FinancistoPrivacy Policy
Last updated
Financisto is a personal finance app for iPhone and iPad. This policy says what the app and its server collect, why, who else handles it, how long it is kept, and how you delete it. The short version: your financial records are kept so that they sync between your devices, and for nothing else. They are never sold, shared for advertising, or used to profile you.
Who is responsible
Financisto is made and run by Igor Garin, an individual developer, who is the controller of your personal data under the GDPR. Contact: support@financisto.app.
What is collected, and why
Your account
You sign in with Apple or Google. We receive your email address (with Sign in with Apple this can be a private relay address that Apple forwards to you) and the provider's identifier for you. Nothing else from your Apple or Google account, and never your password. We use it to identify your account and to link your devices to it.
Your financial records
Everything you enter in the app (accounts, transactions, transfers, categories, payees, projects, locations, budgets, currencies, exchange rates, templates, scheduled transactions and notes) is stored on your device and copied to our server so that your other devices get the same data. This copy exists to provide sync; it is not read, analysed or shared for any other purpose.
When your account is active
For each day your devices sync, the server records that your account was active that day. We use this only to count how many people use the app and how many come back.
Anonymous usage data, only if you allow it
When you first open the app it asks whether to share anonymous usage data. Only if you choose Allow, the app records which screens are opened and which actions are taken (for example "a transaction was saved", "a sync failed"), with the app version, device type, iOS version, language, region and time offset. These events carry a random install identifier, not your account or email, and they never contain anything you typed: no amounts, names, payees, notes or file names. The identifier is replaced when you sign out, so under the GDPR the data is pseudonymous rather than fully anonymous. You can turn this off at any time in Settings; the app then stops recording and deletes the events it has not sent yet. We use this data to learn which parts of the app work and which don't.
Crash reports, with the same choice
The same Allow also turns on crash reports: when the app crashes or stops responding, it sends a report to Sentry, our error-tracking service. A report holds where in the app's code the problem happened, the app version, device model, iOS version and a random identifier for the installation; never your account, email, anything you typed, screenshots or your network requests. Turning usage data off in Settings turns crash reports off too.
Server error reports
When part of our server fails, it sends Sentry a report of where in the server's code the failure happened. These reports leave out the request, your account, error messages and any values from your data, so they contain nothing about you.
Server logs
The server keeps technical logs of requests and errors, which can include your account's internal identifier, so that we can find and fix problems and spot abuse. Your IP address is not stored in them.
Smart Import, by invitation only
Smart Import reads a receipt or bank statement you upload and proposes transactions. It is currently open only to invited testers. If you use it, the document is sent to our server and read by Amazon Textract (text recognition) and OpenAI (understanding the text); OpenAI receives it through its API, under terms that do not allow it to train models on it. The uploaded documents and their readings are deleted after 30 days. When you save an import, a short record of what you saved (such as which category you chose for which item) is kept so that later imports suggest your choices; it is deleted with your account.
What is not collected
- No advertising identifiers and no tracking across other companies' apps or websites.
- No third-party analytics or advertising SDKs in the app. The one third-party component is Sentry's crash reporter, which runs only if you allow it.
- No location, contacts, photos or files, except a document you choose to import.
- This website sets no cookies, runs no scripts and keeps no visitor logs.
Legal bases
- Your account, financial records and server logs: performing our agreement with you, that is, providing the app and sync (Article 6(1)(b) GDPR), and our legitimate interest in keeping the service secure (Article 6(1)(f)).
- Active days: our legitimate interest in knowing whether people keep using the app (Article 6(1)(f)).
- Usage data and crash reports: your consent (Article 6(1)(a)), which you can withdraw in Settings.
- Server error reports: our legitimate interest in keeping the service working (Article 6(1)(f)).
Who handles your data
| Service | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting the server, database, storage and sign-in (Amazon Cognito); Textract for Smart Import | Ireland (EU) |
| Apple and Google | Sign-in, under their own privacy policies | Their own |
| OpenAI | Smart Import only | United States |
| Sentry (Functional Software, Inc.) | Crash and error reports | Germany (EU) |
They process the data on our behalf and for no purpose of their own. Transfers outside the EU rely on the European Commission's standard contractual clauses or the EU–US Data Privacy Framework. We sell or share your data with no one else.
How long it is kept
- Account, financial records, active days and Smart Import records: until you delete your account.
- Smart Import documents and their readings: 30 days.
- Server logs: 30 days.
- Usage data: 13 months, then deleted automatically.
- Crash and error reports: 30 days at Sentry.
- Database backups, kept to recover from failures: they expire within 7 days, so data you delete leaves them within that time.
Deleting your data
In the app, go to Settings and choose Delete Account. This immediately erases your account, your financial records, your active days and your Smart Import documents and records from our server, and erases the app's data on that device. Usage data and crash reports are not erased, because they are not linked to your account and we cannot tell which were yours. Logs and backups expire as described above.
Signing out also erases the app's data from that device, but keeps your account and its data on the server so you can sign in again.
Your rights
Under the GDPR and similar laws you can ask for access to your data, its correction, its deletion, a copy in a portable format, a restriction of its processing, or object to processing based on our legitimate interests. Many of these you can do yourself: the app shows all your records, exports them as a backup file or CSV, and deletes your account. For anything else, email support@financisto.app; we answer within one month. You can also complain to a data protection authority in your country.
Security
Data travels only over encrypted connections (HTTPS) and is encrypted at rest on the server. Each account's data is kept separate and is reachable only with that account's sign-in.
Children
Financisto is not meant for children under 16, and we do not knowingly collect their data.
Changes
When this policy changes, the new version is posted here with a new date. A change that affects how your existing data is used will also be announced in the app.