Privacy policy

1Who is responsible

Finantrix is a project developed and operated by Alejandro Abril. For any privacy matter, you can write to [email protected].

2What data we process

What we don't do

• We don't ask for or store full card numbers, PINs or bank credentials.
• We don't access your bank accounts or move money. Finantrix only records what you enter.
• We don't collect your location, your contact list or your browsing history. If you pick someone from your contacts when you create a loan, only that person's name and phone number are stored.
• We don't use advertising, commercial profiling or third-party analytics.

Google Wallet payments: how we receive that information

It's an optional feature so you don't have to log by hand what you pay with Google Wallet. This is how we protect what it reads:

• Only if you turn it on. It's off by default. It only works if you turn it on in Settings → Your money → Google Wallet payments and give Finantrix Android's “Notification access” permission. You can turn it off or remove the permission whenever you want; from that moment on, nothing else is read.
• Only Google Wallet. Android delivers the notifications of every app to the app; Finantrix discards, without reading them, the ones that don't come from Google Wallet. Your messages, emails and notifications from other apps are never opened.
• Only what's needed. From the Wallet notification we take the merchant, the amount and the last 4 digits Wallet shows, which belong to Wallet's virtual card, not to your card. Never the full number, the security code or passwords: Wallet doesn't show them in its notifications.
• It's processed on your phone. The notification isn't sent to our servers or to any artificial intelligence service, and the category suggested in Alerts comes from your own transactions, on the phone. If you open the payment with “Edit,” the form works just like when you log by hand: if it doesn't recognize the merchant, it may ask the AI for a category suggestion using only that name (section 4).
• Nothing is logged on its own. Each payment waits for your confirmation in Alerts on Home: you log it, edit it or discard it. Only what you log is saved as a transaction and synced with your account, just like any expense you enter.
• What stays on the phone. Payments waiting for confirmation, the cards you've already recognized, and a log of the last 30 Wallet notifications, so you can see what was read. They're kept in the app's private storage, aren't included in Android backups and aren't copied when you move your data to another phone. You can delete the log from the same screen.
• It's deleted when you sign out. When you sign out or sign in with another account, everything read from Wallet is deleted and the feature is turned off. “Delete all data” deletes it too. When you uninstall the app, it goes away with it.

Device permissions

• Camera: only to scan a partner's QR code, when you open it.
• Notifications: for the alerts you turn on in Settings.
• Notification access: only if you turn on “Google Wallet payments”; it's used only to read Google Wallet's notifications. You can remove it whenever you want in your phone's settings.
• Biometrics: to lock the app with your fingerprint or PIN. Biometric data is handled by Android; we never see it.

3Where it's stored

Your data lives on your device and, if you sign in, in a PostgreSQL database hosted on our own server that we manage directly (a self-hosted Supabase instance). Connections are encrypted with HTTPS/TLS, and access is restricted by row-level security rules: each user can only read their own rows and the ones a partner has explicitly shared with them.

4Artificial intelligence

Finantrix uses Gemini, by Google, in two places, and in neither of them are your balances or your email sent:

In the app: suggesting the category

When you type the description of a transaction, the app first looks on your phone for a category whose name matches. Only if it doesn't find one and you're signed in does it ask Gemini for a suggestion through our server.

In the WhatsApp and Telegram bots

The optional bots turn what you write — “spent 20k on lunch with Nequi” — into a transaction. Gemini is also used to understand that sentence.

• It's optional and you have to turn it on. The bots don't work until you link them with a one-time code generated from your account. If you never link them, none of this happens.
• We don't store the text sent to Gemini, from either the bots or the app. For each request, we only record how many tokens it used, how long it took and whether it failed, to keep track of the cost of the service.
• Google's processing is governed by its own Gemini API terms.

5Who it's shared with

We don't sell or transfer personal data. Only these third parties are involved, and only so the app can work:

• Google (Sign-in): when you sign in with Google, Google shares your email, name and photo with us.
• Google Play: if you sign up for the testing program, we add your email to the app's tester list in Play Console.
• Google (Gemini): processes the content of the messages you send to the bots and the descriptions the app can't categorize. See section 4.
• Firebase Cloud Messaging (Google): delivers push notifications. It receives the device token and the text of the notification.
• Meta (WhatsApp Business): only if you use the WhatsApp bot or left your number when you signed up for the testing program; Meta carries those messages. If you have WhatsApp's phone number privacy turned on, not even we can see your phone number.
• Telegram: only if you link the Telegram bot; in that case Telegram processes the messages you send it.
• Cloudflare: acts as an intermediary for the finantrix.cc website and sees the requests to those pages.
• Other people: when you share a loan or an account, the partner who accepts will see only that item and its transactions. Never the rest of your finances.

We may also disclose information if we are formally required to do so by law.

6How long it's kept

As long as your account exists. If you delete something in the app, it's removed from your device and from our servers at the next sync. If you delete your account, we delete everything (see section 8). Testing program sign-up data is deleted when the app is released to production, or sooner if you ask us. Feedback and its screenshots are deleted once we've dealt with them, after 12 months at most, or sooner if you ask us. We make a daily backup of the server to recover from failures; your data may remain in those backups for up to 30 days and then disappears on its own.

7Your rights

• Access and portability: you can export all your data from Settings → Export (JSON or CSV).
• Correction: you can edit or delete any record from the app.
• Deletion: see section 8.
• Objection and complaints: write to us and, if you're not satisfied, you can go to the data protection authority that applies to you.

8How to delete your data or your account

• Delete the content: in the app, Settings → Delete all data. It deletes your records from the device and from the cloud.
• Delete the entire account (including the associated email): in the app, Settings → Account → Delete my account, or on the web, in Settings → Data & sync. It's immediate. If you can't sign in, follow the instructions at finantrix.cc/delete-account and we'll process it within 30 days at most.

9Minors

Finantrix is intended for people aged 13 and over. It isn't directed at children under 13 and we don't knowingly collect their data: if we detect an account belonging to a child under 13, we'll delete it.

If you're between 13 and 17, you can use Finantrix with the authorization of your mother, your father or your legal representative, as required by Colombian data protection law (Ley 1581 de 2012 and Decreto 1377 de 2013, that is, Law 1581 of 2012 and Decree 1377 of 2013). We process your data only so the app can work and with respect for your rights: no ads, no profiling and no selling it. Your representative can ask at any time to see, correct or delete your data by writing to [email protected].

10Security

We use HTTPS/TLS on all connections, per-user isolation at the database level and an optional biometric lock in the app. What “Google Wallet payments” reads is processed on your phone and stays there until you log it (see the details). No system is infallible: if a breach affecting your data ever occurred, we would notify you by email.

11Changes to this policy

If we change it, we'll update the date at the top and, if the change is significant, we'll let you know inside the app.

12Contact

Questions, requests or complaints: [email protected].