Privacy Policy

Information we collect

• Account data. When you sign in (with Google, or with an email and password, via Supabase Auth), we receive identifiers and profile details needed to create and secure your account.
• Financial link data. If you connect a bank through Plaid, we receive your transactions, account names, types, last four digits and balances and, where your bank supports it, credit card and loan details such as balances, APRs and due dates. We do not receive your bank login credentials.
• Receipts and prices. Photos of receipts you scan, and what is read from them: the store and its address, the date and time, and each item with its price.
• Location. Only if you allow it: where you are when you scan a receipt or look up prices near you. You can decline and pick a place yourself instead.
• Content you provide. Budget entries, bills, loans, chat messages, and similar content you submit are stored to provide the service.
• Notifications. Only if you allow them: a push token for your device, used to send the alerts you choose.
• Technical data. We may process standard logs and diagnostics needed to operate and secure the service.

Your consent

You agree to this policy and our Terms of Service when you create an account. Before you connect a bank, Finpal explains what it will access, and Plaid asks for your consent before sharing any data from your bank with Finpal. Location, camera, photos and notifications are used only after you allow them when your device asks. You can withdraw consent at any time by disconnecting a bank, turning off a permission in your device settings, or deleting your account.

How we use information

We use the information above to operate Finpal, personalize your experience, sync and display transactions, show what you pay for items at each store, run AI-assisted features you invoke, prevent abuse, and comply with law. We do not sell your personal financial information.

Anonymous price sharing

Unless you turn it off in Settings (“Share prices anonymously”), the item, store, price and week from your receipts help other Finpal users within 20 miles compare prices. Other users see only prices per store; we never share who you are or what else you bought, and never share pharmacy, health, alcohol or tobacco items.

Service providers

We rely on vendors that process data on our behalf, including:

• Supabase for authentication, database hosting and receipt photo storage
• Amazon Web Services to run the servers behind the app and to host this website and the web app
• Plaid for optional bank linking (see Finpal & Plaid)
• OpenAI or similar providers to read the receipts you scan and when you use AI chat or analysis features, subject to their terms
• Google if you choose Sign in with Google
• Expo to deliver push notifications, if you allow them
• OpenStreetMap (Nominatim) to turn a location into an address, and a store’s address into a point on the map

Each provider has its own privacy practices; we encourage you to review their policies.

Retention and deletion

We keep your information while your account is open, and only for the purposes in this policy.

• Disconnecting a bank in the app removes that connection at Plaid, so Plaid stops sharing its data, and deletes the accounts and transactions it brought into Finpal.
• Deleting your account (Settings → Delete Account) removes every bank connection at Plaid and then deletes your account and everything stored with it, including transactions, receipts and their photos, budgets, chats and price data. This happens right away; copies in our database backups expire within 30 days.
• Logs kept by our service providers expire under their own retention periods.

We review this policy and our retention practices at least once a year, and whenever the app or the law changes in a way that affects them.

Security

Information is encrypted in transit (TLS 1.2 or higher) and at rest, and the access tokens that let Finpal reach your bank through Plaid are encrypted again before they are stored. You can turn on two-factor sign-in with a passkey, and it is required before you connect a bank. Access to the systems that store your information is limited to Finpal's administrator and is logged. No method of transmission or storage is completely secure.

Your choices

In the app you can disconnect banks, delete receipts and other content you added, turn off anonymous price sharing, and delete your account. You can also ask us for a copy of your information, to correct it, or to delete it, and use any other rights available where you live, by writing to support@finpal.tech from your account's email address. We respond within 30 days. We do not sell your personal information or share it for advertising.

Children

Finpal is not directed at children under 13, and we do not knowingly collect their personal information.

Changes

We may update this policy from time to time. We will post the updated version on this page and revise the “Last updated” date.

Contact

support@finpal.tech