Privacy Policy — Finlytics
Last updated: 28 August 2026
Finlytics is a shared household expense ledger. This policy explains what the app collects, why, who else sees it, and what you can do about it. It was generated from the app's own source code, so it describes what Finlytics actually does rather than what a template assumes.
Finlytics is published by Arslan Aziz, an individual developer based in Pakistan ("we", "us", "the app").
1. Data we collect
| Category | Source | Why we collect it |
|---|---|---|
| Email address | Google Sign-In, stored by Supabase Auth | Identifies your account, lets other members of your household see who logged an entry, and restores your purchases on a new device |
| Name and profile photo | Google Sign-In | Shown beside the transactions you log, so a household can tell who paid |
| Authentication tokens | Supabase Auth | Keeps you signed in between sessions |
| Your household's financial records — accounts, balances, transaction amounts, categories, notes, dates, and which member paid | Typed by you and the other members of your household | This is the app's entire purpose |
| Purchase history | RevenueCat and Google Play Billing; subscription status is also stored in our own database | Unlocks premium features, restores them on a new device, and lets our servers verify that a shared household is paid for |
| App events, device identifiers, and approximate location derived from your IP address | PostHog, Firebase Analytics | Understanding which features are used, so the app can be improved. You can turn this off — see section 4 |
| Crash logs and device diagnostics | Firebase Crashlytics | Diagnosing and fixing crashes |
| Push notification token | Firebase Cloud Messaging | Delivering the notifications you have enabled |
We do not collect your bank credentials, and Finlytics does not connect to any bank. There is no account linking and no transaction scraping. Every figure in the app is one you typed.
The app does not request access to your camera, microphone, location services, contacts, calendar, photos or files. Those permissions are not declared in the app at all.
2. How we use your data
- To run the shared ledger: storing what your household logs and showing it to that household.
- To identify you to the other members of your household, and to keep you signed in.
- To unlock and restore premium features you have paid for.
- To understand which features get used, so development effort goes to the right places.
- To diagnose crashes and errors.
- To send notifications you have switched on.
We do not use your data for advertising, we do not build advertising profiles, and we do not sell your personal data to anyone.
3. Sharing
We do not sell your personal data. The third-party services below process data on our behalf as service providers, under their own privacy policies:
- Supabase (Supabase Inc.) — authentication and the ledger database — https://supabase.com/privacy
- Google Sign-In and Google Play Billing (Google LLC) — https://policies.google.com/privacy
- RevenueCat (RevenueCat Inc.) — subscription management. Your account identifier **and your email address** are sent to RevenueCat so purchases can be restored and support requests matched to an account — https://www.revenuecat.com/privacy
- PostHog (PostHog Inc.) — product analytics — https://posthog.com/privacy
- Firebase Analytics, Crashlytics and Cloud Messaging (Google LLC) — https://firebase.google.com/support/privacy
Everyone in your household sees your ledger. This is the point of the app, but it is worth stating plainly: when you join or are invited into a household, every other member of that household can see the transactions you log, the accounts you hold, their balances, your display name and your email address. Members cannot spend from an account they do not own — that is enforced by the database, not just the app — but they can see it. Do not join a household with people you would not show your finances to.
4. Your rights and choices
You can:
- Delete your account and its data in the app: Settings → Account → Delete account. You can also request deletion by emailing us. Data is fully purged within 30 days of deletion.
- Turn analytics off in the app: Settings → Privacy → Share usage analytics. Crash reports are still sent, because an app that cannot report its own crashes cannot be fixed.
- Request a copy of your data by emailing app.finlytics@gmail.com.
- Lock the app behind your device's fingerprint or face unlock: **Settings → Security → Biometric lock**. This is off unless you turn it on.
5. Security
- All traffic between the app and our servers uses HTTPS/TLS.
- The ledger database enforces row-level security: a query can only return rows belonging to a household you are a member of. This is enforced by the database itself, so it holds even if the app is modified.
- Money can only leave an account you own. This is enforced server-side by a database trigger, not only in the app.
- Any secret held on your device is encrypted with AES-256/GCM, with the key material stored in the Android Keystore and never leaving it.
- No security is absolute, and we cannot guarantee that a determined attacker will never succeed.
6. Children
Finlytics is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has provided us with personal data, email us and we will delete it.
7. International transfers and GDPR (EEA and UK users)
Our database is hosted in Tokyo, Japan (AWS ap-northeast-1). If you use Finlytics from the European Economic Area or the United Kingdom, your data is transferred outside your region. Japan is covered by an adequacy decision of the European Commission, meaning it is recognised as providing an equivalent level of protection.
Our lawful bases for processing are:
- Performance of a contract — your account, your household's ledger and your subscription. The app cannot function without these.
- Consent — product analytics, which you can withdraw at any time in Settings without losing any functionality.
- Legitimate interests — crash diagnostics, and keeping the service secure and working.
You have the right to access, rectify, erase, restrict, port and object to the processing of your personal data, and to lodge a complaint with your local supervisory authority. Exercise any of these by emailing app.finlytics@gmail.com.
8. California residents (CCPA/CPRA)
In the past twelve months we have collected these categories of personal information: identifiers (email address, name, device identifiers), commercial information (purchase history), internet activity (app events), geolocation (approximate, derived from IP), and financial information you enter into your own ledger.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. You have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising those rights. Email app.finlytics@gmail.com, or delete your account in the app.
9. Changes to this policy
We will update this page when our practices change, and the "Last updated" date above will change with it. Material changes will be announced in the app.
10. Contact
Privacy questions: app.finlytics@gmail.com
Arslan Aziz, Pakistan.