Privacy Policy

What we store

FinCú stores the information you enter or import: your name and email, and the financial data you add — bank transactions, investments, assets, budgets, and settings. We never ask for or store your bank login; data comes from CSV files you upload yourself.

Passwords and recovery codes are stored only as bcrypt hashes, and password-reset links only as fingerprints, so we can't read them. If you turn on two-factor authentication, its secret is stored encrypted.

Where it lives

Your data is held in a private PostgreSQL database on a server in the EU (Hetzner, Germany), scoped to your household. The database is backed up nightly to the same server, and backups are kept for 14 days.

Who handles what

Your financial data is never sold, never used for advertising, and never sent to an AI service. A few providers do part of the work:

• Hetzner (Germany) hosts the server and database.
• Resend sends password-reset emails, so it receives your email address and the email itself.
• Stripe handles payment if you subscribe to Plus. We receive your subscription status; your card details go to Stripe, never to us.
• Finnhub, Yahoo Finance and CoinGecko supply market prices. Our server asks them for quotes by ticker symbol only — never your name, amounts or account details.

Insights are worked out by fixed rules from your own data. No external AI service receives it.

Your rights

You can export all of your household's data as JSON at any time, and permanently delete your household and every associated account, both from the Account page. Deletion removes it from the live database immediately and can't be undone; copies in backups are gone within 14 days, as those backups expire.

Cookies

We only use essential cookies for signing in: one keeps you signed in, one protects sign-in from forged requests, and one remembers which page to return you to. No analytics, tracking or advertising cookies.