Privacy Policy

This Privacy Policy explains what information FinnLion collects, how we use it, and the choices you have. It applies to the FinnLion web app and mobile apps (together, the "Service"). We built FinnLion to hold sensitive financial information, so we've kept what we collect to what the Service actually needs, and we don't sell your data or use it for advertising.

1. Information We Collect

Account information

Your name and email address, and either a password (stored as a one-way bcrypt hash — we never see or store your actual password) or, if you sign in with Google, your Google account identifier. If you sign in with Google, we ask Google to verify your identity directly; we don't receive your Google password.

The financial data you enter

Budgets, invoices, estimates, customers, bills, debts, mileage trips, categories, and any notes or documents (like receipts) you attach to a transaction. This is stored so the Service can show it back to you across sessions and devices.

Bank account data (only if you connect one)

If you link a bank account, we use Stripe Financial Connections to read your account balances, institution name, and transaction history, and store that so it appears in your Transactions, Reports, and Dashboard. We never receive or store your online banking username or password — authentication happens directly between you and your bank through Stripe's connection flow. You can disconnect a bank account at any time, which stops future syncing.

Your own Stripe key (only if you connect it)

If you choose to accept online payment on invoices, you can paste your own Stripe secret key into Settings. It's encrypted at rest (AES-256-GCM) and used only to generate payment links on your invoices — it's unrelated to, and stored separately from, the bank-connection data above.

Google Calendar data (only if you connect it)

If you choose to connect Google Calendar, the Service reads your calendar list and event titles/dates directly from Google, live, each time you view the Calendar page, so they can appear alongside your bills and invoice due dates. We don't keep a persistent copy of your calendar events on our servers.

Usage & device information

Sign-in timestamps, session cookies (to keep you signed in), and basic technical data (like IP address, handled through our rate-limiting and security logging) used to keep the Service secure and reliable.

2. How We Use Information

• To provide the Service — storing and displaying your budgets, invoices, transactions, and other data across your sessions and devices;
• To operate features you turn on, like bank sync, invoice payment links, and calendar display;
• To send you service email — verification links, password resets, security notices, and, when you use the feature, invoices and estimates on your behalf;
• To secure the Service — detecting abuse, enforcing rate limits, and investigating suspicious activity;
• To estimate our own operating costs (for example, how many bank-refresh calls or emails an account generates) — this uses aggregate counts, not the content of your financial data;
• To improve the Service and fix problems.

3. Who We Share Information With

We don't sell your information, and we don't share it for third-party advertising. We share it only with:

• Service providers who help us run FinnLion — Stripe (bank data aggregation and, if you use it, invoice payment processing), Google (sign-in and, if you connect it, Calendar), Resend (sending transactional email on your behalf), and our hosting and database providers. Each only receives what it needs to perform its function, under its own privacy terms.
• Your own customers — only what you choose to put on an invoice, estimate, or public share link you create and send.
• Our own team, for account administration only — whoever administers FinnLion can see account-level usage information (sign-up and login dates, number of connected accounts, transaction and email counts, verification status) to run the Service and estimate costs. Administrators do not have access to your budgets, invoices, customers, categorized transactions, or any other financial content you've entered — that boundary is enforced in how the Service is built, not just a policy.
• Legal or safety reasons — if required by law, subpoena, or other legal process, or to protect the rights, property, or safety of FinnLion, our users, or the public.
• A business transfer — if FinnLion is involved in a merger, acquisition, or sale of assets, your information may transfer as part of that deal, subject to this Policy or a successor policy you're notified of.

4. How We Protect Your Information

• Passwords are hashed with bcrypt and never stored in plain text;
• Your own Stripe key (if you add one) is encrypted at rest with AES-256-GCM;
• Data is encrypted in transit (HTTPS/TLS);
• Security headers, cross-site request forgery protection, and rate limiting are applied across the Service;
• Bank account access can only happen after you've verified your email address.

No method of storage or transmission is 100% secure, and we can't guarantee absolute security — but we've built the Service specifically around minimizing what's stored, and encrypting what's sensitive.

5. Data Retention & Deletion

We keep your information for as long as your account is active, so the Service can function. You can permanently delete your account at any time from Settings. Doing so disconnects any linked bank account at Stripe and deletes your app data, transactions, invoices, and everything else tied to your account from our systems. This can't be undone.

We may retain limited records where required by law or to resolve disputes, prevent fraud, or enforce our agreements, even after account deletion.

6. Your Choices & Rights

You can review and edit most of your information directly in the Service, disconnect a bank account or Google Calendar at any time, revoke a public invoice/estimate link at any time, and delete your account (and all associated data) at any time from Settings.

Depending on where you live, you may have additional rights over your personal information — for example, to access, correct, or request deletion of it, or to object to certain processing — under laws such as the California Consumer Privacy Act or the EU/UK GDPR. To exercise any of these rights, contact us at shayalieberman@gmail.com.

7. Children's Privacy

FinnLion isn't directed at, and isn't intended for use by, anyone under 18. We don't knowingly collect information from children.

8. Where Your Data Is Stored

FinnLion's servers and database are hosted in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States.

9. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you in the app.

10. Contact

Questions about this Policy, or want to exercise a privacy right described above? Contact us at shayalieberman@gmail.com.