Privacy Policy

Last updated: October 2026

Introduction

PersonalFinance ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our personal finance web application (the "Service").

Please read this privacy policy carefully. By accessing or using our Service, you signify that you have read, understood, and agree to be bound by this policy.

Information We Collect

Account Information

When you create an account, we collect:

  • Email address
  • Password (stored securely using hashing)
  • Account creation date

Financial Data You Enter

The core of our Service involves storing your personal financial information. We collect and store the data you voluntarily enter, including:

  • Budget categories and monthly budget plans
  • Budget transactions and spending records
  • Savings goals and targets
  • Money Priorities answers (your extra monthly amount and your answers about debt, emergency fund, employer match, time horizon, age range and contribution limit) and the optional Purpose you write, and the Purpose Note written for it, which is stored with that result
  • Net worth parameters (assets, liabilities, income, expenses)
  • User budget allocations and source preferences

Google Drive Integration Data

If you connect your Google Drive account, we store:

  • Google Drive connection metadata
  • Spreadsheet budget snapshots imported from your Google Sheets
  • Spreadsheet transaction records
  • Cached file information from Google Drive

Community Content

If you participate in community features, we store:

  • Community stories and posts
  • Comments on community posts
  • Poll votes and likes

Usage Data

We collect:

  • Saved articles
  • Notification preferences and history

Third-Party Services

We use the following third-party services that may process your data:

Google Drive and Sheets API

If you connect your Google Drive, we use the Google Drive and Sheets API (googleapis.com) to read your spreadsheets. Your Google API key is used to authenticate these requests.

Google Fonts

We load fonts from Google Fonts (fonts.googleapis.com). This service may collect your IP address. See our Cookie Policy for details.

unpkg CDN

We load the Lucide icon library from unpkg.com. This is a third-party content delivery network.

Brevo (Transactional Email)

We use Brevo to send transactional emails, such as account confirmation. Brevo processes your email address for delivery purposes.

Azure Hosting

Our application is hosted on Microsoft Azure. Your data is stored in Azure SQL Database. Azure may be located in the United States.

AI Chat Widget

Our Service includes an AI-powered chat feature. Interactions with this feature may be processed by a third-party AI provider. Do not share sensitive financial details in the chat.

OpenAI (Money Priorities Purpose Note)

When you give a Purpose in Money Priorities, we send that Purpose with your answers, the path through the Priority Tree and the computed figures to OpenAI to write a short Purpose Note. Nothing is sent when you leave the Purpose empty. The note is stored with that result.

How We Use Your Information

  • Provide, maintain, and improve the Service
  • Process your financial data and generate projections
  • Send you transactional emails (account confirmation, etc.)
  • Import data from your connected Google Drive spreadsheets
  • Respond to your support requests

Data Retention and Deletion

When you delete an item in our Service, such as a transaction or a savings goal, it is hidden from you but stays in our database while your account exists. This protects you from accidental loss. Deleting your account removes these items for good, as described below.

Deleting your account

You can delete your account yourself on the Personal data page in your account settings, by confirming with your password (or by typing DELETE if you sign in with Google only).

  • Straight away: your data is hidden, you are signed out, and you can no longer sign in. We email you a link to cancel the deletion.
  • For 30 days: you can cancel with that link. Your account and your data are restored exactly as they were.
  • Within 31 days of your request: we permanently delete your account and all of your data, including items you had deleted earlier. The deletion runs once a day after the 30 days end.
  • Community posts: stories and comments you published stay visible, shown as written by "Deleted User", with nothing that links them to you. Stories and comments you had already deleted are removed, and your likes and poll votes are deleted.
  • What we keep: only a record that an account deletion was requested and when it was completed, with nothing that identifies you.
  • Backups: our database provider keeps automatic backups for up to 7 days, so deleted data disappears from backups within 7 days after the deletion.

Downloading your data

On the same Personal data page, Download my data gives you a copy of everything your account holds, as a JSON file that other apps can read. Downloading never changes your data.

Your GDPR Rights

If you are located in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation (GDPR):

  • Right of Access: Request a copy of your personal data
  • Right to Rectification: Correct inaccurate or incomplete data
  • Right to Erasure: Request deletion of your personal data ("right to be forgotten")
  • Right to Data Portability: Receive your data in a machine-readable format
  • Right to Object: Object to the processing of your personal data
  • Right to Restriction: Request restriction of processing

You can exercise your rights of access, portability and erasure yourself on the Personal data page: download your data, or delete your account (see "Deleting your account" above). For any other request, please contact us using the details on our Contact page.

International Data Transfers

Your data is stored on Microsoft Azure servers, which may be located in the United States. If you are outside the United States, your data will be transferred across borders. We rely on appropriate safeguards, such as Standard Contractual Clauses, to ensure your data remains protected.

Data Security

We use industry-standard security measures to protect your data, including encrypted connections (HTTPS), password hashing, and access controls. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

Children's Privacy

Our Service is not intended for children under 16. We do not knowingly collect personal data from children under 16. If we learn we have collected data from a child under 16, we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy, please contact us via our Contact page.