Privacy policy

1Who we are and what this covers

FinBuddee ("FinBuddee", "we", "us") provides the FinBuddee: Family Finance app for Android, the website finbuddee.com, and the services behind them. FinBuddee is a financial organization tool. It is not a bank and does not hold, transfer, or control your money.

FinBuddee is the data fiduciary (controller) for the personal data described here. You can reach us at finbuddee@gmail.com.

2Free and Premium: where your data lives

Where your financial data is stored depends on your plan.

• Free plan: FinBuddee reads transaction SMS and parses them on your phone. Your accounts, transactions, and categories are stored encrypted on the device and are not uploaded to FinBuddee.
• FinBuddee Premium: your financial records are stored in FinBuddee's cloud, hosted on Microsoft Azure in India, so they can sync across your devices and be shared with your family group. Gmail and statement imports, family sharing, and AI-assistant access are Premium features.
• When you upgrade from Free to Premium, the app uploads the records stored on your phone to your Premium cloud space.

3Information we process

We process the following information, depending on which features you use.

• Account information: when you sign in with Google, we receive your name, email address, Google account identifier, and profile photo link. Sign-in is required to use the app.
• Device and session information: a random installation identifier, sign-in session records, and the app version, used to keep you signed in and protect your account.
• Transaction SMS: with your permission, the app reads SMS from bank, card, and payment senders to detect transactions. On the free plan these are processed on your phone. With Premium, transaction messages are uploaded so our servers can parse them and detect duplicates.
• Message-format templates (free plan): when you resolve a message the app could not read, it may send us an anonymous template of the message's format, with amounts, dates, numbers, names and other details replaced, together with the bank's sender code. Templates are not linked to your account or device.
• Gmail data (Premium): if you connect Gmail, we access your mailbox with Google's read-only permission to find transaction emails, such as receipts, bank notifications, and statement attachments, and extract transaction details from them.
• Statements (Premium): bank and credit-card statement files you upload, and the transactions extracted from them.
• Financial records you create or that we extract: accounts, balances, transactions, categories, and your corrections.
• Family information (Premium): your family group, its members and their roles, and invite codes.
• Subscription information: the product, purchase token, status, and renewal dates we receive from Google Play. Google Play processes your payment; we never receive your card or UPI details.
• AI assistant connections (Premium): which AI apps you have authorized, when they connected, and a record of the requests they made.
• Support and issue reports: what you choose to send us, including any message details you attach to an issue report.
• Usage analytics: app events such as screens viewed, features used, and coarse errors, linked to a pseudonym of your account rather than your name or email. We do not collect amounts, merchant names, account numbers, or message contents in analytics, and IP addresses are discarded.
• Crash reports: technical details about app crashes and failed requests, with personal details redacted. Crash reports use a random per-install identifier and are not linked to your account.

4Android permissions

FinBuddee asks for SMS permissions (READ_SMS and RECEIVE_SMS) only after explaining why, and only to find bank, card, and payment transaction messages. You can use the app without granting them and add transactions manually instead. You can withdraw SMS access at any time in Android settings; the app then stops reading new messages.

FinBuddee does not request access to your contacts, location, camera, microphone, or photos.

5How we use information

We use information only to:

• Provide the app: detect, parse, categorize, and de-duplicate transactions, identify transfers, and show your spending, income, and accounts.
• Provide Premium features: cloud sync, Gmail and statement imports, family sharing, notifications, and AI-assistant access.
• Manage your account and subscription, and keep the service secure, including detecting abuse.
• Improve parsing so FinBuddee can read more bank formats.
• Understand which features are used and fix problems, using pseudonymous analytics and crash reports.
• Respond to support requests and meet legal obligations.

6Automated and AI processing

FinBuddee first reads messages with its own parsing rules. With Premium, when those rules cannot read a message, its text may be sent to an AI language model hosted on Microsoft Azure OpenAI Service in India to extract the transaction details. The model only returns the extracted details. Under Microsoft's terms, this data is not used to train its models.

Categorization, duplicate matching, and transfer detection are automated and can be wrong, so you can review and correct them in the app.

7Google user data

FinBuddee's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use Gmail data only to provide the transaction-import feature you turned on. We do not use it for advertising, do not sell it, and do not use it to train general-purpose AI models. People at FinBuddee do not read it unless you ask us to (for example, to investigate an issue you report), it is needed for security, or the law requires it.

You can disconnect Gmail in FinBuddee's settings, or remove FinBuddee from the third-party connections in your Google Account.

8Service providers and sharing

We do not sell your personal data and we do not show ads. We share information only in these cases:

• Microsoft Azure (India): hosting, database storage, and AI parsing for FinBuddee's services.
• Google: Google Sign-In, the Gmail API if you connect Gmail, and Google Play for app distribution and subscription billing.
• PostHog (United States): pseudonymous product analytics and redacted crash reports.
• Cloudflare: hosting and network delivery for finbuddee.com.
• Your family group (Premium): members of a family group you create or join can see the family's shared financial information in the app.
• AI assistants you connect (Premium): AI apps you authorize can read your FinBuddee financial data, read-only, until you revoke them. They cannot read raw SMS, email, or statement contents, or full account and card numbers. What those apps do with the data is governed by their own policies.
• Legal requirements: when required by law, or to protect the rights, safety, and security of our users or FinBuddee.

9Storage and security

Free-plan financial data is stored encrypted on your phone, and app credentials are protected by the Android Keystore. Premium data is stored on Microsoft Azure in India, is encrypted in transit and at rest, and access is restricted to your account, your family group, and apps you authorize. Analytics and crash reports are processed by PostHog in the United States.

We use access controls and monitoring to protect your data, but no system is completely secure. Keep your Google account and phone protected, and tell us immediately at finbuddee@gmail.com if you suspect unauthorized access.

10How long we keep information

We keep information only as long as needed for the purposes above:

• Account information and Premium cloud data: for as long as your account exists. If Premium lapses, your cloud data stays available to you read-only until you delete your account.
• Gmail access: until you disconnect Gmail or delete your account.
• Data uploaded while moving from Free to Premium: temporary migration records are removed 15 days after the upload is verified.
• AI assistant request records: 90 days.
• Analytics events: up to one year.
• Database backups: overwritten within 35 days, so deleted data disappears from backups within that time.
• Message-format templates: kept to maintain parsing rules; they are not linked to any account.
• Records we must keep by law, such as subscription billing records, are kept only for the period the law requires.

11Your choices and rights

You can view and correct your financial records in the app; withdraw SMS permission in Android settings; disconnect Gmail; revoke connected AI apps; leave a family group; and delete your account and data.

Subject to applicable law, including India's Digital Personal Data Protection Act, 2023, you can ask us for a summary of the personal data we process, ask us to correct or erase it, withdraw consent, nominate someone to exercise your rights if you die or become incapacitated, and raise a grievance. Email finbuddee@gmail.com and we will respond within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

12Children

FinBuddee is meant for adults. You must be 18 or older to use it, and we do not knowingly process children's data. If you believe a child is using FinBuddee, contact us and we will delete their account.

13Changes to this policy

We will update this policy when FinBuddee's data handling changes and revise the "Last updated" date. For significant changes, we will also notify you in the app before they take effect.