Last updated: August 20, 2026
This Privacy Policy explains how Finzy ("Finzy", "we", "our", or "the app") handles your information. It applies to the Finzy mobile app for iOS and Android.
| What | Where it goes | When |
|---|---|---|
| Expenses, categories, budgets, income, recurring expenses, display name, currency, theme, language | Your device only | Always |
| The same records, plus your email address | Our cloud backup provider (Supabase) | Only if you turn on Cloud Backup |
| Spending figures, or a receipt photo, or a voice transcript | Our processing service (Cloudflare) and then Google Gemini | Only when you use an AI feature |
| A random install identifier | Our processing service (Cloudflare) | Only with AI requests, to enforce daily usage limits |
| A CSV file of your transactions | Wherever you send it | Only when you tap Export |
| Usage analytics, advertising identifiers, crash telemetry | Nowhere — not collected | Never |
Finzy stores your financial data in a database on your device. This includes:
If you never turn on Cloud Backup and never use an AI feature, this data never leaves your device.
Cloud Backup is off unless you switch it on. It exists so your expenses survive a lost or replaced phone.
To back up, you sign in with your email address. We send a six-digit code to that address and you enter it in the app — there is no password to create or remember. We store your email address to identify your account, and the display name you choose so it can appear on your other devices.
While backup is on, the app uploads and keeps in sync:
Deletions are synced as well, so removing an expense on one device removes it everywhere.
Backups are stored with Supabase, our database and authentication provider, acting as a processor on our behalf. Data is encrypted in transit (HTTPS/TLS) and encrypted at rest by the provider. Database access rules restrict every record to the account that created it.
From Settings → Cloud Backup you can at any time:
Deletions are immediate and irreversible. Residual copies may persist in encrypted infrastructure backups for up to 30 days before being overwritten in the normal course of operation.
Finzy has four features that use artificial intelligence. All four are optional, none run in the background, and each one only sends data at the moment you ask it to.
The app does not talk to the AI provider directly. Requests pass through a small processing service we operate on Cloudflare Workers, which attaches our API credentials, applies a daily usage limit, and forwards the request to the Google Gemini API. The service does not require or receive your name, email address or account.
When you tap to analyse a month, the app sends: transaction amounts, dates, weekday and hour, categories, any notes you have written, your budgets, your monthly income if you have set one, your currency, and your chosen language. The first time you use the feature, the app shows you exactly what will be shared and asks you to confirm.
Your typed question is sent along with a summary of your spending for context — recent transactions and category-level totals. The conversation for the current month is kept on your device so you can scroll back, and you can delete it at any time from the chat screen.
When you speak an expense, your device's built-in speech recognition converts the audio to text. That text transcript — not the audio — is then sent to be turned into an amount, a merchant and a category. See Section 5 for how the audio itself is handled.
When you scan a receipt, the photo is resized on your device and the image is transmitted for reading, together with a list of your category names so the result can be matched to one. The photo is used for that single request. Finzy does not save the photo, add it to your library, or attach it to the expense.
To avoid repeating identical work, an AI response may be cached by our processing service for up to six hours, keyed by a one-way hash of the request. A random install identifier generated on your device is sent with AI requests solely to count them against a daily limit; the counter expires automatically. This identifier is not linked to your name, email or account, and is not used for advertising, profiling or tracking.
Google processes this data under its own terms:
If you never open an AI feature, no spending data is ever sent for AI processing.
The microphone is used only while you are actively recording a voice entry, and only after you grant permission. Finzy does not record in the background and does not save audio files.
Speech is converted to text by your operating system's speech recognition service (Apple on iOS, Google on Android). Depending on your device, language and system settings, that service may perform the conversion on the device or may send the audio to the platform provider's servers for processing. That handling is governed by Apple's or Google's privacy policy, not ours. Finzy itself neither stores your audio nor transmits it to our own services.
The camera is used only when you open the receipt scanner, and photo library access only when you pick an existing receipt image. Finzy does not browse, index or upload your photo library. The selected image is used for a single receipt-reading request and is not stored by us afterwards.
If you allow notifications, Finzy schedules reminders locally on your device — for expenses you have marked as recurring, and optionally when your Monthly Rewind is ready. No push server is involved and no notification data leaves your device. You can turn notifications off at any time in your device settings.
Export Data generates a CSV file of your transactions for the range you select and hands it to your device's share sheet. You choose the destination. We do not receive, see or store exported files, and once a file leaves the app it is governed by the privacy practices of wherever you sent it.
Where the GDPR or UK GDPR applies, we rely on:
Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, and to receive a copy in a portable format. Finzy is built so you can exercise most of these yourself, immediately:
For anything you cannot do in the app, contact us at the address in Section 15. We respond within 30 days. You also have the right to complain to your local data protection authority.
California residents: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not discriminate against users who exercise their privacy rights.
Our service providers — Supabase, Cloudflare and Google — operate globally, so data processed through Cloud Backup or AI features may be handled on servers outside your country, including in the United States. Where required, these transfers rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard offered by the provider.
Your data is stored in an SQLite database on your device, protected by your device's own passcode, biometrics and encryption. Sign-in credentials are held in the device keychain and encrypted with a key that never leaves it. All network traffic uses HTTPS/TLS. Backed-up records are encrypted at rest by our provider and isolated per account.
No system is perfectly secure, so please keep your device software up to date and protect the email account you use to sign in — anyone with access to it could request a sign-in code.
Finzy is not directed at children under 13 (or under 16 in the EEA/UK), and we do not knowingly collect data from them. If you believe a child has provided us with personal data, contact us and we will delete it.
If we make material changes, we will update the "Last updated" date above and, where the change is significant, tell you in the app. Continued use after a change constitutes acceptance of the updated policy.
Questions, requests or complaints about this Privacy Policy:
nsgmobileapps@gmail.com