🔒 Privacy Policy

When your account is created by an administrator, we store:

All financial data you enter is stored in our secure database:

• Accounts: name, aliases, type (cash, credit, investment, receivable, payable), currency, and balance
• Transactions: date and time, action type, account names, amounts, currency, exchange rate, category, and any notes you add
• Recurring rules: schedules, amounts, and linked accounts you configure for automated reminders
• Categories: spending category names you create

When you submit a text message or image for automatic transaction parsing:

• Your message text is sent to an AI service for interpretation
• Receipt or document images are encoded and forwarded to the AI service. By default they are not stored by us before or after processing — they are transmitted inline and discarded once the AI returns a result. If you turn on Save receipt images in User Settings (see below), the post-processed copy of the image is instead saved so you can view it later
• The full AI response (the structured transaction interpretation) is stored alongside the resulting transaction record as a processing log

The following contextual information is included with every AI request to enable accurate parsing:

• Your username and family member usernames
• Your account names, aliases, types, and currencies
• Your spending categories
• Current date and time, and your approximate location: normally a geographic region derived from your configured timezone, or a nearby city derived from your device's position if you have turned on Enable Location (see 2.5)

User Settings includes an opt-in Save receipt images toggle (Preferences section). It is off by default. While it is off, the behaviour described in 2.3 applies: receipt images are never stored.

When you turn this setting on:

• The post-processed image used for AI parsing (a downscaled, re-encoded copy — not your original full-resolution upload) is saved to a private cloud storage service
• This applies to receipts uploaded via Telegram photo messages and via the webapp photo upload
• The stored image is linked to the single transaction it created, and is viewable by you in the History tab and in report drill-downs
• The image is never publicly accessible. It can only be retrieved through the app's authenticated endpoints by members of your own family workspace, or through your family's authenticated MCP connection for analysis
• Turning the setting back off stops any future storage — images already stored remain until you delete them or the related transaction, or request deletion (see Section 6)

User Settings includes an opt-in Enable Location toggle (Preferences section). It is off by default. While it is off, we never ask your device where it is, and the approximate region described in 2.3 is derived from your timezone alone.

When you turn this setting on:

• Your browser asks for your permission separately, and you can refuse. Refusing switches the setting back off
• We store the latitude and longitude your device reports, the accuracy figure it reports with them, and the time it was taken
• We also store the nearest city we can price from that position, where one is close enough. If none is, only the coordinates are kept
• It is used for two things: telling the AI roughly where you are, so it can recognise local merchants and currencies, and pricing an Auto Budget against local cost-of-living figures
• Your position is matched against a list of cities held in the app itself. It is not sent to any mapping or geocoding service
• It is refreshed at most once every 6 hours, and only while you have the app open
• We keep one position, not a history. Each refresh overwrites the last, so there is no record of where you have been
• Turning the setting back off deletes the stored position and city immediately. So does an administrator turning it off for you

When an error occurs during processing, we log:

• Your username and Telegram chat ID (if applicable)
• The first 500 characters of the input that triggered the error
• The error message and technical stack trace
• The AI response at the time of the error (if applicable)

Error logs are used solely for diagnosing and fixing bugs.

We use a single session cookie (ft_session) to keep you signed in:

• It is HttpOnly (not accessible to JavaScript on the page)
• It uses SameSite=Lax to protect against cross-site request forgery
• It contains a cryptographically signed session identifier; it does not contain your password or any financial data

We do not use tracking cookies, advertising cookies, or third-party analytics cookies of any kind.

When you use AI-assisted transaction input (text or image), your data is transmitted to a third-party AI processing service for interpretation. Your data is subject to that provider's privacy policy and terms.

See the AI data flow diagram in Section 5 for a visual overview.

If you enable Save receipt images in User Settings, the post-processed receipt image is stored in a private cloud storage service provided as part of our hosting infrastructure (see 4.4 below). The store is private — images are not publicly accessible by URL. Access is only possible through the Service's own authenticated endpoints, restricted to members of your family workspace, or through your family's authenticated MCP connection. The storage provider processes this data as our infrastructure sub-processor and does not use it for its own purposes.

If you access the Service via Telegram:

• Your Telegram user ID and chat ID are stored to route responses back to you
• Messages you send to the bot are processed by our server
• Your use of Telegram is also subject to Telegram's own Privacy Policy

The Service is deployed on third-party hosting and infrastructure providers. These providers may process standard request metadata (such as IP addresses and server access logs) in the course of delivering the Service, and — when you have enabled Save receipt images — the stored receipt images described in 4.2 above. No personal or financial data is shared with infrastructure providers beyond what is technically necessary to serve your requests.