Privacy Policy
Last updated: August 2026
1. Information We Collect
We collect the following information when you use AI Finance Tracker: • Account information: name, email address, password (hashed) • Financial data: income, expenses, budgets, savings goals you enter • Usage data: login times, features used, browser type • Analytics data: an anonymous visitor ID, a hashed (one-way) IP address, pages visited, device/browser type, referrer, and interaction events such as registrations, logins, or payment outcomes — used only to understand how the site is used. No financial data, passwords, payment credentials or other sensitive information is ever collected or stored as part of analytics. • Google account data (if you sign in with Google): name, email, profile photo
2. How We Use Your Information
We use your information to: • Provide and improve the Service • Generate AI-powered financial insights and predictions • Send budget alerts and notifications you request • Authenticate your account securely • Respond to support requests We do not sell your personal information, and the financial data you enter — your income, expenses, budgets and savings goals — is never shared with advertisers or used to target ads. The Service does display third-party advertising, which involves cookies set by Google and its partners. This is described in full in Section 6 below.
3. Data Storage & Security
Your data is stored in encrypted PostgreSQL databases hosted on Supabase (AWS ap-southeast-2 region). We use: • SSL/TLS encryption for all data in transit • Bcrypt hashing for passwords • JWT tokens for secure authentication • Regular security audits No system is 100% secure. Use a strong password and keep it private.
4. Data Sharing
We do not sell or trade your personal data. We share data only in these situations: • Service providers: Supabase (database), Vercel (hosting), Firebase (Google authentication) — each bound by their own privacy policies • Advertising partners: Google AdSense and its partners, which serve the advertisements shown on this site and receive technical data such as your IP address, browser type and cookie identifiers (see Section 6) • Google Fonts: fonts are loaded from Google's servers, which receive your IP address as part of that request • Legal requirements: if required by law or court order • Account protection: to investigate fraud or security threats The financial records you enter into the Service are never shared with advertising partners.
5. Google Sign-In
If you use "Sign in with Google", we receive your name, email, and profile photo from Google via Firebase Authentication. We do not access your Google Drive, Gmail, or any other Google services. Your Google data is governed by Google's Privacy Policy.
6. Cookies, Local Storage and Advertising
Our own use of storage is limited. We use browser localStorage to keep you signed in (JWT authentication tokens), to remember preferences such as your theme choice and your cookie consent selection, and to store an anonymous visitor ID used by our own analytics. We do not run Google Analytics, Facebook Pixel, or any third-party analytics tool. We do operate a lightweight, privacy-safe analytics system of our own to understand how the site is used. It records the pages you visit, your device and browser type, the referrer, and interaction events such as registrations, logins or payment outcomes. The visitor ID it uses is a random string with no connection to your identity. Your IP address is stored only as a one-way hash, not in raw form, and is never shown to anyone. No financial data, passwords, payment credentials, or other sensitive information is ever collected or stored as part of analytics. This analytics data is visible only to the site owner and is never shared with advertisers. However, this site is supported by advertising, and that advertising uses cookies. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet. These cookies are set by domains including google.com, doubleclick.net and googlesyndication.com, and the advertising partners may receive technical information such as your IP address, device type, browser and general location. We do not control these cookies, and we do not receive the financial or personal data they may collect.
7. Your Advertising Choices
You can opt out of personalised advertising at any time: • Google Ads Settings — turn off ad personalisation across Google's services: https://adssettings.google.com • Third-party vendors — opt out of many advertising vendors at once: https://www.aboutads.info/choices • Browser settings — you can block or delete cookies through your browser's privacy settings • Our consent banner — choose "Essential Only" when the cookie banner appears on your first visit • Changing your mind later — select "Cookie Settings" in the footer of any page to reopen the banner and replace your earlier choice at any time If you select "Essential Only" in our cookie banner, we stop loading Google's advertising script on this device, so no new advertising cookies are set by us. Cookies already stored in your browser are not removed automatically — you can clear those through your browser settings. Opting out through Google Ads Settings or aboutads.info does not remove advertising entirely. It means the ads you see will be less relevant to you. Blocking all cookies in your browser may also sign you out of the Service, since your login token is stored in the browser. We are based in Pakistan and our audience is primarily Pakistani. If you are visiting from the European Economic Area or the United Kingdom, please select "Essential Only" if you do not wish advertising scripts to load, and use the Google Ads Settings link above to manage personalisation across Google's services.
8. Your Rights
You have the right to: • Access all data we hold about you • Export your financial data (PDF/Excel) • Correct inaccurate data via Profile settings • Delete your account and all associated data • Withdraw consent at any time Contact jutthamid148@gmail.com to exercise these rights. In detail: you can download a copy of your records at any time from the Reports section without contacting us. To see what we hold beyond what is in the app — such as your account record and consent history — email us and we will respond within 30 days. To correct something, edit it in Profile settings, or ask us if it cannot be changed there. To delete your account and everything in it, use the delete option in Profile settings. Deletion is permanent and cannot be undone from our side, so please export anything you want to keep first. We delete your records within 30 days of the request, and backups containing your data are overwritten within a further 60 days. We will send a confirmation email once deletion has completed. Withdrawing cookie consent takes effect immediately and stops advertising and analytics scripts from loading. Choosing "Essential Only" in the cookie banner, or reopening it from "Cookie Settings" in the footer at any time, is how you do this. Some features may behave differently afterwards, because advertising and measurement are what the free plan is funded by.
9. Data Retention
We retain your data as long as your account is active. When you delete your account, your personal data is permanently deleted within 30 days. Aggregated, anonymized data may be retained for analytics. Specifically: account and financial records are kept while your account is open and deleted within 30 days of a deletion request. Backups are overwritten within 60 days after that. Analytics records held by Google are kept by Google under their own retention policy, not ours — you can limit that through your Google account settings. Consent records are kept while your account exists so we can show we acted on your choice.
9a. International Transfers
Our service providers store data outside Pakistan. Supabase, Google (Firebase and Analytics), Vercel and AdSense operate servers in other countries, including Australia, the United States and the Netherlands. This means your data — including your name, email address and the financial records you enter — may be transferred to and processed in those countries. Each provider is bound by its own privacy policy and, where applicable, standard contractual clauses. If you are unhappy about that, please tell us before using the service; we cannot offer a data-residency guarantee, and we would rather be upfront about it than imply the data never leaves Pakistan.
9b. Security Incidents
If we discover a breach that affects your data, we will tell you and the relevant authority as required by law, without undue delay, describing what happened, what data was involved, and what steps you should take. We will not claim an incident had no impact when we do not yet know the scope. Given that this is a small project, you should also assume that an account compromise is visible to you sooner than to us — checking your own records periodically is a reasonable precaution.
10. Children's Privacy
AI Finance Tracker is not intended for users under 13 years of age. We do not knowingly collect data from children. If you believe a child has provided us data, contact us immediately.
11. Changes to Privacy Policy
We may update this Privacy Policy periodically. We will notify you of significant changes via email or in-app notification. Continued use after changes constitutes acceptance.
12. Contact Us
For privacy concerns or data requests: Email: jutthamid148@gmail.com AI Finance Tracker