1. Who operates the service
Finance Manager is operated by ImMasonxd. Privacy, access and account-deletion questions can be sent to mason@immasonxd.dev. Additional operator identification may need to be added before a commercial public launch where required by applicable law.
2. Data we process
We process information needed to run Finance, including your name, email address, profile picture, account settings, household membership, income, expenses, planned payments, savings, categories, notes and other information you enter. We also process technical and security information such as login timestamps, IP addresses associated with login attempts, device/browser information, session tokens, MFA data and information required for passkeys and push notifications.
3. Why we use the data
We use the data to provide budgeting features, synchronize household data, authenticate and secure accounts, deliver requested notifications, prevent abuse, troubleshoot failures and verify the technical integrity of financial calculations. We do not use your financial data for advertising or third-party profiling.
4. Shared households
If you join a shared household, records marked as shared may be visible to other active members. Visibility depends on the household settings and the scope of the individual record. Consider who has access before entering sensitive text in merchant names or notes.
5. Integrity checks and diagnostics
Finance performs automated financial-integrity checks. If totals or database relationships do not match expected rules, the application may create an internal diagnostic record and email a technical alert to the operator at mason@immasonxd.dev. Diagnostics may contain numeric household/user IDs, the budget period, aggregate financial totals, record counts, application/PHP/database versions, timestamps, request path and a request identifier. They intentionally exclude names, email addresses, merchant names, transaction notes, passwords, MFA codes, authentication tokens, push endpoints and private cryptographic keys.
6. Passkeys, MFA and push notifications
Passkeys use WebAuthn. Finance stores only the public credential information and metadata needed for verification, not the device's private key. Email MFA creates short-lived one-time codes and security records. If you enable push notifications, Finance stores the technical subscription data needed to deliver notifications through your browser or platform push infrastructure.
7. Service providers and recipients
Hosting and email infrastructure providers may process data where necessary to operate the service. If push is enabled, the relevant browser/platform push provider participates in delivery. Finance does not sell data to advertisers and does not use third-party advertising or behavioral analytics services.
8. Retention
Financial and account data is kept while your account or household exists unless you delete it. Short-lived authentication tokens and MFA codes expire automatically. Login-attempt records and resolved integrity incidents are periodically removed after approximately 90 days; older read notifications may be removed after approximately one year. Hosting backups may retain earlier copies for a limited backup-retention period.
9. Export and account deletion
Settings → Data & privacy lets you export transactions as CSV, download account data as JSON, and download a full Finance archive containing structured JSON plus CSV copies of available financial data. Security secrets such as passwords, authentication tokens, MFA codes, push secrets and private passkey cryptographic material are excluded. You can also delete your account. A household owner can transfer ownership to another active member or permanently delete the entire household. Deleting a household removes its financial data for all members; deleting an account removes or anonymizes personal account data while shared household records may remain anonymized so other members retain their shared history.
10. Your rights
Depending on applicable data-protection law, you may have rights to information, access, rectification, erasure, restriction, portability and objection, and to withdraw consent where processing relies on consent. Requests can be sent to mason@immasonxd.dev. You may also lodge a complaint with the competent data-protection supervisory authority.
11. Security
We use measures including HTTPS, secure session cookies, CSRF protection, hashed passwords and tokens, optional MFA, passkeys, login throttling and separation of sensitive secrets. No online system can be guaranteed to be absolutely secure.
12. Changes
We may update this policy when features, infrastructure or legal requirements change. Material changes will be published in the application or on this page.