Privacy Policy

Who runs this service

FinancialControl is built and operated by one person. There is no company behind it, no support department, and no staff whose job involves looking at your records. When you write in about your data, one person reads it and answers it. You should know that before you connect a bank account.

What is collected

Your account

• Your email address, stored encrypted, with a separate one-way lookup value so that signing in by email still works
• Your password, stored only as a hash that cannot be turned back into your password
• A display name, if you enter one
• If you turn on two-factor sign in, the secret for your authenticator app, stored encrypted, and your recovery codes, stored only as hashes
• Your settings, such as your utilization target, payoff strategy, and monthly budget

Your cards and accounts

• Card or account name, issuer, and the last four digits
• Account type, such as credit card, loan, or checking
• Current balance, available balance, and credit limit
• Statement balance and the date the last statement was issued
• Interest rate, minimum payment, payment due date, and whether the account is past due
• Last payment amount and date
• Any notes you add yourself

Your expenses

Expenses you type in or bring in from a CSV file: name, category, amount, whether it repeats, how often, the dates, and any notes.

Payments you record

When you tell the app you have paid a card, it saves that payment: the amount, the date, the card it was against, whether you asked for it to come off the balance, and any note or reason you typed. It also saves who recorded it and the address the request came from, because a payment record is what the rest of the arithmetic trusts. Corrections are stored as new records that supersede the original rather than by editing history.

Snapshots

Once a day, when your figures change, the app saves a summary of your position: total limit, total balance, total statement balance, total available credit, overall utilization, how many cards are over your target, and a health score. It also saves one line per card holding that card's name, balance, credit limit, and utilization. This is what draws the history charts. It holds no account numbers.

Technical records

• Sign in sessions, each holding your IP address, your browser's user agent string, and an expiry date. The session token itself is stored only as a hash.
• An activity log of actions on your own account, such as signing in, connecting a bank, importing a file, and recording a payment. Each entry records the action, whether it succeeded, the time, your IP address, and your browser's user agent. Some entries carry a little detail about the action itself: the internal id of the card or expense involved, and, when you record or correct a payment, the amount of that payment. The log never records a card balance, a credit limit, an account number, an email address, or any token.
• Email verification and password reset requests, holding the IP address and browser that asked, and the token stored only as a hash.
• Short-lived approval records for bank calls that cost money, holding a hashed token, what was being approved, and the cost.
• Ordinary web server logs.

Why it is collected

Every item above is collected for one of three reasons.

• To do the job you asked for. The app cannot tell you which card to pay without knowing your balances, limits, minimum payments, and dates. This is the bulk of it.
• To keep the account yours. Passwords, sessions, two-factor secrets, lockout counters, and the activity log exist so that somebody else cannot read your finances.
• Because you chose to connect a bank. Bank data is only collected if you go through the connection process yourself, and only from the institutions you pick.

Your information is never sold, never used for advertising, and never used to build a profile of you for anyone else. No marketing email is sent.

Banks and Plaid

Your bank credentials never reach this app

When you connect a bank, you do it inside Plaid Link, which is a component supplied and run by Plaid. Your bank username, password, and any one-time code are entered there and go to Plaid and your bank. They are never sent to FinancialControl, never pass through its server, and are never stored by it. FinancialControl only ever receives a token from Plaid that allows reading, and the account data that comes back.

What is requested from Plaid

When a connection is made, FinancialControl asks Plaid for the Liabilities product and reads account balances. It does not ask for Transactions, Auth, Identity, Assets, Income, or Investments, so it never receives your spending history or your account and routing numbers.

These are the only calls the app makes to Plaid:

• Starting a connection, which creates the token that opens Plaid Link
• Exchanging the result of a successful connection for a read token
• Reading the details of the connection itself, to learn which institution it is and when consent expires
• Looking up that institution's name and logo, so the connection is recognizable on screen
• Reading account balances
• Reading credit card liabilities: credit limit, statement balance, statement date, minimum payment, due date, interest rates, and whether the account is past due
• Removing the connection at Plaid when you disconnect it or delete your account

What comes back is used for exactly one thing: filling in your cards on your own dashboard so the payment figures are right. It is not examined for any other purpose and is not shared onward.

Connecting a bank is not open on a new account. Accounts are created with no bank access, and bank linking is granted by an administrator, because every bank call is billed. Until then, cards are added by hand or imported from a CSV file, and everything else in the app works.

Who your data is shared with

Nobody buys it, and nobody is given it for their own purposes. There are three parties who necessarily touch it, and you should know who they are.

• Plaid, if and only if you connect a bank. Plaid handles the connection to your institution and returns the account data. Plaid has its own privacy policy governing what it does with what it collects.
• The hosting provider that rents out the server. The application and database run on their machine. They are not sent your data as a separate handover, but the hardware and the disks are theirs.
• An email provider, when email delivery is configured, which carries account messages such as address verification and password resets. It necessarily sees your email address and the contents of those messages. No financial figures are ever put in an email.

Beyond that, information is disclosed only if the law requires it.

Encryption and security

In transit. The whole site is served over HTTPS, with a certificate from Let's Encrypt. A request arriving on plain HTTP is redirected to HTTPS, the www address is redirected to the bare domain, and your browser is told to use HTTPS only for this site for a year. The server is set to negotiate TLS 1.2 or better and to refuse TLS 1.1 and older.

At rest. The most sensitive individual fields are encrypted in the database with AES-256-GCM, using a key held in a file on the server outside the application code: your email address, your Plaid access token, and your two-factor secret. Each encrypted value is tied to its owner and its field name, so a stored value cannot be moved onto somebody else's record and still be readable. Passwords are stored as Argon2id hashes, or scrypt hashes where the Argon2 native module is unavailable, and are never recoverable. Session tokens, password reset tokens, email verification tokens, and two-factor recovery codes are stored only as SHA-256 hashes.

To be accurate about the limits of that: your balances, credit limits, minimum payments, due dates, expenses, and recorded payments are stored as ordinary database fields and are not individually encrypted. They are protected by the controls on the server rather than by field level encryption.

The server. The database accepts connections only from the machine itself and is not reachable from the internet. Administrative access is by SSH key only, with password sign in disabled. A firewall is active and automatic operating system security updates are enabled. Requests are rate limited by address, and an account locks after repeated failed sign in attempts.

Backups. Any backup of the database is held on the same server. There is no off-site copy. A record you delete is gone from the live database at once, but it remains inside any backup file taken before the deletion until that file is replaced. Backups are never searched to remove one person's records, and restoring one is a whole-database operation used only for disaster recovery.

What this service does not have

An honest list, because a policy that implies more than exists is worse than a short one.

• No SOC 2, ISO 27001, PCI, or any other certification
• No penetration test, no third party security audit, and no bug bounty program
• No security team, and no formal vulnerability scanning beyond automatic operating system updates
• Two-factor sign in is available and recommended, but it is not required
• No off-site backup
• No scheduled review of stored data, and no automated check that this retention policy was applied

How long things are kept

In short: your records are kept while your account exists, and they go when you delete it. Sign in sessions expire on their own after 30 days, password reset links after 30 minutes, and email verification links after 24 hours. The activity log is deleted automatically two years after each entry is written.

Two principles sit underneath all of it.

• Data is kept while the account exists, and goes when the account goes. There is no separate archive and no copy kept for analytics, because there are no analytics.
• Leaving is never blocked. Exporting your data and deleting your account both work even when the email address on the account has not been confirmed. Other features can be gated behind confirming your address. These two are not.

Retention at a glance

Your profile

Held for as long as the account exists. Deleting the account removes the whole record, including the encrypted email address, the lookup value derived from it, the password hash, the encrypted two-factor secret, the hashed recovery codes, and your settings. There is no soft delete and no grace period. The record is removed from the database rather than flagged as inactive.

Accounts are not expired for inactivity. An account you stop using is kept until you delete it.

Cards, accounts, expenses, and payments

Held while the account exists. You can delete any individual card, account, or expense in the app at any time, and that removal is immediate. Recorded payments are not edited or deleted one by one; a correction is written as a new record that supersedes the original, so the history stays readable.

On account deletion, every card, account, expense, and recorded payment is removed automatically in the same action.

Bank connections and Plaid access tokens

A Plaid access token is stored encrypted and is kept only while the connection exists. It is removed when you disconnect that institution, and when you delete your account.

In both cases the app also calls Plaid to remove the connection at Plaid's end, so read access to your bank actually stops rather than merely vanishing from the screen. When you disconnect an institution you choose whether to delete the cards that came from it or keep them as manual entries, and the token is removed either way.

Snapshots

One summary row per day, holding totals, utilization, and one line per card. It carries no account numbers. Kept for the life of the account so the history charts have something to draw, and removed automatically when the account is deleted. There is no age limit on snapshots while the account is open.

Sessions and one-time links

A sign in session lasts a maximum of 30 days, and the database removes expired session rows automatically. Signing out, changing your password, and completing a password reset all revoke the session immediately, so it stops working at once, and the row itself is removed when its 30 day expiry passes. Deleting your account removes every session row outright. The session token is never stored, only a SHA-256 hash of it.

Email verification links last 24 hours and password reset links last 30 minutes. Both are single use, both are stored only as hashes, both are removed automatically once expired, and issuing a new one destroys any outstanding one for that account.

Activity log

Every entry is deleted automatically two years after it is written. The database enforces this itself rather than relying on anybody remembering to run a cleanup.

The log deliberately outlives the account. When you delete your account, a final entry recording that deletion is written and kept under the same two-year clock. It exists so there is a record that an action happened, which is what makes an unauthorized action detectable at all. Entries cannot be edited once written.

Backups

Backups are held on the same server. There is no off-site copy at present. A record you delete is gone from the live database immediately, but it remains inside any backup file taken before the deletion until that file is replaced. Backups are not searched to remove individual records, and restoring one is a whole-database operation used only for disaster recovery.

How this is enforced

Being honest about the mechanism, because "we enforce our retention policy" means nothing on its own.

• Enforced by the database. Sessions, email verification links, password reset links, bank call approvals, and activity log entries all carry an expiry that the database acts on itself. Nobody has to remember, and nothing is missed if the operator is unavailable.
• Enforced by the application. Deleting a card, deleting an expense, disconnecting a bank, and deleting an account all remove the records in the same action. Account deletion removes your profile, your cards and accounts, your bank connections, your sessions, your snapshots, your expenses, your recorded payments, and any outstanding one-time link, and it also calls Plaid to remove each connection at their end.
• Done by hand. Answering a request for a copy of the data the export button does not cover, which is your expenses, your recorded payments, and your snapshots. That depends on one person acting on a request.
• Not done. There is no scheduled review of stored data, no automated audit that retention was applied, and no independent verification of any of it. It is one person and one server.

Getting a copy of your data

Your cards and accounts can be exported at any time from the Settings page or the Accounts page, as either CSV or JSON. The export is not gated behind email verification, and it is not gated behind anything else.

Your profile and your activity log are shown to you in the app. For a copy of anything the export button does not cover, including your expenses, your recorded payments, and your saved snapshots, write to the address below and it will be sent to you.

Deleting your account

Delete your account from the Settings page. You confirm with your password and by typing DELETE, so it cannot happen by accident. Deletion is never blocked, including when your email address is unverified. There is no cooling-off period and no way to undo it, so export your data first if you want to keep it. Leaving is always as easy as arriving.

Deleting immediately removes, in the same action:

• Your profile, including your encrypted email address, your password hash, your two-factor secret, and your settings
• Every card and account record
• Every expense
• Every payment you recorded
• Every bank connection, and Plaid is told to remove each connection at their end, so bank access genuinely stops rather than just disappearing from the screen
• Every sign in session
• Every saved snapshot
• Any outstanding verification link, password reset link, or bank call approval

One thing is handled differently, and you should know which:

• Your activity log is kept, and is deleted automatically two years after each entry was written. It holds a record that actions happened, including the deletion itself. It never held your card balances, your credit limits, your account numbers, or any token.

Backups taken before your deletion still contain your records until those backup files are replaced.

Correcting your data

Every card, account, expense, and setting can be edited or deleted directly in the app at any time. Values that came from your bank can be overridden by hand where your bank reports them wrongly or not at all. A payment recorded wrongly is fixed with a correction, which supersedes the original rather than erasing it.

Age

This service is meant for adults managing their own accounts. It is not directed at children. No age check is performed at sign up.

Changes to this policy

If this policy changes, this page and the date at the top change with it. This page also covers data retention and deletion, which used to live on a separate page.

Contact

Questions about your data, requests for a copy, and deletion requests all go to the same place.

thesiteteamapps@gmail.com