Privacy policy

Last updated: 22 October 2026

This policy explains, in plain language, what F!nSights stores and where. We aim to follow Singapore's Personal Data Protection Act (PDPA).

Stored on your device only

Your income, expenses, budgets and personal goals are stored in your browser on this device. We cannot see them. Clearing browser data or switching devices removes them unless you have a backup.

Your backups

If you choose a backup folder, copies are saved there. If that folder is synced by Google Drive, iCloud, OneDrive or Dropbox, that provider stores the copies under your own account and its own terms apply.

Optional encrypted cloud backup

If you choose it, your on-device data is encrypted on your device with your passphrase (AES-GCM 256-bit) before upload (PBKDF2 key from your passphrase or recovery code). We store only the locked copy, one previous locked copy, and which device saved it and when. The previous copy is refreshed only when the current copy is more than 24 hours old; it may remain longer if you do not upload again. We cannot read or recover it if you lose your passphrase. If you turn on auto-sync, a locked key that can't be read out is kept in your browser; your passphrase is never stored. You can delete the cloud copy any time in Settings. No restore can be undone.

Stored on our server

• Account details (email and display name)
• Groups, shared expenses, settle-ups and shared goals you create or join
• Your plan, free-trial dates, top-up credits and monthly receipt/statement read counts
• Joint home-goal details you or your partner enter, shared only between the two of you
• Your encrypted cloud backup, only if you turn it on
• A record of when you agreed to our terms and disclaimer

Only members of a group or shared goal can see its shared items, settle-ups and your display name. Nobody else can.

Who processes data for us

• Our cloud database and hosting provider (stores the server data listed above)
• An AI service, only for receipts and PDF statements you choose to scan
• Google, only if you sign in with Google
• Stripe, only if paid plans are turned on and you subscribe (it handles card details; we never see them)

Hosting, database, AI, Google sign-in and payment providers may process data outside Singapore. We take steps to protect that data, including access controls, encryption where applicable and appropriate safeguards with our service providers.

How long we keep it

Server data is kept while your account is active. Deleted groups, cloud copies and reset data are removed straight away. Consent records are kept as proof of agreement while your account exists. On account deletion they are removed with your account. After you delete your account we keep a one-way scrambled version of your email (not readable, and not shown anywhere in the app) for 12 months to stop repeated free trials, then it is deleted automatically. You must be 18 or older to use F!nSights.

Reading receipts and statements

When you scan a receipt or import a PDF statement, we ask first, then the file is sent to an AI service to read the amounts. CSV files are read on your device and never uploaded. F!nSights does not keep the file. The results are saved on your device only.

Why we use it

Only to run the app: signing you in, showing shared data to your group, and applying plan and fair-use limits. We do not sell your data or use it for advertising.

Deleting your data

In Settings, "Reset everything" removes your on-device data and your groups, encrypted cloud backup, shared items and display name from our server. A group can only be deleted by its creator once everyone is settled up and no removal is waiting for approval; leaving a group requires a S$0.00 balance and no pending removal, and the last member leaving removes the group. Restoring a backup replaces all data on that device and cannot be undone.

To close your account, request account deletion in Settings. You have a 14-day grace period and may cancel in Settings any time before deletion. Signing in does not cancel it. After the grace period, the daily deletion process removes your sign-in account, profile, plan and subscription records, consent records, encrypted cloud backups, AI usage and top-up credits, joint home links, shared goals you own (including their members and entries), your membership and entries in other shared goals, groups you created (including their expenses, settlements, invites and memberships), your group expenses, settlements involving you, invites you created and memberships in other groups. Only the one-way email marker described above is retained by this process. On-device copies and downloaded backups are not remotely erased; remove these from your devices and backup folders yourself.

Data breaches

If a data breach occurs, we will notify affected people and Singapore's Personal Data Protection Commission (PDPC) when the law requires.

Contact

Questions or requests to access or correct your data: fin-insight@gmail.com. Data protection officer: fin-insight@gmail.com.