Overview
FinTrack is a private household budgeting app operated by Rafael Alonso for his own household. This policy explains what data FinTrack accesses, how it is used, and how you can remove it. FinTrack does not sell data, show ads, or use your data for any purpose other than running the app for you.
Google user data (Gmail)
If you choose to connect Gmail, FinTrack requests the read-only Gmail scope (gmail.readonly) plus your email address. FinTrack uses this access only to:
- Search your mailbox for transaction alert emails from supported banks (Chase and Itaú sender domains). Other emails are not requested.
- Read those alerts on FinTrack's server to extract the merchant, amount, currency, date and card ending, and record them as transactions in your budget.
FinTrack never sends, modifies or deletes email. The full email body is not stored; FinTrack keeps the extracted transaction plus the alert's sender address, subject and message ID so it can avoid duplicates. Email content is never sent to an AI model.
FinTrack's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used for advertising, is not sold, is not used to train AI or machine-learning models, and is not read by people except with your consent, for security, or as required by law.
Other data FinTrack processes
- Account: your name, email address and Google account identifier, used to sign you in and to share a household with members you invite.
- Bank accounts: if you connect a bank through Plaid, FinTrack receives account names, masked account numbers, balances and transactions. Your bank credentials go to Plaid and are never seen or stored by FinTrack.
- Budget data you enter, such as categories, budgets, income and savings goals.
- Device token for iPhone notifications. Notification text does not include merchants or amounts.
Service providers
- Vercel hosts the application server.
- Neon stores the database (United States).
- Plaid connects bank accounts, when you choose to use it.
- Apple Push Notification service delivers notifications.
- TypeSafe may receive the name of a well-known public business (for example "Trader Joe's") to suggest a budget category. It never receives email text, amounts, dates, people's names or account details.
Security
Data is encrypted in transit. Gmail and Plaid access tokens are encrypted at rest with AES-256-GCM. Every request is checked against your session and household membership, and private allowance spending is visible only to its owner.
Retention and deletion
Data is kept while you use FinTrack. You can disconnect Gmail at any time from your Google Account permissions, and disconnect banks from the app's settings. To delete your account and all associated data, email rafaeljosealonsogerla@gmail.com; deletion is completed within 30 days.
Contact
Questions about this policy: rafaeljosealonsogerla@gmail.com.