Privacy Policy

Executive summary

Your financial database is stored on your iPhone and, with sync enabled by default, in your private iCloud. We do not keep a complete copy of that database on our backend. Some features do send financial information and other data for processing, as summarized below.

Feature	Data and controls
Records and organization	Expenses, income, transfers, refunds, wallets, categories, budgets, goals, and subscriptions are managed on your device.
iCloud	A private copy in your Apple account. You can turn sync off; doing so does not delete the existing copy.
Optional AI	May send descriptions, amounts, queries, category, wallet and tag names, and file samples to Finyvo and OpenAI. Controls are in Settings.
Excel import	XLS/XLSX files are uploaded in full to our backend for conversion to a table, even with AI off. CSV, TSV, and JSON are read locally; with AI on, samples and descriptors may be sent.
Apple Pay and Shortcuts	Receives purchase data supplied by your automation, with the destinations you select. Learn what is stored and how to stop it.
Technical identity	App Attest, a pseudonymous installation identifier, RevenueCat, and request metrics. No user account, password, or advertising identifier.
Feedback	When you submit a form, Web3Forms and Finyvo receive what you write. Success and error messages inside the app are not messages to our team.
Optional statistics	PostHog receives usage events and a pseudonymous ID only with consent, without financial content. Controlled in Settings → Privacy.

We do not sell data to advertisers or track you across apps. Having no account does not make the text you share or technical identifiers anonymous.

Who we are and the data controller

The controller responsible for processing the data covered by this Policy is:

Moisés Núñez
Dominican Republic
Contact: [email protected]

This Policy applies to:

• The Finyvo iOS app, distributed through Apple’s App Store.
• The finyvo.com website and its subdomains.
• The api.finyvo.com backend, operated by Finyvo.

Throughout this document, “the App” means the iPhone app; “our backend” means api.finyvo.com.

Data stored on your device

When you use Finyvo, the following data is stored in your iPhone’s local storage through SwiftData (Apple’s local storage framework, built on SQLite) and, if iCloud sync is on — it is on by default —, replicated to the private database of your iCloud account. That database belongs to Apple and to you: Finyvo has no read access to it. We do not host a complete copy of that database; some features send portions of this data for processing, as explained below:

Type of data	Typical content
Transactions	Amount, currency, date, type (expense, income, transfer, or refund), category, wallets, tags, notes, and merchant. Refunds may store links and allocations to original purchases; valuation uses daily rate tables with fallback to available rates.
Wallets	Name, type (cash, account, credit, savings…), currency, balance, color and icon, optional last 4 digits, optional payment reminder, and optional notes
Categories	Name, keywords, group and subcategory hierarchy, icon, color, and an internal marker (slug) on the categories that ship with the app
Tags	Name and color
Budgets	Monthly period, total amount, allocations by category or goal, method used, and currency
Savings goals	Name, target amount, currency, optional deadline, contribution plan, optional linked wallet, status, and the full history of contributions, withdrawals, and spending for that goal
Subscriptions	Name, amount, currency, frequency, next charge, category, wallet, reminders, optional brand, and the charge history
Custom logo	If you pick an image from your photo library as a subscription’s logo, that image is stored inside the App’s database
Alerts and notifications	Titles, bodies and structured data to reconstruct the alert, entity references, scheduled dates, and delivery and read evidence. Some alerts contain amounts.
Category learning	Readable normalized descriptor, category, source, confidence, and usage data. Memory is shared across editing, imports, and compatible captures; it may sync through iCloud.
Import history	Date, number of entries, destination wallet, the name of the file you imported, and its SHA-256 fingerprint, so we can warn you if you repeat an import and let you undo it
Cached brands	Domain, name, and color of the logos the App has resolved, and when it resolved them
Exchange rates	The daily table of downloaded rates, so conversions work offline
Preferences	Language, preferred currency, theme, animations, private mode, and your optional display name
Automatic backups	Automatic cleanup applies limits of seven scheduled backups and three pre-migration backups, while protecting the latest backup, manual and incident backups, and those currently in use.

Protection at rest. The files live inside the App’s container with iOS data protection (class NSFileProtectionCompleteUntilFirstUserAuthentication). If your iPhone has a passcode, they are encrypted at rest until the first unlock after powering on.

About backups. The automatic internal-format backups live inside the App’s container, on your device. We do not back up to servers of our own.

Private mode. The eye on Home hides amounts in viewing surfaces and their accessibility labels. Editing fields and exported files retain readable amounts; some system alerts may also show them. It does not encrypt data or lock the app. Finyvo has no separate Face ID, Touch ID, or passcode lock.

iCloud sync

Finyvo syncs your data with iCloud, and that sync is on by default. It is the most important privacy decision you can make inside the App.

What is replicated. Every record type in the App’s database: transactions (with their notes and merchant names), wallets and their balances, categories, tags, budgets and their allocations, savings goals with their movement history, subscriptions and their charges, any logo you uploaded for a subscription, the already-composed alerts (which may contain amounts), category learning, your import history, cached brands, and downloaded exchange rates.

Where it goes. To the private database of your own iCloud account, inside the iCloud.com.moiszr.finyvo container. That is Apple’s infrastructure and the account is yours. Apple encrypts it in transit and at rest. Finyvo cannot query it: it does not appear in any console of ours, and there is no way for the developer to read the contents of a user’s private database. If you have Apple’s Advanced Data Protection enabled, that copy is additionally end-to-end encrypted.

What it is for. So your data shows up on its own on any device where you use the same Apple Account, and so you do not lose it when you change iPhones.

How to turn it off. In the App: Settings → Sync → iCloud. With the current sync system, the change takes effect while you use the app. If your installation still requires a restart, Settings shows that it will apply on the next launch. This does not delete the iCloud copy or disable the app’s other data flows.

Turning it off does not delete what was already uploaded. The App does not have a “delete my iCloud copy” feature. To remove that copy you must use the system settings: iOS Settings → [Your name] → iCloud → Manage Account Storage → Finyvo.

Your display name, separately. The name you type when setting up the app is also stored in the iCloud key-value store of your Apple Account, so we can greet you by name if you reinstall the App or open it on another device of yours. It is a piece of data in your Apple Account, not on a Finyvo server, and it does not depend on the sync toggle: it is stored there even if sync is off. You can change or clear it in Settings → Account.

How our backend identifies you

We do not require an account, email, or password to use the app. Apple’s App Attest verifies an installation and enables a short-lived session (15 minutes).

The backend maintains a pseudonymous installation identifier to authorize requests, prevent abuse, and count AI usage. It can be retained when a key is renewed if the app provides valid proof of its previous session. Keychain credentials may survive uninstallation: reinstalling does not guarantee a new identity or delete earlier records.

The app and backend also use a RevenueCat identifier to verify the plan. These identifiers can be associated. Requests to /fx/*, /brand/*, /ai/*, and /import/* carry a session token; the initial authentication exchange obtains that token.

Request and provider-response identifiers allow correlation between the app, backend logs, and OpenAI responses. These are pseudonymous, not anonymous, data. They do not themselves contain your Apple ID, but can link activity from one installation. See Security.

Data sent to our backend

Some features need to go online. For that, the App talks to our backend, hosted on Cloudflare Workers under the api.finyvo.com domain. That backend acts as a secure proxy to external providers, so those providers’ keys never ship inside the app or sit exposed on your device.

Elements common to every request:

• Your installation’s session token, described in the previous section.
• IP address. Cloudflare receives your IP and may log it in anti-abuse events, subject to the retention described under Processing.
• User-Agent, a string with the app’s name and version (for example, Finyvo/1.0).

Exchange rates (/fx/*)

When the App needs to refresh rates or convert an amount, it calls /fx/latest, /fx/date/{date} (a past day’s table, for transactions dated in the past), /fx/convert, /fx/timeframe, or /fx/symbols. What is sent:

• Currency codes (ISO 4217: USD, EUR, DOP…).
• Dates (YYYY-MM-DD) for historical queries.
• On /fx/convert, a specific amount you are converting at that moment — for example, when changing a subscription’s currency or saving a transaction with a past date — along with the two currencies and, where applicable, the date. The description, wallet, and category do not travel, but the request is authenticated with your installation’s identifier.

Most conversions are resolved offline, using rates the app already downloaded. Rates are obtained by our backend from exchangerate.host and cached for 24 hours; a historical copy lives in the backend database to serve past queries. These are public market rates: they contain no data of yours.

The rates Finyvo shows are for reference, to help you organize your finances. They are not trading quotes and should not be used for trading.

Brand logos (/brand/search/:query)

To show a subscription’s or a merchant’s logo, the App first looks through the bundled brand catalogue in the app itself and the logos already saved on your device. If there is no match, it queries /brand/search/:query.

When this happens. Not only when you create a subscription: it happens every time the App needs to draw that logo, including the Home screen when you open the app. If a name does not match any known brand, the query may repeat on later launches.

What is sent. The text exactly as you typed it, inside the request address. Usually these are brands (netflix, spotify), but the field is free text: if you name a subscription with personal information, that text is what leaves your device. We recommend not including other people’s names or sensitive information in a subscription’s name; you can change it any time from the editor.

What is not sent. The amount, frequency, wallet, category, or notes of that subscription. If you upload your own image as the logo, no query is made at all.

One more case. When you delete a subscription, the transactions it already generated keep their logo. To draw it again, the App queries the merchant name stored on that transaction and, if that transaction has no merchant name, the text of its note. That is the only path through which a transaction’s note can leave your device for this feature; the recommendation above about not writing sensitive data there applies here too.

How the image arrives. Our backend forwards the query to Brandfetch and receives a list of brands, each with the address of its logo hosted on Brandfetch’s CDN. That query is cached for 1 hour. After that, it is your own device that downloads the image directly from Brandfetch’s CDN, without passing through our servers. In that download, Brandfetch receives your device’s IP address, your connection’s standard headers, and the requested brand domain. It does not receive amounts, categories, wallets, notes, your identity, or any Finyvo identifier: that request carries no credentials of ours. Once downloaded, the image is stored on your device.

Health check (/health)

A public, unauthenticated endpoint used for automated monitoring. It returns a status, a timestamp, and a request identifier. It neither sends nor receives user data.

Artificial intelligence features

AI complements category memory, keywords, and search running on your iPhone. You do not need AI to record and organize transactions.

When it runs and how to control it

Before sending content to OpenAI, Finyvo explains the data that may be shared and asks for your permission. During initial setup, AI may be preselected, but this remains a draft choice without authorization until you tap Allow AI and continue. You can deselect it and tap Continue without allowing AI. A previous refusal or disabled master switch is respected; switches enabled in an earlier version do not grant permission on their own.

In Settings → Artificial intelligence, turning on the master switch beside the notice about OpenAI, data and purpose grants permission directly; no further confirmation screen appears. The information button expands the details without changing your choice. Five feature controls limit which features use AI: categorization, description improvement, subscription categorization, smart search, and import-file analysis.

With your permission and the corresponding controls enabled, categorization and normalization may run when you finish editing a description, before saving. Subscription categorization may run when its form opens or is edited. Cancelling afterwards does not retract what was sent. AI search runs when you submit a query; import may invoke AI within the flow you open. Apple Pay purchases may also be categorized in the background.

Turning the master switch off withdraws permission: new AI calls stop and pending results are discarded. This does not retract data the provider has already received. Turning that switch on again grants new permission. Local file reading remains available, with manual mapping when needed. Backend Excel conversion is independent of AI, as are iCloud, rates, and logos.

Data sent

Feature	Content
/ai/categorize	Description, merchant, amount, candidate category names and keywords, language, and—on Plus—tag names.
/ai/normalize	Description and language; no amount.
/ai/categorize-subscription	Subscription name, brand domain when applicable, candidate categories and language; no amount.
/ai/search	Query, category, wallet and tag names, and currencies. Returns filters applied to your history on your iPhone; that history is not sent.
/ai/infer-schema and /ai/categorize-batch	File samples and descriptors detailed under Import.
GET /ai/usage	No financial content in the body; retrieves usage for the authenticated installation. Does not call a model.

Candidate identifiers are used to interpret responses without sending your original category, wallet, or tag UUIDs to the model. The backend applies size budgets and may select a subset before contacting the provider. Free-text fields may contain names, accounts, or other information you enter; not requiring an account does not guarantee anonymity. File balances may be present in samples.

Learning and review

Your manual choices have priority. Category memory stores normalized descriptors, categories, source, and confidence and is reused across editing and imports; it may sync through your private iCloud. This is not training a shared model. You can correct suggestions; AI can make mistakes and does not make credit decisions or execute banking operations.

Provider, records, and retention

The current provider is OpenAI. Our backend selects a model for each feature: the routes do not necessarily all use the same model. This selection may change; the app does not connect directly to the provider.

Finyvo does not train models on your data. OpenAI’s API does not use it for training by default. This does not mean zero retention: OpenAI specifies up to 30 days for abuse logs, with exceptions, and at least 30 days of response storage under the default Responses settings. Our integration does not explicitly disable that storage. See OpenAI’s data controls. Technical identifiers allow our metrics to be correlated with those responses; we do not claim content cannot be associated with an installation.

Usage limits

Free includes 50 requests per UTC calendar month; Plus has no monthly plan cap. Speed and spending-protection limits may apply to both plans. One action may require several requests, and a failed attempt may consume quota. When AI is unavailable, local options remain and limitations are communicated according to the flow; automatic completion of all categorization is not guaranteed.

Importing bank files (Finyvo Plus)

Import is a Finyvo Plus feature. It supports CSV, TSV, JSON, and Excel (XLS/XLSX), up to 5,000 transactions. Limits are 10 MB for text/JSON and 5 MB for Excel. PDF and images are not yet interpreted.

Step	What is processed outside your iPhone
Reading CSV, TSV, and JSON	Performed locally. Content may be sent to AI in subsequent steps if enabled.
Excel conversion (/import/grid)	The complete file and its name are sent to our Cloudflare backend. It converts the file to a table in memory; neither file nor table is stored or logged as content. This step uses no AI model and also runs with AI off.
Interpretation (/ai/infer-schema)	If local reading cannot determine the structure and AI is enabled, up to 60 rows, with up to 40 cells per row and 200 characters per cell, are sent along with the filename, language, and interpretation-conflict information if needed.
Categorization (/ai/categorize-batch)	Unique descriptors, amounts, and transaction direction in batches of up to 50, plus category names and keywords. Category mapping sends category names from the file, without amounts in that mode.
Format confirmation and correction	/import/confirm-format sends a confirmation token; /import/cache-feedback sends a header fingerprint, version, and reason. The backend may retain the interpreted format, mappings, and metadata for reuse. This is not a copy of your statement; it may contain structural text derived from it.

Partial redaction. Before AI processing, the app masks long digit sequences that do not resemble compact dates. This does not remove all personal data: amounts, balances, dates, and free text may remain. This redaction does not apply to the complete Excel file uploaded for conversion.

How to prevent these transmissions. Use CSV, TSV, or JSON and turn off the AI master switch or “Analyze files on import” before starting. Local interpretation is attempted and manual mapping is offered when needed. Turning AI off does not make Excel processing local.

You review transactions before saving. The app retains the filename and fingerprint, import history, and links needed to detect repeats and undo imports. These records may sync to your iCloud. If part of categorization fails, you can review or correct outstanding items: an incomplete suggestion does not mean every row was classified.

Apple Pay and Shortcuts

You can set up Apple Pay purchase recording through a personal Shortcuts automation. Card selection and automation are configured on the device; Finyvo does not gain general access to Wallet, your banking history, or your full card number or security code.

Shortcuts may provide an amount, currency, merchant, and transaction name. Finyvo retains that evidence, receipt time, language and time zone, and identifiers needed to link it to a connection and wallet. Active connections belong to the device; capture and review records in the financial database may sync to your private iCloud.

Compatible purchases may become an expense. Others remain pending review, for example when data is missing, duplicates are possible, or the charge in the wallet’s currency is unknown. Pending evidence is not a confirmed bank charge.

If AI categorization is enabled, a recorded purchase may be enriched automatically through /ai/categorize, sending the descriptor, amount, categories, and—on Plus—tags. The same AI controls apply; original evidence is retained locally even if that request fails. The optional “Purchase recorded” notification is generic and contains no amount or merchant.

You can pause or revoke a connection in Finyvo and disable its automation in Shortcuts. This stops authorized processing of future purchases but does not itself delete earlier evidence or expenses. JSON exports may include captures, links, and retained evidence; they do not include active connection settings or reactivate automations when imported.

How our backend processes and logs

The backend records technical data to operate the service, diagnose errors, and prevent abuse: normalized route, HTTP status, duration, request identifier, and limited counters. Sentry diagnostics may be linked to the pseudonymous installation identifier. Cloudflare receives the IP address to transport and protect requests; structured application logs do not include brand-search text or request bodies.

AI metrics in D1 include a hash of the installation identifier, feature, provider, model, tokens, estimated cost, latency, outcome, limited error code, and request and provider-response identifiers. These identifiers allow metrics to be linked to responses retained by OpenAI. We do not store full AI bodies in the metrics table; the import-format cache separately retains interpretations and mappings.

The application reduces provider errors to limited codes before logging them. This does not make the records anonymous or change the content retention of AI providers.

Standard Workers logs are retained for 3 days on the free plan or 7 days on the paid plan. This differs from D1 metrics and records, which have no automatic expiry implemented.

Internal health alerts use ntfy, with status, route, request identifier, and counters; the code does not send IP addresses or financial content to that channel. These are separate from local iPhone notifications and the feedback form.

Purchases and subscriptions

To manage the Finyvo Plus subscription, the App integrates the RevenueCat SDK, which validates App Store purchase receipts and keeps your subscription status.

What is shared with RevenueCat:

• The pseudonymous identifier its own SDK assigns to your installation (not your Apple ID).
• The identifier of the purchased product.
• Apple’s encrypted receipt, to validate the purchase.
• Subscription status (active, in grace period, expired).
• The technical device data its SDK collects under its own privacy policy.

What is not shared with RevenueCat: your Apple ID, your name, email, or phone number, and the financial information you keep inside Finyvo.

Server-side, our backend queries RevenueCat’s API with that pseudonymous identifier to resolve whether your installation has Finyvo Plus.

Payments. All payments are processed by Apple through the App Store. Finyvo never comes into contact with your card or payment-method details. Apple Media Services Terms and Privacy Policy apply: https://www.apple.com/legal/internet-services/itunes/.

RevenueCat’s privacy policy: https://www.revenuecat.com/privacy.

System permissions

Permission	When it is requested	What for
Notifications	During initial setup (only if the system has not asked yet), when saving a subscription with reminders or a credit card with a payment day, or when turning on the switch in Settings → Notifications	Reminders for subscription charges and card payments, budget alerts, goal contributions, low balance, month-end, a weekly summary, a nudge if you have gone days without recording anything, and AI quota warnings. We request alerts, sound, and badge; never critical alerts
Photo library (single-item picker)	Only if you tap “Upload Logo” while editing a subscription	Use an image of yours as that subscription’s logo. The system picker is used: the App does not gain access to your photo library, it only receives the image you chose. That image is stored in the app and synced to your private iCloud
Files (single-item picker)	Only if you use Import Transactions (a Finyvo Plus feature)	Read the CSV, TSV, JSON, or Excel file you select. The system picker is used and the file is copied into a temporary directory of the app, which is cleaned when the flow closes
Background App Refresh	Enabled along with notifications; you control it in iOS Settings → Finyvo	Reschedule reminders, refresh exchange rates, and receive the silent notifications that keep iCloud sync up to date

Finyvo does not request or access: camera, your full photo library, location, contacts, calendar, health (HealthKit), microphone, speech recognition, motion data, Bluetooth, music library, Face ID or Touch ID, or the advertising identifier (IDFA). We also never show the app-tracking (ATT) prompt, because we do no tracking.

About the content of alerts. Some notifications include amounts (for example, “Next charge: Netflix RD$ 590”) and appear on the Lock Screen if your iPhone is set to show previews. You can hide them in iOS Settings → Notifications → Finyvo → Show Previews. Finyvo’s private mode hides amounts inside the app, not in system notifications.

If you do not grant the permission, the App still shows you the alerts inside the app, in its own notification center. They simply will not appear on the Lock Screen.

Apple Pay automation is configured voluntarily in Shortcuts as described above. Success, error, Retry, and Undo messages are presented locally and do not send feedback to the team. The feedback button opens the web channel, which sends a message only when you submit it.

Analytics and diagnostics

Optional usage statistics with PostHog

Finyvo versions that include PostHog share usage statistics after you confirm your choice during onboarding. The switch is selected the first time, but PostHog does not start until you confirm your choices to continue with that option selected. You can turn it off before continuing or change it later in Settings → Privacy. Declining does not restrict Finyvo’s features. This choice is independent of AI permission, notifications, iCloud and Plus.

We measure confirmed actions, such as completing an import, saving a budget or using a goal, to improve flows, understand adoption and compare usage over time. We send the action type, its time and a few restricted properties: source, result, app version/build, operating system, generic device type/model and known plan status. We do not send amounts, balances, merchants, notes, file or AI content, wallet/goal/category/tag names, currency, financial transaction dates or record IDs. Names, email, phone numbers, credentials and advertising identifiers are also excluded.

The SDK generates a pseudonymous identifier and manages sessions and a profile for analyzing that app instance. This is not absolute anonymity: its events can be linked. We do not connect it to App Attest identity, your support code or RevenueCat, and do not promise continuity across devices or reinstalls. A flow may use a temporary UUID that does not identify a financial operation.

We use PostHog’s US region and separate projects for testing and the App Store. The service receives the IP needed to transport the request; we configure its removal from analytics and disable geographic enrichment. We do not enable session recording, screenshots, interaction autocapture, surveys, logs or advertising tracking with PostHog.

Withdrawal, queue and deletion

Before consent, we do not start PostHog or reconstruct earlier actions. Withdrawing consent stops new captures and avoidable future requests. A request already in flight may finish. The SDK keeps a bounded local queue for offline use: retained events captured while permission was active may be sent after a new opt-in, preserving their original identity and time. We do not recover actions performed while consent was withdrawn. Turning statistics off does not automatically delete data PostHog has already received.

You can request deletion at [email protected]. If you choose to share a support report while analytics is enabled, it may include the existing analytics ID, separately labeled, to locate those data. Reading it does not start a disabled SDK. Deleting finances, uninstalling or resetting the app is not a request for remote deletion.

Technical diagnostics and other libraries

Apple’s local logs and MetricKit remain technical diagnostics. Finyvo also uses Sentry for filtered crash and technical diagnostics, with a pseudonymous installation identifier and compatibility metadata; financial content and request bodies are excluded from diagnostics. The product statistics control governs PostHog and does not change diagnostics policy, authentication or Apple permissions.

RevenueCat checks Plus and Lottie plays local animations. We do not integrate advertising SDKs or cross-app tracking. PostHog and Sentry privacy policies.

Storage and security

Data is stored in the app container with iOS data protection. Preferences use system settings. The Keychain holds the App Attest key identifier, installation identifier, and session token with its expiry. They are restricted to this device and do not sync through iCloud Keychain. They may survive reinstallation.

Network communication uses HTTPS. External provider keys remain on the backend. Cloudflare hosts the service, metrics, installation records, and caches, including reusable import-format interpretations. See Processing for retention and correlation.

Private mode is a presentation control. The app has no separate biometric lock; exported files are not encrypted. More detail under Security.

Third-party services

We separate three surfaces: what the App does from your iPhone, what our backend does on your behalf, and what happens when you visit the website.

In the App (your device talks directly to the provider)

Service	Purpose	Data shared	Privacy policy
Apple — iCloud / CloudKit	Sync your data across your devices (on by default, you can turn it off)	All of your Finyvo data, inside the private database of your own iCloud account. Finyvo cannot read it	apple.com/legal/privacy
Apple — iCloud key-value store	Recover your name if you reinstall or switch devices	The display name you typed	apple.com/legal/privacy
Apple — App Attest / DeviceCheck	Prove that the caller of our backend is the real app	A cryptographic attestation of the device and app, generated by the Secure Enclave. It does not include your Apple ID; it establishes a pseudonymous technical identity	apple.com/legal/privacy
Apple — App Store / StoreKit	Distribution and billing	Encrypted purchase receipt	apple.com/legal/privacy
Apple — MetricKit	Crash diagnostics	Crash and hang reports, aggregated by Apple	apple.com/legal/privacy
RevenueCat	Validate the Finyvo Plus subscription	Pseudonymous SDK identifier, Apple receipt, product identifier, subscription status, and the technical device data its SDK collects	revenuecat.com/privacy
Brandfetch (CDN)	Download the logo of a brand that is not bundled in the app	Your device’s IP address, your connection’s standard headers, and the requested brand domain	brandfetch.com/privacy
PostHog	Optional usage statistics	Pseudonymous ID, sessions, actions and limited technical metadata; no financial content	posthog.com/privacy
Sentry	Technical diagnostics	Pseudonymous installation identifier, crashes and filtered technical metadata	sentry.io/privacy

On our backend (we talk to the provider on your behalf)

Service	Purpose	Data shared	Privacy policy
Cloudflare (Workers, D1, KV)	Run and store the backend	HTTP metadata, IP address, the contents of /fx/*, /brand/*, /ai/*, and /import/*, those of the handshake (/auth/*, /attest/*, /session/*), and the installation registry	cloudflare.com/privacypolicy
RevenueCat (server API)	Verify your plan server-side	Your installation’s pseudonymous RevenueCat identifier	revenuecat.com/privacy
exchangerate.host	Exchange rates	Currency codes and dates. No data of yours	exchangerate.host
Brandfetch (API)	Brand lookup	The brand text you typed	brandfetch.com/privacy
OpenAI	Language models	The description, merchant, and amount of the entry; the names of your categories, wallets, tags, and currencies; and, when importing, the sample of rows from your file and the descriptors with their amounts	openai.com/policies/privacy-policy
ntfy	Internal backend health alerts	Operational metadata only (status code, path, request identifier, counters). Never your IP or content of yours	ntfy.sh

On the finyvo.com website

Service	Purpose	Data shared	Privacy policy
Cloudflare Pages	Host the site and detect your country to show example amounts in your currency	IP address and request metadata. The country detection is not stored in a cookie or in the browser	cloudflare.com/privacypolicy
Web3Forms	Deliver the Contact and Feedback forms	What you type: name, email address, topic, and the text of your message. Used only to deliver your message and reply to you	web3forms.com/privacy

International transfers

Finyvo is operated from the Dominican Republic, but its providers are international. Depending on the feature you use, your data may be processed outside your country of residence:

Recipient	Where it processes	What is transferred
Apple (iCloud / CloudKit)	Apple’s global infrastructure	Your Finyvo data, if you keep sync enabled
Cloudflare	Global network (200+ data centers); each request is routed to the nearest edge	Backend requests and website visits
OpenAI	Primarily the United States	The data of whichever AI features are invoked
RevenueCat	United States	Your subscription’s pseudonymous identifier
Brandfetch	The provider’s infrastructure	Your device’s IP and the brand domain, when downloading a logo
Web3Forms	United States	The content of the website forms
PostHog	United States	Consented usage statistics and pseudonymous analytics identifiers
Sentry	United States	Filtered technical diagnostics and installation identifier

How to avoid each transfer:

• Apple / iCloud: turn sync off in Settings. If your installation requires a restart for the change, Settings tells you; see iCloud sync. Your display name uses a separate iCloud store.
• OpenAI: turn off artificial intelligence in Settings → Artificial Intelligence. The master switch also covers the AI in the import flow, so with it off nothing travels to the model provider. The App works fully without it.
• Brandfetch: use brands from the catalog bundled in the app, upload your own image, or leave the default logo.
• Web3Forms: write to us directly at [email protected] instead of using the website form.
• RevenueCat: the SDK may check plan status even if you do not buy Plus; not purchasing does not disable that service.
• PostHog: decline or withdraw statistics in Settings → Privacy; this does not affect your finances or disable other services.

For users in the European Economic Area, the United Kingdom, and other jurisdictions with transfer rules: we work to have each transfer covered by the Standard Contractual Clauses published by the European Commission, by an adequacy framework, or by the data processing terms each provider publishes. If you need the specific mechanism applicable to a particular provider, write to us at [email protected].

Retention and deletion

Data	Retention
Local financial database, including refunds and captures	Until deletion in the app or uninstallation, subject to copies and evidence retained for review or undo. Archiving or dismissing does not erase all evidence.
Private iCloud	May remain after uninstalling or turning sync off. Managed through iCloud storage settings.
Local backups	Automatic cleanup applies limits of seven scheduled backups and three pre-migration backups, while protecting the latest backup, manual and incident backups, and those currently in use. Exported files remain wherever you save them.
Keychain	May survive uninstallation; reinstalling does not guarantee deletion of technical identity.
Backend caches	Rates: 24 hours; brands: 1 hour. Pending format tickets expire after 30 minutes.
D1	Historical rates, installations, AI metrics, and confirmed formats have no automatic expiry implemented. Uninstalling does not delete them.
Workers Logs	3 or 7 days depending on the plan, as explained under Processing.
OpenAI and RevenueCat	According to provider terms and controls. OpenAI has different rules for abuse logs and responses: see AI.
Support messages and forms	As long as needed to address them, normally up to 24 months, unless law requires retention.
PostHog	The current plan allows event retention for up to 7 years (plan terms). You may request earlier deletion; turning analytics off does not delete the profile or remote events. The local queue is limited to 1,000 events, without a guaranteed app-enforced time limit.
Sentry	Subject to the provider’s technical diagnostics retention and applicable deletion requests; uninstalling does not delete it.

Delete individual records or use Settings → Advanced → Reset all data. Reset cancels alerts and resets app data; changes may propagate through iCloud, but do not themselves delete your Apple account’s container, previously exported files, or backend records.

To stop future captures, pause or revoke the Apple Pay connection and disable its Shortcuts automation. This does not erase recorded purchases. To delete the iCloud copy, use iOS Settings → [Your name] → iCloud → Manage Account Storage → Finyvo.

Cancelling Plus is separate and is managed in your Apple account subscriptions. To request access to or deletion of backend data or support messages, email [email protected]. We will explain what is needed to locate records without requesting your financial history.

Take your data with you

In Settings → Data → Export my data, you can generate a free ZIP containing eight CSV files, detailed JSON, and a file guide. It is generated on your iPhone and works offline.

JSON includes refund links, transaction provenance and, where present, Apple Pay captures, import links, and retained original evidence. Pending captures are not presented as expenses in financial CSV files. Active Apple Pay connection settings are not included.

Importing transactions from that JSON does not restore the whole database or reactivate automations. Use backup recovery for local backups recognized by the app. The ZIP is not encrypted or password protected, even with private mode enabled.

Your rights

Depending on your country of residence, you have one or more of the following rights over your personal data:

• Access: know what data we process about you.
• Rectification: correct inaccurate or outdated data. Data on your device is edited directly in the App.
• Erasure (“right to be forgotten”): delete the data we keep about you. See Retention and deletion.
• Restriction of processing.
• Objection to processing based on legitimate interest. In practice: turn off iCloud sync and the AI features in the App’s settings.
• Portability: receive your data in a structured, machine-readable format. You can exercise it yourself, without asking us: see Take your data with you.
• Withdraw consent where processing is based on it.
• Not to be subject to automated decisions with legal or similarly significant effects. Finyvo makes no such decisions about you: it computes no credit scores and approves or denies nothing. AI may suggest or apply categories and tags depending on the flow, including categorization of recorded Apple Pay purchases. You can review and correct those assignments; they do not authorize payments or credit decisions.
• Lodge a complaint with the supervisory authority in your country.

To exercise these rights, email [email protected]. We respond within the applicable legal deadline. Where GDPR applies, the ordinary deadline is one month, extendable by two further months in the circumstances it allows, with notice of the extension and reasons.

In many cases we cannot access your data even if we wanted to. We cannot query your financial database on your iPhone or iCloud; some features process portions of your data outside the device, as explained above. What we can act on are our backend’s records (installation identifier, AI usage metrics, operational logs) PostHog analytics data, and the messages you have sent us through the website forms.

Applicable legal frameworks and legal bases

Dominican Republic

Processing is carried out in accordance with Law No. 172-13 on the Protection of Personal Data. In consumer matters, Law No. 358-05, the General Law on the Protection of Consumer or User Rights, applies.

European Union, European Economic Area, and United Kingdom

For residents of the EEA or the UK, Regulation (EU) 2016/679 (GDPR) and the UK GDPR apply. The legal bases are:

Processing	Legal basis
Local storage of your financial data and delivery of the service	Performance of a contract (Art. 6(1)(b) GDPR)
Sync with your private iCloud	Performance of a contract (Art. 6(1)(b) GDPR). It is a service feature you can turn off at any time
Installation identification (App Attest) and anti-abuse limits	Legitimate interest in protecting the service from fraudulent use (Art. 6(1)(f) GDPR)
Artificial intelligence features, including assisted import	Performance of a contract for the features you request (Art. 6(1)(b)) and legitimate interest in offering automatic suggestions (Art. 6(1)(f)), with a right to object exercisable from the App’s switches
Technical diagnostics, security, and abuse prevention	Legitimate interest (Art. 6(1)(f) GDPR)
Managing the Finyvo Plus subscription	Performance of a contract (Art. 6(1)(b) GDPR)
Handling messages sent through the website forms	Legitimate interest in answering enquiries (Art. 6(1)(f)) or performance of your request
Compliance with legal and tax obligations	Legal obligation (Art. 6(1)(c) GDPR)
Optional product statistics (PostHog)	Voluntary consent, withdrawable in Settings (GDPR Art. 6(1)(a)).

United States: California (CCPA / CPRA)

For California residents, under the California Consumer Privacy Act as amended by the California Privacy Rights Act, you have the right to know which categories of personal information are collected, to access, correct, or delete your information, to limit the use of sensitive information, not to be discriminated against for exercising your rights, and to opt out of the “sale” or “sharing” of personal information.

Finyvo does not sell or share personal information as defined by the CCPA/CPRA. We do not trade data with advertisers or ad networks.

Brazil: LGPD

For residents of Brazil, the Lei Geral de Proteção de Dados (Lei 13.709/2018) applies. Your rights are substantially equivalent to those listed above and the contact channel is the same: [email protected].

The App is available in Brazilian Portuguese, and so is this document: finyvo.com/pt/privacy. The Portuguese version is a courtesy translation; if the versions differ, the Spanish version prevails.

Other Latin American countries

Depending on your residence, the following may apply: Mexico (Federal Law on the Protection of Personal Data Held by Private Parties), Argentina (Law 25.326), Colombia (Statutory Law 1581 of 2012), Chile (Law 19.628, as amended in 2024), and Peru (Law 29.733). Finyvo respects the substantive rights each framework grants and responds within the applicable time limits.

Supervisory authorities

If you believe your rights have not been properly addressed, you may turn to the competent authority:

Jurisdiction	Authority
Dominican Republic (consumer)	Pro Consumidor: proconsumidor.gob.do
European Union / EEA	Your country’s national data protection authority
United Kingdom	ICO: ico.org.uk
California (USA)	CPPA: cppa.ca.gov
Brazil	ANPD: gov.br/anpd
Mexico	Secretaría Anticorrupción y Buen Gobierno: gob.mx/buengobierno
Argentina	AAIP: argentina.gob.ar/aaip
Colombia	SIC: sic.gov.co

Before going to the authority, we would appreciate it if you wrote to us first at [email protected] so we can try to resolve it directly.

Children’s privacy

Finyvo is rated 4+ on the App Store, but it is not designed for or directed at children under 13. We do not knowingly collect personal information from children under 13, or under the minimum age applicable in your country, which may be higher under local rules.

If you are a parent or guardian and discover that a child under 13 has used the App, write to us at [email protected]. We will take the necessary steps to address the situation and, where appropriate, delete the corresponding information.

App Store privacy label

Read the App Store privacy information alongside this Policy. We do not perform advertising tracking. Depending on the feature, processing includes pseudonymous identifiers, Plus purchases, diagnostics, text, usage statistics, and financial information. Authenticated requests and technical identifiers can be correlated; we do not describe that data as anonymous. Availability and the final declaration for each version are published in its listing.

Changes to this Policy

This Policy may be updated to reflect changes in the App, in applicable law, or in our practices. When there are substantial changes:

• We will publish the updated version on the website and link to it from the App.
• We will update the “Last updated” date at the top of the document.
• When the changes affect your substantive rights, we will tell you inside the App.

Changes to this Policy do not replace consent where legally required; in that case we will request it before the new processing.

The finyvo.com website

This section applies only to the finyvo.com website and its subdomains. It does not apply to the iOS App, which uses no cookies.

Cookies and storage

The site sets no cookies. It only uses two local storage keys in your browser:

Type	Storage	Expiry	Purpose
Necessary (language)	localStorage	Until you clear site data	Remember the language you chose
Necessary (theme)	localStorage	Until you clear site data	Remember whether you prefer light or dark theme

You can clear them at any time from your browser’s privacy settings.

Network requests made by the site

The site makes exactly two requests that involve a third party:

When	Where	What for	What is sent
On loading the home page	/cdn-cgi/trace, a Cloudflare service served from our own domain	Detect your country from your IP and show example amounts in your currency	Your IP address, as on any web visit. The result is not stored: no cookie, no local storage
Only if you submit the Contact or Feedback form	api.web3forms.com (Web3Forms)	Deliver your message to us by email	Your name, your email address, the topic, and the text of your message. On the Feedback form, the email is optional

There is no other third-party request: the fonts are hosted on our own domain and we use no external CDNs.

Website forms

The /contact and /feedback forms are submitted to Web3Forms, a third-party service that receives the message and forwards it to us by email. Web3Forms processes what you wrote: name, email address, topic, and message text. It sets no cookies and builds no profile. If submission fails, your browser opens your email app with the message pre-filled so you can send it to us directly. We keep received emails as long as needed to handle your request, and at most 24 months.

One of the contact form’s topics is “Privacy / data”. If you would rather not go through Web3Forms to exercise your rights, write to us directly at [email protected].

What the site does not use

There is no Google Analytics, Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, Hotjar, Crazy Egg, Microsoft Clarity, nor any marketing, retargeting, or third-party advertising cookie. If we ever integrated an analytics tool, we would update this section before enabling it and would show a consent notice where legally required.

Contact

For any query, rights request, or complaint related to privacy:

[email protected]

We reply within the applicable legal time limits, normally 30 calendar days.