Privacy Policy
Effective date: July 13, 2026 · Last updated: July 13, 2026
FinTrack (“FinTrack”, “we”, “us”) is a personal-finance tracking app operated by Swatantra Dhakal, based in Nepal. This policy explains what we collect, why, who we share it with, and the choices and rights you have. It covers the FinTrack mobile app and its backend service.
If you have questions or want to exercise a privacy right, contact us at support@swatantra.dev.
1. A quick summary
- Your transactions, notes, and receipts are your content. We store them to sync across your devices — we do not sell them and we do not use them to build advertising profiles.
- FinTrack works offline first: your data is stored on your device and synced to our server when you’re online.
- Voice recordings and receipt photos you choose to process with AI are sent to Google’s Gemini API to extract the amount, date, and merchant. We do not use your data to train our own models.
- You can delete your account and data at any time from Settings → Delete Account, or by emailing us.
2. Who is the data controller
The data controller is Swatantra Dhakal (Nepal), contactable at support@swatantra.dev. For users in the EU/EEA and UK, see Section 11 for how to reach us about data-protection matters.
3. What we collect and why
We collect only what the app needs to work. We do not buy personal data from third parties.
3.1 Account and identity
| Data | Purpose | When |
|---|---|---|
| Name (or “guest”), avatar selection | Display your profile | On sign-up / profile setup |
| Email address | Sign-in, account recovery, transactional email | Only if you sign in with email, Google, or Apple |
| Country and currency | Localize amounts and set your free-tier voice limits | Profile setup |
| Login provider + provider account ID | Authenticate you (device, Google, Apple, or email) | Sign-in |
| Device-generated account identifier | Enable “device accounts” that work without an email | Device sign-in |
| One-time passcode (OTP) | Verify email ownership when you add/upgrade an email | Email verification — we store only a hashed code, which expires shortly |
3.2 Financial content you create (the core of the app)
- Transaction records: amount, title, notes, category, date, an “important” flag, and how the entry was created (manual, voice, or picture).
- Recurring subscription templates you define (title, amount, category, next charge date).
- Category customizations (names, colors, icons).
This content is stored on your device and on our server so it can sync across your devices.
3.3 Receipt images
Photos you capture or select to attach to a transaction. Stored in our object storage and linked to your account. You control which images you upload.
3.4 Voice recordings
Audio you record to add a transaction by voice. See Section 4 for how AI processing works. We keep voice-feature usage counts to enforce free-tier monthly limits; we do not retain the audio beyond what is needed to process your request.
3.5 Purchases (FinTrack Pro)
If you subscribe, we process the subscription status and store purchase identifiers (product ID, store transaction/original transaction ID, period start/end, status) to unlock paid features and keep your entitlement in sync. Payments are handled by Apple and Google via RevenueCat — we never receive your card or payment details.
3.6 Diagnostics and technical data
- Crash reports and error diagnostics (via Sentry, only when enabled in a build) to fix bugs. These may include device model, OS version, and a technical stack trace.
- Push notification token on Android (via Firebase Cloud Messaging) to send you reminders/notifications you’ve opted into. (Push is currently not enabled on iOS.)
- Basic network/connectivity state to decide when to sync.
We do not use third-party advertising SDKs, and FinTrack does not track you across other companies’ apps or websites. No App Tracking Transparency prompt is shown because we do not track.
4. How AI processing works
When you add a transaction by voice or receipt photo, FinTrack sends only that audio clip or image (plus a fixed instruction prompt) to the Google Gemini API to extract structured fields — amount, date, merchant/title, and a suggested category. The extracted result is returned to you to review and save.
- We transmit the media and prompt over an encrypted connection.
- We use the Gemini API on a plan under which Google does not use your prompts or responses to train its models. See Google’s Gemini API terms.
- We do not use your content to train our own models.
- AI extraction can be inaccurate — always review the result before saving. See our Terms of Service.
You can avoid AI processing entirely by adding transactions manually.
5. Legal bases for processing (GDPR / UK GDPR)
Where GDPR applies, we rely on:
- Performance of a contract — to provide the app, sync your data, and manage your subscription.
- Consent — to access your microphone, camera, and photo library, and to process your voice/images with AI. You can withdraw consent by disabling the permission or not using those features.
- Legitimate interests — to secure the service, prevent fraud/abuse, enforce usage limits, and diagnose crashes.
- Legal obligation — to keep records of purchases where required.
6. Who we share data with (sub-processors)
We share the minimum necessary with service providers who process data on our behalf under contract. We do not sell personal data.
| Provider | Purpose | Data shared | Where |
|---|---|---|---|
| Google (Gemini API) | AI extraction from voice/receipts | Audio clips, receipt images, prompt | Google Cloud regions |
| Google (Sign-In) | Authentication | Your Google account identifier, email, name | |
| Google (Firebase Cloud Messaging) | Push notifications (Android) | Push token | |
| Apple (Sign in with Apple) | Authentication | Apple account identifier, relay email | Apple |
| Apple / Google (in-app billing) & RevenueCat | Subscription purchase & entitlement management | Purchase identifiers, subscription status | US / global |
| Resend | Sending one-time passcode / transactional email | Email address, OTP email content | US / EU |
| Sentry | Crash & error diagnostics (when enabled) | Diagnostic/technical data, device info | US / EU |
| HostHatch (app server + database) | Hosting the API and storing your records | All account and transaction data | Singapore |
| Self-hosted MinIO, running on our HostHatch server (receipt image storage) | Storing receipt images | Receipt images | Singapore |
We may also disclose data if required by law, to protect our rights, or in connection with a business transfer (with notice).
7. International data transfers
We are based in Nepal, our app server and database are hosted in Singapore, and our sub-processors may process data in the United States, the European Union, or other countries. Where we transfer personal data of EU/EEA or UK users internationally, we rely on appropriate safeguards such as the processor’s Standard Contractual Clauses. By using FinTrack you understand your data may be processed outside your country.
8. How long we keep data
- Account and transaction data: kept until you delete your account or the specific records.
- Deleted records: removed from your active view immediately and purged from backups on a rolling basis.
- Account deletion: your email is erased and your account is deactivated immediately (see Section 9).
- One-time passcodes: short-lived; expire within minutes and are stored only as a hash.
- Purchase records: retained as needed to manage entitlements and meet legal/accounting obligations.
- Crash diagnostics: retained per Sentry’s default retention.
9. Deleting your account and data
You can delete your account at any time:
- In the app: Settings → Delete Account.
- By email: write to support@swatantra.dev from your account email.
When you delete your account, we deactivate it, erase your email address, and remove your personal content from active use. If you signed in with Apple or Google, we also revoke the associated sign-in token. Some records may persist briefly in encrypted backups before being overwritten, and we may retain the minimum data required by law.
10. Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Delete your data (“right to erasure”).
- Port your data to another service.
- Object to or restrict certain processing.
- Withdraw consent at any time.
- Complain to your local data protection authority.
To exercise any of these, email support@swatantra.dev. We respond within the timeframe required by law (generally 30 days).
California (CCPA/CPRA)
We do not sell or share (for cross-context behavioral advertising) your personal information. California residents have the rights to know, delete, correct, and to non-discrimination for exercising these rights. Submit requests to support@swatantra.dev.
11. EU/EEA and UK users
We have not yet appointed a representative in the EU/EEA or UK under Article 27 of the GDPR. Until we do, users in the EU/EEA and UK can raise any data-protection matter with us directly:
- Swatantra Dhakal — support@swatantra.dev
We will respond to your request within the timeframe required by law. You also retain the right to lodge a complaint with your local supervisory authority.
12. Children’s privacy
FinTrack is not directed to children under 13 (or under 16 in the EU/EEA where a higher age applies). We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.
13. How we protect your data
- All traffic between the app and our server is encrypted with TLS/HTTPS.
- Authentication tokens are stored on your device in the platform secure store (Keychain / Keystore).
- One-time passcodes are stored only as hashes.
- Access to production data is restricted and authenticated.
No system is perfectly secure, but we take reasonable measures to protect your information.
14. Changes to this policy
We may update this policy. Material changes will be reflected by the “Last updated” date and, where appropriate, an in-app notice. Continued use after changes means you accept the updated policy.
15. Contact us
Swatantra Dhakal
Email: support@swatantra.dev
Website: https://fin.swatantra.dev