Last updated: September 2026
The data controller for Fincator is Fincator (contact: hello@fincator.com). We rely on three lawful bases, and which one applies depends on what the data is for: performance of the contract you enter into when you create an account, for everything needed to run the service; your consent, for analytics and advertising cookies and for optional features; and our legitimate interest in keeping the service secure and working, for error monitoring and abuse prevention. Where we rely on consent you may withdraw it at any time, and withdrawing it does not affect processing that already happened.
We store your account details (email, name) and the financial data you voluntarily enter or import, including transactions, budgets, goals, investments, loans, and preferences. Sensitive credentials like your 2FA secret and one-time backup codes are encrypted or hashed at rest. We also record technical data that reaching a website necessarily produces — IP address, browser and device type, pages visited, and the timestamps of security-relevant events such as sign-ins — which we use to keep the account secure and to diagnose faults.
Your data is used strictly to provide the features you request: tracking, forecasting, analytics, and AI insights. AI features operate solely on your own authenticated data; our architecture enforces absolute isolation so an AI model cannot access or reference another user's information.
We do not sell your personal data. We utilize the following third-party sub-processors to deliver core functionality: • Stripe: Payment processing and subscription management. • Anthropic / OpenAI: Processing of AI assistant queries and insights (your data is not used to train their models). • ECB (European Central Bank): Real-time foreign exchange rates. • Yahoo Finance (yfinance): Market data for investment tracking. • Sentry: Application error and performance monitoring, so faults are diagnosed from reports rather than from your records. • Google: Advertising and, where you consent to it, measurement — see section 5. Your financial records are never shared with advertisers. Optional partner or affiliate offers are clearly labeled and do not share your personal data with the partner unless you explicitly interact with them. We may also disclose data where the law requires it, or to protect the rights and safety of our users.
Cookies on this site fall into four groups, and only the first is set without asking you. • Strictly necessary: keep you signed in and the app functioning. Blocking them breaks authentication. • Functional: remember your preferences, such as currency and timezone. • Analytics: measure how the site is used, in aggregate, so we can improve it. Loaded through Google Tag Manager and only where you have consented. • Advertising: used by third-party ad vendors to select and measure the ads shown on this site. On advertising specifically: • Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this site or other sites. • Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this and other sites on the internet. • You can opt out of personalised advertising by visiting Google Ads Settings at adssettings.google.com, or opt out of third-party vendors' use of cookies for personalised advertising at aboutads.info/choices and, in Europe, youronlinechoices.eu. • Analytics and advertising cookies are set only where the law allows it without prior consent; where consent is required, they are not set until it is given. You can also block or clear cookies in your browser at any time — the strictly necessary group is the only one that authentication depends on. Some advertising on this site is our own rather than a network's: those slots are filled from offers we hold ourselves, set no cookie, and record only how many times an ad was shown and clicked in total — not who saw it. Advertising is kept separate from your account data: ad vendors receive the ordinary technical signals a page view produces, never your transactions, balances, or any figure derived from them.
We retain your data only for as long as your account is active. You may export your complete dataset or permanently delete your account at any time from the Settings page. Deleting your account immediately removes all associated personal and financial data from our active databases. Backups are cycled out on a rolling schedule, and records we are legally required to keep — payment records, for instance — are kept for the period the law sets and nothing longer.
Depending on where you live, you have the right to access the personal data we hold about you, to correct it, to have it erased, to receive it in a portable form, to object to or restrict certain processing, and to withdraw consent you have given. The export and delete controls in Settings satisfy the first four directly and immediately; for anything else, write to us and we will answer within one month. If you are in the UK, EU, or EEA and you think we have handled your data wrongly, you may also complain to your national data protection authority. We do not sell personal information as defined by California law, and we do not discriminate against anyone who exercises these rights.
Traffic is encrypted in transit, credentials are hashed, and sensitive fields such as your 2FA secret are encrypted at rest. Access to production data is restricted, and security-relevant account events are logged so you can review them yourself in Settings. No system is perfectly secure, and we will notify you and the relevant authority if a breach affecting your data occurs.
The sub-processors named in section 4 operate internationally, so your data may be processed outside your own country, including in the United States. Where that happens we rely on the transfer mechanisms the law provides, such as the European Commission's Standard Contractual Clauses.
The service is not directed at children. We do not knowingly collect personal information from anyone under 16, and we do not serve ads targeted at children. If you believe a child has given us personal data, write to us and we will delete it.
We may update this policy as the service changes. The date at the top of this page always reflects the current version, and material changes are announced in the app before they take effect. Questions, requests, and complaints all go to the same place: hello@fincator.com.