Privacy Notice

1. Who We Are, and Who Controls Your Data

Finaura ("we," "us," or "our") is a personal finance app that stores all your data locally in your browser (IndexedDB). We do not operate servers that receive, process, or store your financial information.

Because of that architecture, you are effectively your own data controller for the financial data you enter: it stays on your device unless you take an explicit action to move it (exporting a backup, or opting into Drive/P2P sync). Where you opt into Google Drive sync, Google acts as your processor, storing a file in your own Google Drive account at your direction; it does not act as our processor, because we never have access to that file's contents or to any Google account other than yours.

2. Overview

This notice explains exactly what data exists, where it lives, who (if anyone) it's ever shared with, and your rights over it. Read together with our Terms of Service.

3. Information We Collect

Stored locally on your device only, never transmitted to us:

• Profile and vault information: your display name, budget name, and a hashed PIN, password, or passkey credential used to lock the app. There is no server-side account or email/password login.
• Financial data: transactions, budgets, categories, accounts, goals, debts, investments, subscriptions, bills, tax profiles, credit tracking, and any notes or tags you attach to them.
• Preferences: currency, language, theme, notification settings, and layout customizations.
• Receipt image attachments: if you attach a receipt photo to a transaction, it is stored exclusively in IndexedDB and is never included in sync operations or backups that leave your device.

Transmitted only when you take an explicit, opt-in action:

• Google Drive sync payload: an AES-256-GCM encrypted snapshot of your data, written to a file in your own Google Drive account, only if you enable this feature.
• P2P sync payload: the same kind of encrypted snapshot, sent directly between two of your own devices over WebRTC, only during an active, QR-code-paired sync session.
• Contact Support / Feedback form fields: your name, email, category of issue, and message, only when you fill out and submit that specific form.

Automatically collected:

• Standard web server request metadata: our static hosting provider necessarily logs basic request information (such as IP address and browser type) to deliver the app's files to you, the same as any website. This never includes your financial data, since that data is never sent to any server in the first place.
• No analytics, no cookies, no tracking scripts of any kind — see "Cookies, Analytics & Tracking" below.

4. How We Use Information

We do not process your financial data in any way, because we never receive it. The app running on your device is what reads, calculates, and displays your budgets, balances, and projections, entirely locally.

The very limited data that does reach us or a processor acting on your behalf is used solely to:

• Relay a Feedback/Support form submission to us by email, if you choose to send one
• Store your encrypted Drive/P2P sync snapshot exactly where you told it to go, if you opt into that feature
• Deliver the app's files to your browser (standard web hosting)

5. Legal Basis for Processing (GDPR)

Because Finaura does not act as a controller processing your financial data on infrastructure it operates, the traditional GDPR "legal basis" analysis mostly does not apply to that data — there is no processing by us to have a legal basis for. To the extent GDPR does apply to the narrow slice of data described above, our bases are:

• Consent (Art. 6(1)(a)): enabling Google Drive sync or P2P sync is an explicit opt-in action, and you can withdraw that consent at any time by disconnecting the feature.
• Contract performance / legitimate interest (Art. 6(1)(b)/(f)): responding to a Feedback/Support form submission you send us, and delivering the app's static files to your browser.
• Legal obligation (Art. 6(1)(c)): we may process data where required by law, such as responding to a valid legal request, though as described above there is generally no data on our systems for such a request to reach.

6. Data Sharing and Service Providers

We do not sell your data. We do not share your personal or financial data with third parties for their marketing purposes. We do not use your data to train any artificial intelligence or machine learning model, and we do not send your data to any AI provider — the in-app AI Financial Assistant ("Veda") runs entirely on-device using pattern matching, not a hosted large language model, and no query or financial data you give it ever leaves your browser.

The only service providers involved in operating Finaura are:

• Google (Drive Sync, optional): stores your encrypted sync file in your own Drive account. We use the drive.file OAuth scope, which limits Google's access to files the app itself created. Google never sees your data unencrypted; it sees only ciphertext.
• Web3Forms (Contact Support / Feedback, optional): receives and relays whatever you type into the Feedback/Support form. No financial data (transactions, balances, budgets, accounts) is ever included, only the fields visible on that form.
• Static web hosting provider: delivers the app's files to your browser and, like any web host, sees standard request metadata (IP address, browser type) in the process. It never receives your financial data.

We do not use Plaid, or any bank-linking or financial-data-aggregation service. Finaura has no feature that connects to your bank or automatically imports transactions from a financial institution; every transaction is entered manually or imported by you from a file you provide.

7. Google Drive Sync (Optional)

If you choose to enable Google Drive sync, your budget data is stored as a file (finaura-sync.json) in your own Google Drive account. We do not have access to your Google Drive or its contents.

• End-to-end encrypted: before the file ever reaches Google Drive, your data is encrypted on-device with AES-256-GCM, using a key derived from a sync passphrase only you know. Finaura never stores or transmits that passphrase, and never sees your data in unencrypted form once it leaves your device. Google sees only ciphertext.
• Google Drive sync is entirely opt-in. The app works fully offline without it.
• OAuth access and refresh tokens are stored in your browser's IndexedDB only.
• Tokens are never transmitted to any party other than Google during the OAuth flow.
• Google's own handling of your data is governed by Google's Privacy Policy.
• You can disconnect Google Drive at any time in Settings → Sync → Disconnect.

8. P2P Device Sync (Optional)

If you use the peer-to-peer (P2P) sync feature to sync between devices, Finaura establishes a direct, encrypted WebRTC connection between your two devices on your local network.

• No relay servers: P2P sync uses local network connections only. No STUN or TURN relay servers are used. Your data never passes through any intermediary server.
• Signaling via your Drive file: Device pairing uses a temporary session token written to your own Google Drive file (the same one used for Drive sync). This signaling token contains no financial data, only a connection handshake.
• Data scope: During a P2P sync, a full snapshot of your local IndexedDB (excluding receipt attachments) is exchanged directly between your two devices. No data is routed through our servers.
• Encrypted twice over: WebRTC's DTLS transport already encrypts the connection itself, and Finaura additionally encrypts the snapshot payload with the same AES-256-GCM, passphrase-derived key used for Google Drive sync. This keeps the data opaque even to a peer that captures raw signaling or data-channel traffic outside the intended pairing.
• Opt-in only: P2P sync requires Google Drive sync to be enabled first and requires active pairing via QR code on each session.

9. AI Financial Assistant (On-Device)

Finaura includes an on-device AI Financial Assistant that answers questions about your finances. This feature is designed with privacy as a core principle:

• Fully on-device: The assistant runs entirely in your browser using a pattern-based query engine that reads directly from your local IndexedDB. No question you ask, and no data used to answer it, is ever sent to an external server or AI model.
• No cloud AI: The assistant does not use any cloud-based language model (ChatGPT, Claude, Gemini, or any other). All processing is local.
• No conversation logging: Your chat history with the assistant is held in browser memory for the current session only and is cleared when you close the panel or reload the page. It is not persisted to IndexedDB.
• One limited write action: the assistant can draft a transaction for you to review, but it never saves anything to your data without your explicit confirmation tap.

10. Support & Feedback Form (Optional)

The Contact Support form (Settings → Help, or /support) sends whatever you type into it, name, email, category, and message, to Web3Forms, a third-party form-relay service, which forwards it to us by email. This is the only place in Finaura where free-text you type is sent off your device by our own code.

• Only submitted when you fill out and send the form. Nothing is sent automatically or in the background.
• No financial data (transactions, balances, budgets, accounts) is ever included, only the four fields you see on the form.
• The form itself asks you not to include account numbers, balances, or transaction specifics in your message.
• Governed by Web3Forms' Privacy Policy once it leaves your device.

11. Cookies, Analytics & Tracking

Finaura uses no cookies, no analytics trackers, no advertising networks, and no third-party tracking scripts. There is no session tracking, fingerprinting, or behavioral profiling of any kind. This is enforced at the network level, not just by policy: the app's Content Security Policy restricts outbound network requests to only Google's APIs (for opt-in Drive sync) and Web3Forms (for the opt-in Feedback form) — no other destination is reachable from within the app.

12. International Data Transfers

Because Finaura has no backend that receives your financial data, there is no international transfer of that data by us — it either stays on your device or moves, at your direction, into your own Google Drive account. When you use the optional Contact Support/Feedback form, your submission is transmitted to and processed by Web3Forms, which may process it outside your country of residence under its own privacy policy and its own transfer safeguards. When you use Google Drive or P2P sync, your encrypted file is stored by Google under its own privacy policy and transfer safeguards. Those third parties, not Finaura, are responsible for the international handling of the narrow slice of data each of them separately touches.

13. Data Security

Your PIN or password is hashed using PBKDF2-HMAC-SHA256 (600,000 iterations) via the Web Crypto API before storage. It is never stored or transmitted in plaintext. Anything that leaves your device, including JSON exports, Google Drive sync, and P2P sync, is encrypted with AES-256-GCM using a passphrase only you know before it's written or transmitted. All network traffic to and from the app uses HTTPS/TLS, and the app is served with a strict Content Security Policy and standard web security headers.

We have internally audited Finaura against the OWASP Application Security Verification Standard (ASVS) 5.0, Level 2, a widely used web-application security checklist, and address findings as they're identified.

Known limitation, stated plainly: data at rest in your browser's IndexedDB is not separately encrypted by the app itself. It relies on your device's operating system-level storage protection (such as full-disk encryption on most modern phones and laptops). Full application-level encryption of the local database is on our roadmap but not yet implemented. The accurate claim today is: data in transit, and data that leaves your device (backups and sync), is encrypted by the app; data resting locally in IndexedDB depends on your device's own OS-level protection. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

14. Data Breach Notification

Because Finaura never holds a copy of your financial data on infrastructure we operate, there is no Finaura-side data store of your financial information that could be breached in the way that term is normally used, and so a personal-data breach notification obligation of the kind described in GDPR Articles 33–34 does not arise for that data.

That said, a vulnerability in the app itself, for example a bug that could expose data already on your device to malicious code, would still warrant a security disclosure. If we become aware of such a vulnerability, we will fix it and disclose it through the in-app "What's New" notification or a similar in-app notice, since we have no email address on file to contact you directly.

15. Automated Decision-Making and AI

We do not carry out automated decision-making that produces legal or similarly significant effects about you. The in-app Smart Insights and AI Financial Assistant features surface human-reviewable suggestions and rule-based observations about your own data; they never make a decision on your behalf. As stated above, we do not use your personal or financial data to train any AI or machine learning model, and we do not send your data to any third-party AI or LLM provider. If that ever changes, we will update this notice and communicate the change through the in-app "What's New" notification before enabling it.

16. Your Rights (GDPR & CCPA)

Because all data is stored locally on your device, you have complete, direct control at all times:

• Right to access: use Settings → Export Data → Download JSON to export all your data in a structured, machine-readable format at any time.
• Right to erasure: use Settings → Danger Zone → Delete All Data to permanently wipe all records from your device's IndexedDB. This is immediate and irreversible.
• Right to rectification: every record in the app is directly editable by you; there is no separate Finaura-controlled copy that would need to be separately corrected.
• Right to portability: data is exportable as JSON (all tables) or CSV (transactions) at any time from Settings.
• Right to restrict processing / object to processing: largely not applicable by architecture, since we do not carry out ongoing processing of your financial data to restrict or object to. Where processing does occur (the opt-in Feedback form, opt-in sync), you control it directly by choosing whether to use those features at all.
• Right not to have data sold (CCPA): we do not sell, share for cross-context behavioral advertising, or otherwise transfer your personal data to any third party. There is no data to sell because we never receive it.

Right to lodge a complaint: if GDPR applies to you, you have the right to lodge a complaint with your local data protection supervisory authority. Because Finaura is not established in the European Union or United Kingdom, we do not have a single lead EU/UK supervisory authority the way an EU-based company would; you may contact the data protection authority in your own country of residence.

For any request or question about your rights, please reach out via the in-app Feedback button or the /support page. We will respond within a reasonable time, generally within 30 days.

17. Data Retention

We retain different categories of data for different periods:

• Data on your device: retained for as long as you keep the app installed and don't delete it. This is entirely under your control.
• After you use Delete All Data: every table in your local database is cleared immediately and permanently. Nothing is held back by us, since we never had a copy to begin with.
• Google Drive sync file: retained in your own Google Drive account until you delete it or disconnect sync. We hold no independent copy.
• Feedback/Support form submissions: retained in our support inbox for as long as reasonably necessary to address your inquiry, and separately retained by Web3Forms under its own retention practices.
• Hosting/server request logs: retained only for a short period, consistent with our hosting provider's standard web-server log practices, for security and abuse-prevention purposes.

18. Notice to US Residents (CCPA/CPRA)

If you access Finaura from the United States:

• We do not sell your personal information as defined by the California Consumer Privacy Act (CCPA/CPRA) or comparable state laws.
• We do not share your personal information for cross-context behavioral advertising.
• We do not use or disclose sensitive personal information (which, under CPRA, includes financial account information) for any purpose other than providing the Service directly on your own device.
• We do not connect to your bank accounts; every transaction in Finaura is entered or imported by you, not pulled automatically from a financial institution.
• To exercise access, deletion, correction, or opt-out rights under your state's privacy law, use the in-app Feedback button or the /support page and identify the state you reside in.

19. Children's Privacy

Finaura is not directed to, and may not be used by, anyone under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child has used the app and provided personal data to us (for example, through the Feedback form), please contact us via the in-app Feedback button and we will delete it.

20. Changes to This Notice

We may update this notice when we add features that affect data handling. Because Finaura has no server-side accounts or email addresses on file, we cannot notify you individually by email; instead, material changes will be communicated through the in-app "What's New" notification, and the "Last updated" date above will always reflect the most recent revision. Continued use of the app after a change takes effect constitutes acceptance of the updated notice.

21. Contact Us

If you have questions about this Privacy Notice or our data practices, use the in-app Feedback button, or visit /support.