be processed. That means:

The provider currently configured is OpenAI (GPT models). Our server reaches it through Finman's own ChatGPT account, signed in with OAuth; your browser never talks to OpenAI directly, and OpenAI handles the content under its own terms. The application also supports Google Gemini, other OpenAI-compatible providers and Ollama, selected by server configuration. The AI features switch on when you open the AI page or send a chat message. If you never use them, none of your data is sent to any of these providers.

2. Bank connections

If you connect monobank, we exchange data with monobank's own API to import your accounts and transactions, and we store your personal API token encrypted so the connection keeps working. Other banks (RBC Royal Bank, TD Canada Trust, Scotiabank, BMO, CIBC, Tangerine, Wealthsimple Cash, EQ Bank, Revolut and Wise) are supported through the CSV, OFX or QFX files you download from your online banking and upload yourself; we do not connect to those banks. Connecting a bank is entirely optional; the app is fully usable with manual entry and file import.

3. Sign-in with Google

If you use the Google button, Google necessarily learns that you signed in to Finman. That exchange is governed by Google's own privacy policy.

4. New-account notice to the operator

When an account is created, the operator of Finman receives an email with the username, the email address, the name you entered and whether you signed up with a password or with Google. The email is delivered through our email provider, Resend. Nothing about your finances is included.

This website (finman.money)

The pages at finman.money, which are separate from the app, use Google Analytics 4 to count visits and clicks on the buttons that lead to sign-up. Google Analytics sets first-party cookies (_ga, _ga_*). Google uses your IP address to estimate an approximate location and, according to Google, does not store it. Advertising features are switched off.

If you visit from the European Economic Area, the United Kingdom or Switzerland, these cookies are set only after you accept them in the banner. To change your choice, clear this site's data in your browser and the banner will ask again. The app at app.finman.money does not load Google Analytics.

How long we keep it

We do not currently run an automatic deletion schedule. Your data stays until you delete it in the app or ask us to remove your account. When you ask, we delete the account and the records attached to it.

What you can ask for

Write to [email protected] and we will act on it. Most of these you can also do yourself inside the app.

Security

Passwords are hashed with bcrypt and never stored in readable form. Sessions are authenticated with signed JSON Web Tokens. The service is served over HTTPS only, applies security headers and rate limiting, and sanitises user-supplied content before it is rendered. No system is perfectly secure, and we do not claim otherwise.

Children

Finman is not directed at children and we do not knowingly create accounts for them.

Changes

If this policy changes materially, the updated version will appear on this page with a new date. Continuing to use Finman after that means the updated policy applies.