Privacy
Fincraft holds your financial records so it can organise them for you, and for nothing else. We do not sell your data, we do not share it with advertisers, we do not use it to train anything, and we do not track you around the internet. This page says exactly what is held, who can reach it, where it lives and how long it stays.
Last updated 1 November 2026
LEGAL_OPERATOR, LEGAL_ADDRESS, LEGAL_GOVERNING_LAW, LEGAL_JURISDICTION, LEGAL_CONTACT_EMAIL.
Set them in .env and the wording below completes itself.
See config/legal.php.
Who is responsible
[not set], of [not set], is the controller of the personal data you put into Fincraft. For anything about this policy or your rights under it, write to [not set].
What is stored
| Account details | Your name, email address, date of birth and a one-way hash of your password. The date of birth confirms you are old enough to agree to the terms and sets the rules that change with age, such as senior-citizen tax slabs; it is never shown to anyone else in the household or sent to Ask AI. The password itself is never stored and cannot be recovered or displayed — only replaced. |
|---|---|
| Financial records | The accounts, balances, valuations, transactions, holdings, budgets, goals, loans and recurring items you enter or import. |
| Nominee and estate records | The names, relationships and contact details of people you record as nominees or beneficiaries, and any documents you upload. |
| Imported statements and app exports | The rows you confirm on the import preview, whether from a bank statement or an export from another app such as YNAB or Quicken. The uploaded file is held only while you review it, then discarded — it is not retained. |
| Memberships | Loyalty programmes, clubs, discount cards, coupons and air miles: the programme, its balance and dates, and the membership or card number, which is encrypted. |
| Secure vault | The sign-ins, PINs, notes and files you choose to keep there. Everything in the vault is encrypted, titles included. Items you mark end-to-end are encrypted in your browser with a passphrase that never reaches us, so we cannot read them at all. |
| Emergency contacts | The name and email address of anyone you name for emergency access, and a record of any request they make. They are emailed when you name them and if they ever ask for access. |
| Money sent abroad | The transfers you record: provider, amounts, fee and dates. Recipient names and references are encrypted. |
| Fingerprint, face or PIN unlock | If you open the vault with your device's fingerprint, face or PIN, only a public key and the device's name are stored. Your fingerprint, face or PIN never leaves your device and is never sent to us. |
| Ask AI conversations | The questions you ask and the answers, kept only in your signed-in session — on this server, until you start a new conversation or sign out — so a follow-up question makes sense. They are not written to the database. |
| Testimonials | Anything you send us about your experience, with the name you choose. It is published on the website only if you agreed to that when sending it, and you can withdraw it at any time. |
| Subscription records | Which plan you are on, when it renews, and a reference to the payment from our payment provider. |
| Preferences | Your reporting currency, language and light/dark theme choice. |
| Activity log | Sign-ins, failed attempts, vault unlocks, administrative actions and significant changes, with the IP address and browser that made them. You can read your own, and download it, from the activity log; it is what makes unauthorised access noticeable. |
| Recognised devices | For each browser or device you sign in from: a description such as “Chrome on Android”, the last internet address, and when it was first and last used. The browser holds a random identifier in a cookie; we keep only a one-way hash of it. This is what lets us email you when a device you have never used signs in. |
| Sessions | An identifier, IP address, browser string and last-active time for each browser you are signed in from. |
What is not stored
- No card numbers. Payment card details are entered on our payment provider's own page and never reach our servers. We hold only the provider's reference, the last four digits and the card type.
- No banking credentials. Fincraft never connects to a bank, holds no online banking login, and cannot move money. Statements are imported as files, by you.
- No advertising or behavioural tracking. Google Analytics counts visits to the public pages (front page, sign-in, policies) while you are signed out, and nothing else.
- No third-party fonts or stylesheets, and no third-party script inside the application: once you are signed in, Google Analytics is not loaded. Your financial records are never sent to Google.
Encryption
The most sensitive fields — account numbers, membership and card numbers, nominee details, identity numbers, recipients of money sent abroad, your own notes, and everything in the secure vault — are encrypted in the database with a key held separately from the application's signing key. Everything is served over HTTPS, and backups are encrypted at rest.
Vault items you mark end-to-end go further: your browser encrypts them with a passphrase only you know before they are sent, so what we store is unreadable to us, to anyone who obtains the database, and to anyone who obtains a backup. The cost is that a forgotten passphrase cannot be reset by us — those items are lost with it.
Ask AI
Questions asked in the Assistant are answered on this server unless the installation offers Ask AI and your household's owner has switched it on. Then each question is sent, with a summary of the household's figures, to Anthropic, the company that makes the Claude model, which writes the answer. The summary holds balances and totals, the names you gave accounts, categories and payees (with any long number in a name cut to its last four digits), scheduled payments, goals, loans and loyalty points. It never holds passwords, full account, card or membership numbers, anything in the vault or documents, nominees or emergency contacts, or individual transactions.
Under Anthropic's commercial terms, what is sent is not used to train their models and is kept only for a limited period for safety and abuse monitoring. The owner can switch Ask AI off at any time, and from that moment nothing more is sent.
Who can see your data
You see your own household's records and nobody else's. Where you invite other people into a household, they see what their role allows — the roles are explained on the household screen, and the nominee and document screens are behind their own permissions precisely because somebody who keeps the books day to day has no business knowing who is named on them.
Roles are enforced by the server, not just by what the screens show: a viewer or adviser cannot add, change or delete anything, whatever they send. Access given with an end date stops on that date — the person can no longer open the household at all.
Someone you name for emergency access sees nothing until they ask, you are emailed at once, and the waiting period you chose passes without you declining. Even then they see only the emergency pack and the vault items you marked for release.
On our side, access is limited to the small number of people who operate the service, it is logged, and it happens only to fix a fault or when you ask us to look at something. We do not read your records otherwise.
Who else holds it
config/legal.php before this service takes a customer. Both the Indian
DPDP Act and the UAE PDPL expect this list to exist and to be accurate.
How long it is kept
- Your records are kept while your account is open.
- If the household's owner erases its data, everything in it is erased from the live service immediately and cannot be recovered from the screens.
- If a subscription lapses without being cancelled, records are kept for 90 days so you can come back, then deleted.
- Encrypted backups are kept so the service can be recovered after a disaster: one for each of the last 14 nights, one for each of the last twelve months, and one for each of the last 5 years. Data you erase stays inside older backups until they age out on that schedule — at most 5 years. Backups are never used for anything but recovering the whole service, and if one ever had to be restored, anything erased since it was taken would be erased again.
- Sessions expire after 120 minutes of inactivity. Password reset links expire after 60 minutes and work only once.
- Invoices and payment records are kept as long as tax law requires in the country of billing — seven years in India and the UAE, and between five and ten years in most other countries. They hold no financial records of yours — only what was paid, when, and for which plan.
Your rights
Under the data protection law where you live — among others India's Digital Personal Data Protection Act 2023, the UAE and Saudi Personal Data Protection Laws, the UK and EU GDPR, South Africa's POPIA, Kenya's Data Protection Act, Nigeria's Data Protection Act, and the data privacy laws of the Philippines, Sri Lanka and Nepal — you may ask for access to your data, correction of it, erasure of it, a copy you can take elsewhere, and to withdraw consent. Most of these you can exercise yourself, immediately, without asking us:
- Export everything as JSON from your profile or the Settings screen at any time, and transactions, accounts and budgets as CSV from Reports.
- Correct anything directly on the screen it appears on.
- Delete everything from your profile, if you are the household's owner. This erases every account, transaction, budget, goal, membership and vault item in it. A member who wants their own details removed can ask the owner to remove them, or write to us.
- See what has been done on your account, and download it, from the activity log.
- See where you are signed in, and sign other browsers out, from your sessions.
- Change your password at any time, and turn on two-factor authentication.
For anything the screens do not cover, write to [not set]. We will answer within 30 days. If you are not satisfied with the answer you may complain to the data protection authority where you live — for example the Data Protection Board of India, the UAE Data Office, Saudi Arabia's SDAIA, the UK Information Commissioner's Office, South Africa's Information Regulator, Kenya's Office of the Data Protection Commissioner, the Nigeria Data Protection Commission, or the Philippines' National Privacy Commission.
If something goes wrong
If a breach affects your data we will tell you and the relevant authority without undue delay, and in any case within 72 hours of becoming aware of it, with what we know, what we are doing about it, and what you should do.
Security
- Passwords are hashed with bcrypt. Nobody — including us — can read them.
- Two-factor authentication is available on every plan, including the free one, and is required for household owners and administrators.
- A sign-in from a browser or device your account has never used is emailed to you at once, and repeated failed attempts to sign in are too, so someone using or guessing your password is noticed.
- The vault locks itself after five idle minutes and needs your password, or your device's fingerprint, face or PIN, to open again.
- Sign-in, registration and password reset are rate limited.
- Every form is protected against cross-site request forgery.
- A Content-Security-Policy forbids loading script, styles, images or fonts from any other origin, which rules out an entire class of injected-script attack.
- Requesting a reset link gives the same answer whether or not the address has an account, so the form cannot be used to discover who has one.
- Every household's data is scoped at the query level, and what each role may change is checked on the server for every request. Both are covered by automated tests that run on every change.
We email you about your account: password resets when you ask, sign-in codes, sign-ins from a new device, warnings of repeated failed sign-ins, reminders of renewals, maturities and expiring points or documents (owners and partners, unless they switch them off), emergency-access notices, and changes to your subscription or to these terms. Reminder emails carry titles only — never an account number, balance or policy number. There are no newsletters and no marketing email unless you ask for one.
Children
Fincraft is not offered to anyone under 18, and we do not knowingly hold a child's data. A child named as a nominee is recorded as information about your arrangements, not as a user.
Cookies
Fincraft's own cookies are all functional; Google Analytics sets its own to count visits. See the cookie policy for the full list.
Changes
If this policy changes in a way that affects you, we will email you before it takes effect. The date at the top always shows when this page last changed.