Privacy Policy

The short version

• You type your money in or import a file, or, if you choose, connect a bank account so it is read for you. A bank connection is read-only and runs through a licensed partner: we never see your online-banking password, and nothing in Fyncora can move money.
• We do not sell your data, and nothing you enter is used for advertising. There are no ad trackers on Fyncora.
• Your data lives in the EU (Ireland). A few services outside the EU help us run specific features, and they are all named below.
• The AI features send parts of your data to OpenAI only when you use them — and, if you read payments from your phone's notifications, a bank notification the app cannot read on its own. OpenAI does not use it to train its models.
• You can download your data or delete your account yourself, at any time, from Settings → Privacy.

This policy explains what Fyncora does with personal data, in the detail the GDPR requires. It is written in plain language on purpose. If a sentence is unclear, write to privacy@fyncora.com and we will explain it.

Who is responsible#

Fyncora is run by:

• Fyncora, run by its founder Tomo in Slovenia
• Email: support@fyncora.com

The registered business details (name, address, registration and tax numbers) will be listed here as soon as the business registration is complete.

In the words of the GDPR, this is the controller of your personal data. We have not appointed a data protection officer, because the law does not require one for a service of this size. For anything about your data, write to privacy@fyncora.com.

What this policy covers#

This policy applies to the Fyncora website (fyncora.com), the Fyncora web app, the Fyncora phone app, the Fyncora Kids web and phone apps, the public money calculators, and the demo. It does not apply to other websites we link to, or to a service you connect to Fyncora yourself (for example your Google Drive, the AI app you connect through the AI connector, or the provider that connects your bank). Those have their own policies.

The English text is the one that applies. If we publish a translation and it differs, the English version governs.

Where your data comes from#

• From you. Almost everything in Fyncora is something you typed, imported from a CSV file, dictated, or scanned.
• From your bank, if you connect one. Through a licensed partner, your bank sends the accounts you chose, their balances and their transactions. See Bank connections below.
• From your phone's notifications, if you switch it on (Android). The Fyncora phone app reads card-payment notifications from the bank and wallet apps you pick, on your phone. See Payments from notifications below.
• From your household. If another adult in your household shares an account or an item with you, we show it to you, and the other way round. See Household sharing below.
• From a parent or guardian. A child's Fyncora Kids profile is created and filled in by the adult who manages it. See Children below.
• From Google, if you sign in with Google: your name, email address and profile picture.
• From your device and browser, automatically: the technical details every website receives (IP address, browser, operating system, language), which we use only as described under Security and Cookies.

We do not buy data about you and we do not receive data from data brokers.

What we process, why, and on what legal basis#

The GDPR requires a legal basis for each purpose. There are four we rely on: performing our contract with you (the Terms of Service), your consent, our legitimate interest in running a safe and working service, and legal obligations (tax law, mainly).

Purpose	Data	Legal basis
Creating and securing your account	Email address, password (stored only as a hash), name and avatar if you provide them or sign in with Google, language, currency, sign-in records, and when you accepted the Terms of Service (and which version)	Contract
Providing the service: your accounts, transactions, budgets, recurring bills, net worth, investments, goals, tasks, habits, projects, documents and everything else you enter	Whatever you enter or import	Contract
Billing	Email, name, your Fyncora user id, plan, trial and subscription dates, the payment processor's customer and subscription references. Card details go to the payment processor and never reach us	Contract, and legal obligation for the records of payments
Household sharing	What you choose to share and with whom; the household's membership	Contract (you set the sharing level for each account and item)
Fyncora Kids	The child's profile and records, and the guardian's consent record. See Children	Contract with the guardian; the guardian's consent, as required by law for a child under 15
AI features (assistant, financial advisor, voice entry, habit and plan suggestions, reading a payment notification the phone app cannot read on its own)	The parts of your data a feature needs, sent to the AI provider when you use it; the conversation history, kept for you until you delete it	Contract (the features are part of the service you asked for)
The AI connector	The data your own AI app requests, under the permission you gave that app. See Your own AI apps	Contract; you connect and disconnect the app yourself
Documents and warranties	A reference to each file you store, its type, warranty date, retailer and note. The file itself stays in your Google Drive, or, if you choose not to connect Drive, in our storage	Contract
Bank connections (only if you connect a bank)	The bank's name; the accounts you chose (name, type, currency, the last digits of the account number); their balances; their transactions (date, amount, description, the other party's name, a category hint); when your access ends and when we last read it	Contract (you ask us to read your accounts)
Support	Your messages, attachments, and a small technical context (app version, page, screen size, browser, operating system, language, time zone). Recent console logs only if you tick the box	Contract (answering you); legitimate interest in diagnosing faults
Emails about your account: invites, trial reminders, receipts, security notices	Email address, the event that triggered the email, delivery status	Contract
Marketing emails and product news	Email address, your consent and when you gave it	Consent, which you can withdraw at any time in Settings → Notifications or through the link in every such email
Knowing which channels bring people to Fyncora	If you create an account during the same visit: the campaign named in the link that brought you (for example utm_source=linkedin), the site that linked to us, and the first page you saw. They are saved with your new account. Nothing is stored on your device for this	Legitimate interest in measuring our own marketing. No advertising network receives it
Referrals	Who invited whom (a friend or a partner), when the invitation was used, whether the code came from a link or was typed, and the reward	Contract (the referral programme's terms)
The partner programme (only if you are a partner)	Your partner record and deal, daily counts of clicks on your link, the commission each payment earns you, your payouts, and your payout details: legal name, address, country, tax number and IBAN. The IBAN is stored encrypted	Contract (the Partner Terms); legal obligation for payment records
Keeping the service safe and working	Server logs, rate-limit counters (as a one-way hash of the IP address), error reports, aggregate usage statistics	Legitimate interest in security and reliability
The demo	A temporary anonymous identity with example data, and a hashed IP address to limit how many demos one address can start	Legitimate interest; nothing is linked to you
Waitlist (when we run one)	Email address, how you heard of us, your confirmation	Consent
Legal duties	Invoices and payment records; records of consent and of requests you make under the GDPR	Legal obligation

We do not make decisions about you by automated means that have legal or similarly significant effects. Fyncora does not score you, rank you or decide whether you may use the service by algorithm. The AI features suggest; you decide.

Your money data in particular#

• You enter it, or your bank sends it. You type it in or import a file, or, if you connect a bank account, your bank sends it through a licensed partner. Either way we never ask for your online-banking password, and nothing in Fyncora can move money.
• It is only ever used to show it back to you and, if you use them, to power the AI features and household sharing you chose. It is not used for advertising and it is not sold or rented to anyone.
• The figures are as good as what you entered, or your bank sent. Fyncora is a record-keeping and planning tool, not financial advice. See the Terms of Service.

Bank connections#

Connecting a bank account is optional. Entering your money by hand remains a complete way to use Fyncora.

• Who connects. A licensed account information service provider connects to your bank for you, under the EU payment services rules (PSD2), its own licence, and its own terms and privacy policy, which it shows you when you connect. Depending on your bank, that is Enable Banking Oy (Espoo, Finland; supervised by the Finnish Financial Supervisory Authority), Salt Edge Limited (registered with the UK Financial Conduct Authority) or Plaid B.V. (Amsterdam; licensed by De Nederlandsche Bank). For signing in at your bank and reading your accounts, the provider is responsible for its own processing. It then passes the data to us.
• You sign in at your bank. You are sent to your bank's own sign-in and approve the access there. We never see or store your online-banking password.
• Read-only. The access lets us read the accounts you chose. It cannot move money.
• How long. Your bank limits the access, usually to 180 days. After that you sign in at your bank again, or the connection stops. We read your accounts about once a day, and when you press "Sync now".
• What we keep. The data listed in the table above, and a reference to the connection, encrypted with a key only we hold.
• About other people. Transactions can say things about other people (who you paid, who paid you), and sometimes something sensitive, such as a payment to a doctor or a church. We use them only to show your finances to you and, if you use them, in the AI features and the household sharing you chose. Never for anything else.
• Disconnecting. In Settings → Bank connections, at any time. We ask the provider to end the access, and you choose whether the transactions already imported stay (they are your history) or are removed. If your subscription ends, syncing stops; the connections are ended after a while, and we tell you first. Deleting your account ends every connection.

Broker and exchange connections#

Where available, you can choose to connect a supported investment account in Settings → Investment connections. We read balances and positions so you can see them with your other accounts. For Interactive Brokers we also read the account's daily value for up to a year back and, when the report you set up includes them, your deposits, withdrawals, transfers of positions or cash in and out, dividends, interest, fees and taxes, so we can show the account's history and a true return. For a transfer we keep its date, value, currency and the instrument, not the other broker or account. For Binance we also read the account's own history — spot trades, Convert, card purchases, crypto deposits and withdrawals, distributions such as airdrops and rewards, and small balances turned into BNB — to work out what you paid for each coin, valued in euros at Binance's own daily prices. For each record we keep its date, coin, quantity and that value, not addresses, transaction ids or order numbers. A connection never places orders, withdraws funds or transfers assets, and apart from working out what you paid for Binance coins it does not import your trades.

• Access you provide. You create a read-only API key or reporting token at the provider and supply it to Fyncora. We encrypt it on our server. For Binance, Fyncora creates the key pair: you register its public half at Binance and give us the API key Binance shows; the private half is created on our server, stays encrypted there and is never shown. We do not ask for your provider password. For exchange keys, we check the reported permissions before reading balances and stop using a key if it gains trading, transfer or withdrawal permissions.
• What we keep. The provider and connection label, masked account reference, currencies, balances, positions and available valuations, daily account values, the deposits, withdrawals, transfers, dividends, interest, fees and taxes the provider's report includes, for Binance the history records described above, last sync time, key expiry when known, and short operational error codes. We do not retain the raw provider reports. Imported accounts start private; you control any subsequent household sharing.
• Ending access. Disconnect at any time and choose whether to keep the imported accounts as manual records or remove them. Disconnecting, deleting your account or anonymising it removes the stored credentials and the Binance history records. You must also delete or revoke the key at the provider: Fyncora cannot do that through its read-only connection.
• A lapsed subscription. Syncing stops. Stored credentials are scheduled for deletion after 30 paused days, with a reminder beforehand. Imported records remain until you remove them or delete your account.

The provider remains responsible for its own service and privacy policy. We process these connection details and imported records to provide the feature you requested, on the basis of our contract with you.

Payments from notifications#

On Android, the Fyncora phone app can read the notifications your bank or wallet app shows after a card payment, so the payment is waiting in Fyncora for you to add. It is optional and off until you set it up.

• Only the apps you pick. Android gives an app with notification access every notification on the phone. Fyncora checks which app a notification comes from before reading anything, and ignores every app you did not pick. Chat messages are excluded through Android's own setting and never reach the app.
• It stays on your phone, with one exception. What Fyncora reads is kept in a private file on the phone, never in a backup, and deleted after 30 days, or as soon as you add or dismiss the payment.
• The exception: a notification Fyncora cannot read on its own. Fyncora reads notifications with its own rules, on the phone. When they cannot tell what a notification says — whether money went out, how much, or to whom — the app sends that notification to our server, which asks OpenAI to read it: the bank app's name, the notification's title and its text, nothing else. A one-time code or a request to approve a payment is never sent. Our server does not store or log the text; OpenAI handles it as described under AI features. The answer is checked against the text on your phone, and the payment still waits for your tap.
• A category for a shop you have not filed before. When neither your earlier payments nor the shop's name place a payment in one of your categories, the app sends the shop's name and the names of your spending categories — nothing else — so the AI can suggest one. The suggestion is marked as such, and you can change it before adding the payment.
• Nothing is saved without you. Each payment waits for your tap. Only a payment you add is saved to your account, like one you typed, and it is then covered by the rest of this policy.
• Switching it off. In the phone app, Settings → Payments from notifications. Turning it off deletes what was captured; you can also remove the access in Android's settings at any time.

AI features#

Fyncora has an assistant, a financial advisor chat, voice entry, and suggestions for habits, milestones and plans. They are powered by OpenAI's models (currently from the GPT-4o family), reached through OpenAI's API.

• What is sent. When you use a feature, Fyncora sends OpenAI the data that feature needs: your question or dictation, and, for the advisor, a summary of your finances (your first name, net worth, account names and balances, budgets, goals, upcoming bills, spending patterns, and relevant transactions with their descriptions). Household masking applies: an account another member keeps private is not included.
• What OpenAI does with it. Under OpenAI's API data-use commitments, data sent through the API is not used to train OpenAI's models, and OpenAI deletes it within 30 days unless the law requires otherwise. OpenAI processes it in the United States; the safeguards are described under Who else processes your data.
• Nothing happens without you. AI suggestions that would change your data (a new transaction, a budget, a task) are shown to you first and need your confirmation. A spoken entry always shows a review card before anything is saved.
• Voice. Speech is turned into text by the speech service of your device (Google's on Android, Apple's on iPhone) or of your browser, not by us. Fyncora never stores audio.
• Receipt scanning reads the receipt on your phone. The photo is not uploaded unless you choose to keep it in your Drive.
• Conversations with the assistant and the advisor are stored in your account so you can return to them. You can delete any conversation; all of them are deleted with your account.

Your own AI apps#

With the AI connector you can let an AI app you already use (for example Claude or ChatGPT) read your Fyncora data. This happens only if you set it up, and you choose per connection whether the app may only read or may also propose changes.

When you connect an app, that app's provider receives the data it asks for, under that provider's own terms and privacy policy, not ours. We keep a log of which tool each connection used and when, and the connection itself, so you can see and revoke it in Settings → Connectors. Access tokens are stored only as hashes. The sign-in step for a connection is handled by Stytch, an identity provider; see the table below.

Household sharing#

A household is a group of adults who agree to see some of each other's finances. Every account has a sharing level that its owner sets: Shared (balances and transactions), Amounts only (balances, with transactions hidden), or Private (not visible at all). Goals, tasks, milestones, projects and documents are shared item by item. The AI features and the AI connector see exactly what the member using them is allowed to see, never more.

• Joining a household makes your accounts part of it. You choose each account's sharing level when you join.
• Switching an account from Private to Shared shows its whole history, not only new entries.
• Leaving a household, or making an account private again, ends the other members' access from that moment.
• The member who pays for a Household plan does not thereby gain access to anything the others keep private, and cannot delete another adult's account.

Each adult remains responsible for what they share. Fyncora is the controller of the service for all members alike.

Partners and the people they bring#

A partner is a creator who recommends Fyncora with their own code or link (see the Partner Terms). If you signed up with a partner's code or link:

• The partner sees that an anonymous member joined through them: a label such as "Member · 7f3a", the date you signed up, whether you are in a trial, paying or no longer subscribed, and the commission your payments earned them.
• The partner never sees your name, your email address, your account, the amounts you paid or anything you keep in Fyncora.
• Clicks on a partner's link are counted per day. No IP address and no browser details are stored for them.

If you are a partner, we keep what we need to pay you and to account for it: your deal, your link's daily click counts, the commission ledger, your payouts and your payout details. Payment records are kept as long as accounting law requires, also after you delete your account.

Children#

Fyncora Kids is set up and supervised by a parent or guardian. Children do not create an independent account. Under Slovenian law (ZVOP-2, Article 8), a child can consent to an online service from the age of 15; below that, a parent or guardian must. That is why the guardian confirms parental responsibility and consent during setup. We record that decision with the guardian and child account identifiers and its date. The guardian chooses the child's display name, avatar, age or birth date, language, currency, and access settings.

We store the child's jars, money entries, budgets, savings goals, chores, quests and completion history to provide these features. These are records entered by the family, not banking or payment services. Guardians can view and manage them. A child can see only the jars their guardian permits. A family member who is not a guardian cannot manage the child's records.

Device pairing uses a one-time setup code, a device identifier and a protected device secret. PINs are stored as hashes. A paired browser stores the child's session credentials locally; its PIN is an app lock and does not encrypt those browser credentials, so use a trusted browser. Guardians can revoke a device, reset a PIN or sign the child out everywhere. Email sign-in is optional and requires the guardian to verify access to the child's email address.

The Kids experience has no advertising and no third-party advertising identifiers. Usage analytics are switched off on the Kids website. Hosting and authentication providers process the data needed to deliver and secure the service. If email sign-in is enabled, our email provider delivers the verification message. Essential service and security logs may include request metadata such as IP addresses. The Kids Android app does not request camera, microphone or location access.

When a guardian enables notifications, push-delivery providers may process the child's display name, chore title and reward to tell that guardian about a chore. Optional fingerprint unlock is checked by the device; Fyncora does not receive fingerprint images or templates. App updates are delivered through Expo's update service, which receives the technical app and device information needed for delivery.

Guardians can export a child's data or permanently delete the child from Kids → child → Settings. The guardian's own account export also includes the children they supervise. Deleting a child removes their account, paired devices, records and activity; it does not delete siblings or family accounts. Provider backups and the consent record follow the retention periods below. If a guardian leaves a household, another guardian must remain responsible for the children before that guardian can leave or delete their own account.

For children: your grown-up can see the money, goals and chores you enter here. We use them to show you your progress. Ask your grown-up to help if you want to change something, get a copy, or stop using Fyncora Kids.

Who else processes your data#

We do not run our own servers. The companies below process data on our behalf, each for one job, under a contract that binds them to use it only for that job.

Company	What they do for us	What they receive	Where
Supabase	Database, sign-in, file storage	Everything you store in Fyncora	EU (Ireland)
Vercel	Runs the website and app; page analytics	Everything the app handles while serving you; anonymous page statistics	Servers in the EU (Dublin); a worldwide network delivers static files; Vercel Inc. is a US company
OpenAI	The AI features	See AI features	USA
Stripe	Payments on the web	Email, name, your user id, your card (which we never see)	EU (Stripe Payments Europe, Ireland), with the Stripe group in the USA
Google	Sign in with Google; Google Drive for your documents; Google Calendar if you connect it	Your Google identity; the files you store; the goal and task titles and dates you sync	EU and USA
Google Play and RevenueCat	Subscriptions bought in the Android app	Your purchase and subscription status, linked to your user id	USA
Resend	Sends our emails (it uses Amazon's email service to deliver them)	Your email address and the content of each email	USA
Microsoft 365	Our own mailboxes, including support	What you write to us	EU and USA
Stytch	Sign-in for the AI connector	Your Fyncora identity, when you connect an AI app	USA
Expo	Push notifications and app updates	Notification content and device tokens; technical device information	USA
Financial Modeling Prep	Prices of securities you track	The tickers you look up, nothing about you	USA
The European Central Bank	Daily exchange rates	Nothing about you	EU

Where a provider is outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses in our agreement with that provider, and, for providers certified under the EU-US Data Privacy Framework, by that certification. You can ask us for a copy of the relevant clauses at privacy@fyncora.com.

The providers that connect banks (Enable Banking, Salt Edge, Plaid) are described under Bank connections: for signing in at your bank and reading your accounts they act under their own licence, as controllers of that processing.

Beyond these providers, we disclose personal data only when the law requires it (for example a court order), or to protect Fyncora or its users from fraud or abuse, and we tell you first unless the law forbids it.

Cookies and storage on your device#

Fyncora uses no advertising cookies and no cookie-based tracking across other websites. There is no cookie banner because of that. What we do store:

Name	What it does	How long
sb-…-auth-token	Keeps you signed in	Until you sign out; at most 400 days. For the demo, until you close the browser
fyncora_locale	Remembers the language of the website you are reading, or the one you picked with the language switch, so the next page and the sign-up form use it	1 year
fyncora_signup_locale	Carries your language choice to the sign-up form	30 minutes
gt_scope_hint	Opens the right view (personal or household) right after Google sign-in	10 minutes
google_oauth_state, documents_oauth_state	Protects the Google sign-in and Drive connection steps against forgery	5 minutes
fyncora_ref	Only if you follow a friend's or a partner's invitation link, or type a code when signing up: remembers the code, so you get the offer it carries (a discount or a longer trial) when you sign up, and the person who invited you is credited	30 days
kid_session	Keeps a child signed in on the Kids website	24 hours

Your browser's local storage also keeps preferences that never leave your device: theme, language, dashboard layout, whether balances are hidden, dismissed banners, whether you switched page analytics off, and, on the Kids website, the device pairing for a child.

Page analytics. On the website and the web app we use Vercel Web Analytics and Speed Insights. They do not use cookies, do not identify you across other sites, and tell us which pages are visited, from which country and browser, how fast they load, and which buttons on the public pages are used. They are switched off on the Kids site. Our legal basis is our legitimate interest in knowing whether the site works.

You can switch page analytics off in Settings → Privacy → Analytics. The choice applies in every browser you sign in to. If your browser sends the Global Privacy Control signal, page analytics are off there automatically, signed in or not.

How long we keep data#

Data	Kept
Your account and everything in it	Until you delete your account. Deletion is immediate and cannot be undone
AI conversations	Until you delete them, or your account
A bank connection	Until you disconnect it or delete your account. Transactions it imported stay in your account like any other entry, unless you choose to remove them when disconnecting
Support tickets and their technical context	Until you delete your account
Email delivery records	Until you delete your account
Invoices and payment records	As long as tax and accounting law requires: 10 years in Slovenia
A partner's commission ledger, payouts and the payee details frozen with each payout	As long as accounting law requires, also after the partner's account is deleted. The encrypted IBAN is deleted with the partner record
Records of consent and of your GDPR requests (what was requested and when, with your account id, not your name)	Kept as proof that we handled them
The campaign saved with your account	Until you delete your account
Demo sessions	The demo identity and its data are deleted within 48 hours of the demo ending. The hashed IP used for rate limiting is kept
Provider backups	The database provider's backups roll off within its retention window, currently up to 7 days
Server logs	Hours to a few days
A lapsed subscription	Your data stays, read-only, until you delete the account. We may delete accounts that have been lapsed and unused for a long time, after warning you by email

If you choose Anonymise instead of delete, your name, email and sign-in are removed and your account is permanently locked, while the money records stay, unlinked from you, so a household's shared history still adds up.

Security#

• Everything travels over TLS. Our providers encrypt stored data at rest.
• Every table in our database has access rules that the database itself enforces, so one user's data cannot be read with another user's session.
• Passwords are stored only as hashes. Google Drive tokens are encrypted with a key only we hold. AI connector tokens are stored only as hashes.
• Card numbers never reach us. Online-banking passwords never reach us either: you sign in at your bank. Bank connection references are encrypted and readable only by our servers.
• A child's session is separate from a parent's: it has its own credentials and can read only what the guardian allows.

No system is perfectly secure. If we learn of a breach that puts you at risk, we will tell you and the supervisory authority as the GDPR requires. If you find a security problem, write to support@fyncora.com.

Your rights#

You can, at any time:

• See and download your data: Settings → Privacy → Export gives you a JSON or CSV file with the main data in your account. For anything the export does not include, ask us.
• Correct anything in the app yourself.
• Delete your account: Settings → Privacy → Delete. Deletion is immediate.
• Take your data elsewhere. The export is in a commonly used, machine-readable format.
• Restrict or object to processing based on our legitimate interests: switch page analytics off in Settings → Privacy, and write to us about anything else, including the campaign saved with your account.
• Withdraw consent (marketing emails, a child's account) with effect for the future.
• Complain to a supervisory authority. In Slovenia that is the Information Commissioner (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, +386 1 230 97 30, www.ip-rs.si. If you live elsewhere in the EU, you may complain to the authority in your country.

For anything you cannot do in the app, write to privacy@fyncora.com. We answer within one month. We may ask you to confirm it is your account before we act.

You never have to give us data. Without an email address there is no account; without the data you choose to enter, the features that need it simply stay empty.

Changes to this policy#

When we change this policy in a way that matters to you, we tell you by email or in the app before the change takes effect. Each version carries its date at the top of the page. The current version is dated 19 October 2026.

Contact#

Privacy questions and requests: privacy@fyncora.com. Everything else: support@fyncora.com.