Finlytix ("we", "our", "the app") is a personal finance tracking app. This policy explains what data we collect, how we use it, and your rights.
1. Data We Collect
Account Information
When you sign in with Apple, we receive your Apple User ID, name (if provided), and email address (which may be an Apple relay address). This is stored securely in your device's Keychain and synced to our server to create your account.
Financial Data You Enter
Holdings, subscriptions, wealth snapshots, watchlist items, and price alerts are stored locally on your device using Apple's SwiftData framework. This data is optionally synced across your devices via Apple iCloud (CloudKit). We do not have access to this data on our servers.
Settings and Preferences
Your preferences (currency, display name, monthly income, notification settings) are synced across your devices via Apple's iCloud Key-Value Store.
Device and Usage Data
We collect device tokens for push notifications via OneSignal. Google AdMob may collect device identifiers and usage patterns for ad serving. We do not operate our own analytics or tracking systems.
2. How We Use Your Data
- Account management: Your Apple User ID, name, and email are stored on our server to manage your profile and per-user settings.
- Push notifications: Your Apple User ID and email are shared with OneSignal to deliver push notifications you have opted into.
- Advertising: Google AdMob displays ads to non-premium users. AdMob may use device identifiers and usage data for ad personalization, subject to Google's privacy policy.
- Market data: We fetch live prices from third-party APIs (Yahoo Finance, currency exchange APIs). No personal data is sent to these services.
- iCloud sync: Your financial data (holdings, subscriptions) syncs via Apple's CloudKit to your other devices. This data is encrypted by Apple and we cannot access it.
3. Data We Do NOT Collect
- Bank account numbers or login credentials
- Payment card details (all purchases processed by Apple)
- Biometric data (Face ID/Touch ID is processed locally by Apple's Secure Enclave)
- Location data
- Contacts, photos, or other device data
- Browsing history
4. Third-Party Services
| Service | Purpose | Data Shared |
|---|
| Apple (Sign in with Apple) | Authentication | User ID, name, email |
| Apple (iCloud/CloudKit) | Device sync | Financial data (encrypted) |
| Apple (StoreKit) | In-app purchases | Transaction data |
| Supabase | Backend server | User ID, name, email |
| OneSignal | Push notifications | User ID, email, device token |
| Google AdMob | Advertising | Device identifiers, ad interactions |
Each service is governed by its own privacy policy.
5. Data Security
- Passwords and passcodes are hashed with SHA256 and salted before storage
- Sensitive credentials are stored in Apple's Keychain with appropriate access controls
- All network communication uses HTTPS encryption
- Biometric authentication is handled entirely by Apple's LocalAuthentication framework
- A privacy screen hides your financial data in the app switcher
6. Data Retention
- Your account data is retained on our server until you delete your account
- Local data is retained on your device until you delete the app or use the "Delete All Data" option in Settings
- iCloud-synced data follows Apple's retention policies
- Price history data on our server is automatically cleaned up after 90 days
7. Your Rights
- Delete your account: Settings > Delete Account removes all server-side data and local data
- Sign out: Removes your session without deleting data
- Disable iCloud sync: Turn off iCloud in iOS Settings to keep all data local
- Disable notifications: Revoke notification permissions in iOS Settings
- Limit ad tracking: Enable "Limit Ad Tracking" in iOS Settings > Privacy > Advertising
- Request data deletion: Contact us at the email below
8. Children's Privacy
Finlytix is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will delete it.
9. Changes to This Policy
We may update this policy from time to time. The "Last Updated" date at the top reflects the most recent revision. Continued use of the app after changes constitutes acceptance.