FINLOG Privacy Policy

1. Introduction, Scope & Architectural Philosophy

FINLOG (referred to herein as "FINLOG", "we", "us", or "our") provides personal finance management software designed to give users comprehensive command over their personal financial records, budgeting, cash allocations, statement reconciliation, and financial insights.

This Privacy Policy applies to the FINLOG mobile software application, the official website (https://finlog.app), and related technical services.

Our Architectural Commitment: FINLOG is engineered as a local-first application. Unlike traditional financial management services that centralize raw financial transactions on remote company databases, FINLOG keeps your financial records—including transactions, balances, Money Spaces, budgets, and physical cash amounts—on your personal device inside an authenticated, encrypted vault.

However, local-first does not mean the application remains entirely disconnected from the internet. Certain non-financial services—specifically identity authentication, server-side AI model requests via FINAI, optional encrypted vault backups, and anonymous diagnostic crash monitoring—utilize secure internet services as explicitly detailed below.

2. Categories of Information Processed

We strictly partition information into two separate categories: Device-Only Financial Data and Online Account / Telemetry Data.

3. Account Registration & Authentication Information

To use FINLOG's authenticated features and protect against unauthorized access to your on-device ledger, users authenticate via Clerk (Clerk Inc.), our identity infrastructure provider.

• Supported Sign-In Providers: Apple Sign In (native iOS sheet), Google Sign In, and direct Email/Password authentication.
• Authentication Tokens: Upon successful authentication, your device receives a signed JSON Web Token (JWT) issued by Clerk. This token is stored in the device's secure keychain using Expo SecureStore.
• Data Collected by Clerk: Clerk processes your email address, authentication timestamps, IP address, and provider identifier in accordance with Clerk's privacy practices.
• Decoupled Ownership: Your Clerk User ID (sub claim) acts as the cryptographic namespace identifier for your local encrypted financial partition. A signed-in account can only decrypt records matching its verified owner ID.

4. Financial Records Stored Locally on Your Device

Your financial records are stored on your local device storage (AsyncStorage) solely as authenticated ciphertext, never as plaintext JSON.

• Vault Encryption: Vault snapshots are sealed with AES-256-GCM. On iOS and Android devices, the 256-bit symmetric key is generated via Expo Crypto and stored in Expo SecureStore with the policy WHEN_UNLOCKED_THIS_DEVICE_ONLY.
• On-Device Statement Parsing: When you import MTN Mobile Money or Telecel Ghana statements (PDF or XLSX), parsing occurs entirely on your device. Personal Identifying Information (such as sender phone numbers and full recipient names) is sanitized locally before transactions are recorded into your ledger.
• Loss of Keys: Because encryption keys are stored on your device, clearing device data, uninstalling the app, or losing your hardware device will render local records permanently unrecoverable unless you have performed a manual export or maintained an encrypted cloud backup.

5. AI Interactions & Information Sent to FINAI Online Services

FINLOG includes an optional AI financial copilot named FINAI. FINAI utilizes large language model inference (via Grok by xAI and Groq Cloud) to answer your financial questions.

Specifically, an AI request transmits only:

1. Your prompt text (e.g., "Can I afford dinner tonight?").
2. Recent conversation history within the current active session.
3. A sanitized summary context containing: the active currency code (e.g. GHS), the time window (day, week, month), and a dictionary of numerical facts (e.g. food_budget_remaining: 42000).
4. An explicit boolean consent marker (consent: true). If consent is revoked or not granted, no network request is dispatched.

Hallucination Defense: Responses from FINAI utilize token placeholders (e.g., {{fact_key}}) that are substituted locally with deterministic client calculations, guaranteeing that numerical advice is grounded in your actual numbers.

Quota Metering: Server-side requests are authorized via Supabase RPC (finlog_ai.claim_request), strictly enforcing rate limits (5 requests/minute, 25 requests/day) to prevent denial-of-service and unauthorized quota depletion.

6. Subscription & Purchase Processing

Clarification of In-App Features vs Billing: The "Subscriptions" screen within FINLOG is an on-device personal expense manager designed to help you track recurring household services (such as streaming plans, gym memberships, and rent). It is stored on your device and does not represent a paid billing agreement with FINLOG.

App Store In-App Purchases: Future premium tiers (such as FINLOG Pro) will be billed exclusively through Apple's App Store StoreKit infrastructure. Apple processes payment credentials, billing addresses, and tax collection directly. FINLOG will never collect or store credit card numbers or banking credentials.

7. Device Diagnostics, Analytics & Crash Reporting

To maintain reliability and diagnose software defects, FINLOG incorporates Sentry (Functional Software, Inc.) and LogRocket (LogRocket, Inc.).

• Automated Privacy Scrubbers: Sentry telemetry is filtered by client-side privacy hooks (src/config/sentry.ts). All monetary amounts, transaction descriptions, account numbers, and personal email addresses are stripped from error payloads, breadcrumbs, and exception messages prior to network transmission.
• Opt-In / Opt-Out: Users can disable diagnostic telemetry at any time within the application under Settings ➔ Privacy ➔ Telemetry & Diagnostics.

8. Third-Party Service Providers

We engage the following third-party infrastructure processors to deliver specific app functions:

• Clerk Inc. (USA): User identity management, session tokens, and multi-factor authentication.
• Supabase Inc. (USA / AWS): Server-side AI quota counter verification and encrypted vault envelope storage (zero-knowledge ciphertext).
• Groq Inc. & xAI LLC (USA): LLM inference for FINAI queries. Operates under zero-data-retention agreements for API endpoints.
• Functional Software Inc. (Sentry, USA): Crash reporting and performance monitoring with strict financial data scrubbers.
• LogRocket Inc. (USA): Session replay for error diagnostics with text masking enabled.
• Sanity AS (Norway): Delivery of static editorial articles and currency metadata. Does not process financial records.
• Cloudflare Inc. (USA): Global edge distribution, CDN caching, and DDoS mitigation for our public web portal.

9. Data Storage, Retention & Cloud Backup

Local Data: Retained on your device indefinitely until you perform an explicit local data wipe or delete the application.

Encrypted Cloud Backups: If you activate Cloud Backup, your encrypted vault envelope (ciphertext, IV, salt, and SHA-256 checksum) is retained in Supabase Storage until you overwrite it with a new backup or delete your cloud account.

AI Quota Records: Daily query counters in public.finlog_ai_usage are retained for 30 days for billing fraud prevention and service stability auditing, after which they are automatically pruned.

10. Cryptographic Security Practices

FINLOG implements defense-in-depth cryptographic controls:

• Vault Encryption: AES-256-GCM authenticated cipher with 96-bit unique initialization vectors (IVs).
• Key Derivation: PBKDF2 with HMAC-SHA256 and 100,000 iterations for cloud vault passphrases.
• Hardware Isolation: Hardware-backed Secure Enclave / KeyStore utilization via Expo SecureStore.
• Transport Security: Strict TLS 1.3 encryption across all public network endpoints with HSTS preloading.

11. User Access, Export & Deletion Rights

You have full ownership of your data. FINLOG provides built-in mechanisms to exercise your rights:

• Data Portability & Export: Export your complete financial history at any time as RFC 4180 compliant CSV files or structured JSON envelopes via Settings ➔ Data Management ➔ Export.
• Two-Tier Deletion Safety: In Settings ➔ Account ➔ Delete Account, you are presented with two distinct choices:
  1. Keep Data on Device: Deletes your online Clerk identity and Supabase AI quotas, but preserves your encrypted financial records on your device for offline use.
  2. Permanently Wipe Everything: Atomically deletes your online identity, cloud backups, and executes a cryptographic wipe of all local device vaults and encryption keys.

12. Offline Access vs Network-Dependent Features

FINLOG is fully functional offline for core accounting tasks: adding expenses, creating Money Spaces, calculating balances, viewing charts, and importing local PDF statements.

Features requiring an active network connection include: initial sign-up and sign-in, FINAI online inference, and cloud vault backup/restore. If you lose internet connectivity, your local records remain accessible.

13. Data Sharing & Non-Disclosure

We do not sell your personal or financial data. We have never sold, rented, or monetized personal information, transaction history, or financial balances to data brokers, advertising networks, or third-party financial institutions.

14. International Data Transfers

If you access FINLOG from outside the United States, please note that third-party infrastructure providers (Clerk, Supabase, Cloudflare) operate servers located primarily in the United States and the European Union. Transfers are protected under standard contractual clauses (SCCs) and robust cryptographic controls.

15. Children's Privacy

FINLOG is intended for individuals who have reached the legal age of majority in their jurisdiction (generally 18 years of age or older) and are legally capable of entering into binding contracts and managing personal finances. We do not knowingly collect personal data from children under 16 years of age.

16. Policy Amendments

We may update this Privacy Policy from time to time to reflect modifications in application architecture, legal standards, or feature expansions. When revisions are published, we will update the "Last Updated" date at the top of this document. Material changes will be communicated via in-app notifications or registered email notice.

17. Contact Information & Privacy Requests

To exercise your privacy rights, request data clarification, or submit a data protection inquiry, please contact our Data Protection Officer:

18. Revision History & Document Metadata

Version: 1.0.0 (Production Release)
Effective Date: October 21, 2026
Document Identifier: FINLOG-PRIVACY-POL-2026-V1