FinalyzePrivacy Policy
This Privacy Policy explains how Finalyze ("Finalyze," "we," "us," or "our") handles information in connection with the Finalyze web application and related services (the "Service"). Finalyze is a personal financial analysis tool that is designed, from the ground up, to keep your financial data on your own device.
Please read this Policy together with our Terms of Service. By using the Service, you agree to the practices described here.
1. The short version
Finalyze is built so that your financial data never leaves your device.
- Your imported statements, transactions, categories, budgets, tags, merchant merges, accounts, and downloaded AI models are stored locally in your browser (using IndexedDB). They are not transmitted to, or stored on, our servers.
- The only personal information we hold on a server is what is needed to operate your account: your email address, your encrypted authentication credentials, your plan, license, and referral flags, and the onboarding preferences you provide (such as country, currency, and goals, which only adjust labels in the app).
- We do not sell your personal information, and we do not use your financial data for advertising or profiling.
The sections below provide the detail behind this summary.
2. Information we do not collect
Because of how Finalyze is designed, we do not receive or store the following:
- Your uploaded statement files (PDF, OFX/QFX, CSV) or their contents.
- Your individual transactions, balances, merchants, amounts, or dates.
- Your categories, budgets, tags, rules, merchant merges, or dashboard layout.
- The prompts you type into, or the responses you receive from, the on-device AI assistant.
This information is parsed and processed entirely within your browser and is stored only on the device you use. We have no technical means of accessing it.
3. Information we collect and process
3.1 Account information
To create and operate your account, we collect and store:
- Email address - used to identify your account, for sign-in, and for essential account communications.
- Authentication credentials - your password is stored in an encrypted/hashed form by our authentication provider; we do not have access to your plaintext password. If you choose to sign in with Google (where available), we receive a basic identifier and email from that provider rather than a password.
- Account and entitlement flags - for example, whether you are on the Free or Pro plan, your subscription status, and referral-program flags.
- Onboarding preferences - such as country, currency, and stated goals. These tune labels and display in the app and are not linked to your transaction data.
3.2 Payment information
If you upgrade to a paid plan, payments are processed by our third-party payment processor, Stripe. Your card and billing details are submitted directly to Stripe and are governed by Stripe's privacy policy. We do not receive or store your full payment card number. We may receive limited billing-related confirmations from Stripe (for example, subscription status, the last four digits of a card, or a billing country) to manage your subscription.
3.3 Technical and log information
When you connect to our servers for the limited purposes described in Section 4, standard technical information may be processed by us or our infrastructure providers, including IP address, browser type, device type, and timestamps. This is used for security, fraud prevention, debugging, and to keep the Service running. We aim to keep this minimal and do not use it to build advertising profiles.
3.4 Information stored locally on your device
The following is stored only on your device and is under your control: transactions, categories, category groups, budgets, tags, merchant overrides and merges, rules, accounts, dashboard layout, JSON backups you create, and any AI models you download. You can export this data to a JSON backup or clear it at any time from within the app.
4. When your device contacts our servers
Finalyze is designed to minimize network activity. Your device communicates with our servers or our service providers only for the following purposes:
- Sign-in and account management - to authenticate you and load your account settings.
- Pro upgrade and checkout - to process a subscription payment through Stripe.
- One-time AI model download - when you opt in to on-device AI, the model files are downloaded once and then cached and run locally in your browser.
Outside of these events, your financial data is processed locally and is not sent anywhere.
5. On-device AI
Finalyze's AI features (categorization, chat, and narrative insights) are opt-in and run on your device using your browser's hardware (e.g., WebGPU). When you enable AI, the relevant model is downloaded once and cached locally. After that, your transactions and the questions you ask the assistant are processed locally and are not transmitted to us or to any third party for AI processing.
6. How we use information
We use the limited information we collect to:
- Create, authenticate, and maintain your account.
- Provide, operate, and secure the Service.
- Process and manage subscriptions and the referral program.
- Send essential account and transactional messages (for example, email confirmation, password resets, and billing notices).
- Detect, prevent, and respond to fraud, abuse, and security incidents.
- Comply with legal obligations and enforce our Terms of Service.
We rely on the legal bases of performance of a contract (providing the Service you request), our legitimate interests (security and operating the Service), consent (where required, such as optional features), and compliance with legal obligations.
7. Service providers (sub-processors)
We use a small number of trusted third parties to operate the Service. They process information only on our behalf and for the purposes described above:
| Provider | Purpose | Data processed |
|---|---|---|
| Authentication & database provider (e.g., Supabase) | Account creation, sign-in, storing account settings | Email, encrypted credentials, plan/referral flags, onboarding preferences |
| Stripe | Payment processing for paid plans | Billing and payment details (handled by Stripe), subscription status |
| Google (optional) | Optional "Sign in with Google" | Basic profile identifier and email |
| Model/hosting and content-delivery provider | Serving the app and one-time AI model download | Technical request data (e.g., IP, timestamps) |
We do not share your locally stored financial data with any of these providers, because we never receive it.
8. We do not sell your data
We do not sell your personal information, and we do not share it with third parties for their own advertising or marketing. We do not use your financial data to build advertising or behavioral profiles.
9. Cookies and local storage
Finalyze uses browser storage technologies for core functionality:
- IndexedDB - to store your financial data and AI model cache locally on your device.
- Local/session storage and authentication tokens - to keep you signed in and remember app settings.
These are strictly functional and necessary to provide the Service. We do not use third-party advertising or cross-site tracking cookies.
10. Data retention
- Account data (email, credentials, plan/referral flags, onboarding preferences) is retained for as long as your account is active, and afterward only as needed to comply with legal, accounting, or fraud-prevention obligations.
- Locally stored data remains on your device until you clear it, your browser clears it, or you change browsers/origins. We do not control this data and cannot retain or recover it.
- Payment records are retained by Stripe and by us as required for tax and accounting purposes.
11. Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain processing or withdraw consent.
- Access and portability of local data: You can export a full JSON backup of your data at any time from within the app.
- Deletion of local data: Use Clear data in the app to wipe all locally stored data on a device. (Export a backup first if you want to keep it.)
- Account data: To access, correct, or delete the account information we hold (such as your email), or to delete your account entirely, contact us at the address in Section 16.
- Marketing: We send essential account messages only. If we ever introduce optional communications, you will be able to opt out.
We will respond to verified requests within the time required by applicable law. We will not discriminate against you for exercising these rights.
12. Security
We use measures intended to protect the limited account information we hold, including encryption in transit, encrypted/hashed credentials, and reputable infrastructure providers. Your financial data benefits from an additional structural protection: because it never leaves your device, it is not exposed to a server breach.
No method of transmission or storage is completely secure. You are responsible for keeping your password confidential, securing your device and browser, and maintaining your own backups of locally stored data.
13. International data transfers
Our service providers may process the limited account information described above in countries other than the one in which you reside. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for these transfers. Your financial data is not transferred internationally by us because it remains on your device.
14. Children's privacy
The Service is not directed to children and is not intended for use by anyone under the age of 16 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.
15. Changes to this Policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Service after an update means you accept the revised Policy.
16. Contact us
If you have questions about this Privacy Policy or wish to exercise your rights, contact us at:
Finalyze
Email: contact@finalyze.cc
Support: available within the app