Privacy Policy

Last updated: June 2026

1. Who We Are

Finance Assistant ("the App") is a personal finance tracking application available at financeassistant.xyz and on mobile platforms. The App is operated by Finance Assistant ("we", "us", "our").

2. Data We Collect

2.1 Account Data

When you create an account, we collect:

• Email address — used for authentication and password recovery
• Password — stored as a cryptographic hash, never in plain text

2.2 Financial Data You Enter

All financial data is voluntarily entered by you. We do not connect to bank accounts, credit cards, or any financial institution. Data you may enter includes:

• Income and employment details
• Monthly expenses and annual bills
• Assets (savings, investments, property, gold holdings)
• Liabilities (mortgage, loans, debts)
• Pension and retirement settings
• Tax return information
• Zakat calculation data
• Net worth targets and savings goals

2.3 Data We Do NOT Collect

• Bank account numbers or sort codes
• Credit or debit card numbers
• National Insurance numbers
• Passport or identity document details
• Location data
• Device contacts, photos, or files
• Browsing history

3. How We Use Your Data

Your data is used solely to:

• Display your financial dashboard and calculations
• Generate personalised AI financial advice (when you use the AI Coach feature)
• Calculate tax, pension projections, Zakat, and other financial tools
• Sync your data across your devices

4. Data Storage and Security

4.1 Where Data Is Stored

Your data is stored in a Supabase database with the following security measures:

• All data is encrypted in transit (TLS/HTTPS)
• All data is encrypted at rest
• Row Level Security (RLS) ensures you can only access your own data
• Authentication is handled by Supabase Auth with PKCE flow
• Database hosted on secure cloud infrastructure

4.2 Local Storage

The App stores minimal data locally on your device:

• UI preferences (theme, Simple/Pro mode, selected currency) — stored in localStorage
• Authentication session tokens — managed by Supabase Auth

No financial data is stored permanently on your device. All financial data resides in the secure cloud database.

5. Third-Party Services

The App uses the following third-party services:

5.1 Supabase (Database and Authentication)

Stores your account and financial data securely. Supabase Privacy Policy

5.2 Vercel (Hosting)

Hosts the web application and serverless API functions. Vercel Privacy Policy

5.3 Google Gemini AI (AI Coach)

When you use the AI Financial Coach feature, a summary of your financial data is sent to Google Gemini API to generate personalised advice. This data is:

• Sent only when you actively ask a question
• Not stored by Google beyond the API request
• Not used by Google for training AI models
• Processed under Google API Terms of Service

5.4 Exchange Rate API

Currency exchange rates are fetched from exchangerate-api.com for multi-currency display. No personal data is sent.

5.5 Gold Price API

Live gold prices are fetched from public market data sources. No personal data is sent.

6. Your Rights (UK GDPR)

Under the UK General Data Protection Regulation and Data Protection Act 2018, you have the right to:

• Access — Export all your data at any time using the in-app Export feature
• Rectification — Edit any of your data directly in the App
• Erasure — Delete your account and all associated data
• Portability — Download your data in JSON format via the Export feature
• Restrict processing — You control what data you enter
• Object — Contact us to object to any data processing

7. Data Retention

• Your data is retained for as long as your account is active
• If you delete your account, all data is permanently removed within 30 days
• You can export your data at any time before deletion

8. Data Deletion

You can delete your data in two ways:

• In-app: Settings menu, Danger Zone, Delete All Data
• Account deletion: Contact us at the email below to request full account deletion

9. Children's Privacy

The App is not intended for children under 13 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Cookies and Tracking

The App does not use cookies for tracking or advertising. We do not use analytics services, advertising SDKs, or tracking pixels. The only cookies used are essential authentication session cookies managed by Supabase Auth.

11. Advertising

The App contains no advertisements. We do not share your data with advertisers. We do not monetise your personal data in any way.

12. Security Measures

• HTTPS encryption on all connections
• Supabase Row Level Security (RLS) — each user can only access their own data
• Password hashing using bcrypt via Supabase Auth
• PKCE authentication flow for secure password recovery
• API keys stored as server-side environment variables, never exposed to the client
• No sensitive data stored in browser localStorage
• Serverless API functions for external service calls (AI, gold prices) — your API keys are never visible to users

13. International Data Transfers

Your data may be processed in countries outside the UK where our service providers (Supabase, Vercel, Google) operate. These providers maintain appropriate safeguards including Standard Contractual Clauses and equivalent data protection measures.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will reflect the most recent revision. Continued use of the App after changes constitutes acceptance of the revised policy.

15. Disclaimer

• The App does not provide regulated financial advice
• We are not a financial advisor, accountant, tax professional, or regulated firm
• All calculations, projections, and figures are estimates and may not reflect your actual financial situation
• We are not liable for any financial decisions made based on information provided by this App
• Tax rates, pension rules, and financial regulations change — always verify with official sources (HMRC, pension providers, FCA)
• The AI Financial Coach provides general information only — not personalised regulated advice
• For important financial decisions, consult a qualified financial adviser regulated by the FCA
• Gold prices and investment values are live market data and may fluctuate
• We are not liable for errors, omissions, or inaccuracies in the data provided

16. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have concerns about your data, contact us at:

Email: privacy@financeassistant.xyz

Website: financeassistant.xyz