Privacy Policy

1. Introduction

Finvygo is a wealth tracking service: tracking is free, and the paid Premium plan adds features to it. This policy explains what data we process, where it is hosted, who can access it, and how to get it back or delete it. It applies to the mobile app as well as the website.

2. No connection to your accounts

Finvygo works on a declarative basis: you enter your own assets. The app does not connect to any bank, any broker or any exchange platform. We use no bank aggregator and never ask you for your banking credentials, or those of your broker or exchange. We therefore have no access to your accounts, neither read nor write. If you import a file exported from your broker, it is read on your device, and only the lines it recognizes are sent to us to create your positions.

3. Data we collect

What we hold depends on the sign-in method you choose:

• Private key sign-in: no name and no email address. We keep only a cryptographic fingerprint of your key, never the key itself. One exception: if you buy Premium on the website, the payment page asks you for an email address. It is kept by our payment providers, RevenueCat and Stripe, and is never saved in your Finvygo account. It remains linked to your account through your billing identifier, however, and we can look it up at RevenueCat, for example to answer a support request.
• Email sign-in: your email address, used only to find your account and send you your sign-in codes.
• Google or Apple sign-in: the account identifier passed on by the provider and the associated email address.
• In every case: what you enter (assets, quantities, purchase prices, notes, public crypto wallet addresses, price alerts, messages sent to support) and your preferences (language, currency, tax residency, time zone, notification settings).
• Audience and performance measurement, without cookies, on the website as well as in your signed-in area: page viewed, referrer, device type, browser, country and loading time. Our provider derives a technical fingerprint from the request, renewed every 24 hours, which can neither identify you nor follow you from one site to another.
• On every file import: technical information about the attempt (platform, number of rows and columns, detected separators, step reached, institution name if you enter it) and, for a file we don't recognize yet, its column names with their type and shape (decimal separator, thousands grouping), never its content nor the value of your quantities or amounts, so that this broker can be recognized automatically in the future. These column names and the type of each column are also read by an AI (Claude, by Anthropic) to suggest how your columns match.
• If you allow notifications on your phone: the device notification token, its platform (iOS or Android), the language and the app version.
• If you use Premium: your access rights (trial, six free months, subscription, lifetime access) and their dates. The first time you open the subscription screen, or as soon as the message announcing the end of your trial or of your six free months is due to appear, we also create a random billing identifier, which contains neither your email nor your account identifier. Added to this are your purchase history, read from RevenueCat, and, if you followed a partner's link or entered a partner's code, the partner your account is attached to.
• What we calculate for you: your wealth history and your daily, weekly and monthly recaps, whose figures are frozen at the time they are calculated. The first recap of each type can be read in full on every account; for the following ones, the change in your quoted assets over the period can be read on every account, and the details with Premium. The daily recap is kept for 30 days, the weekly recap for 8 weeks and the monthly recap for 12 months.
• How you use the service: start and length of your sessions, device, system and app version, onboarding steps, your answer to "How did you hear about Finvygo?", and the asset searches you run, with the result you chose.
• If you use the AI assistant: the date of your consent, your monthly question count and, for each question, metadata without content (notably: date, language, platform, outcome of the question, tools consulted, suggestion chosen, advice category detected, number of tokens, duration, estimated cost, your optional helpful or unhelpful feedback), kept for 13 months, with your account identifier removed after 35 days. Finvygo keeps neither your questions nor the answers, apart from a copy of the answer kept for two minutes at most to hand it back to you after a dropped connection, unless you report an answer: the question and the answer are then sent to the team, without any identifier, and deleted after 90 days.

4. How we use your data

Your data is used solely to run the service:

• Calculate, revalue and display your net worth
• Adapt the product catalog to your country of tax residence
• Send you your sign-in codes and the notifications tied to the service: price alerts, recaps, reminders about the end of a trial and subscription renewals
• Diagnose failures and improve the app
• Sell and manage the Premium subscription (purchase, renewal, cancellation, withdrawal), and calculate the commission owed to the partner who introduced you to Finvygo
• Answer the questions you ask the AI assistant, if you use it, and suggest, when you import a file, how to match unrecognized columns and securities

5. The legal basis for all this

The General Data Protection Regulation requires us to justify every processing operation. Here are ours:

• Performance of the contract between us: creating your account, recording your assets, revaluing your wealth, sending you your sign-in codes and the notifications you asked for, suggesting how to match columns and securities when you import a file, and providing Premium if you are entitled to it or buy it, including the AI assistant's answers. Without this data, the service cannot work.
• Legitimate interest: diagnosing outages, protecting the service against abuse, measuring audience and usage in aggregate, measuring the AI assistant's quality through metadata without content, handling the answers you report to us, and attributing to a partner the commission on a sale they brought in. You can object to this at any time.
• Legal obligation: keeping the accounting records of Premium purchases made on the website, where we are the seller. They are kept on our behalf by our payment providers.
• For the AI assistant, the basis is the performance of the contract (first point). The consent we ask for before your first question, after telling you that your data is sent to Anthropic, is not a legal basis: it is a permission you can withdraw at any time in the settings, which turns the assistant off for your account.

6. Where your data is hosted

Our database and application server run in Amsterdam, in the Netherlands. The website is rendered from Paris, in France. Your wealth data is stored in the European Union. The data needed for the AI assistant's answers, if you use it, and for the AI help when importing files is processed and temporarily kept by Anthropic, in the United States. Some providers process data outside the European Union: see "Transfers outside the European Union".

7. Transfers outside the European Union

The data of your account and your wealth is stored in the European Union; the data needed for the AI assistant's answers, if you use it, and for the AI help when importing files is processed and temporarily kept by Anthropic, in the United States. Some providers established outside the European Union, mainly in the United States, nevertheless process limited data, each for a specific purpose described in "Sharing your data": RevenueCat and Stripe for the Premium subscription and its payment on the website, Expo, Apple and Google for sending notifications to your phone, Resend for sending your sign-in codes, and Anthropic, which does receive data about your wealth, for the AI assistant's answers and the AI help when importing files. By default, a notification contains neither an amount nor an asset name; if you turn on its detail, that information passes through the delivery service. These transfers rest on the provider's certification to the framework for data protection between the European Union and the United States, or on the standard contractual clauses adopted by the European Commission, which bind the recipient to a level of protection equivalent to the GDPR. Two separate cases: wallet scanning services receive from our servers a public address with no information about you, and the services that host logos see your device's IP address when it loads an image.

8. Encryption and security

Your data travels over HTTPS only and is encrypted at rest by our host. Your private key is never stored on our servers: we keep only a cryptographic fingerprint, from which the key cannot be derived. On mobile, the app locks with a PIN or biometrics, and amounts can be hidden with a single gesture. In the interest of transparency: we do not use end to end encryption. Our servers can read your data, and that is precisely what lets them revalue your holdings every day.

9. Who can access it

Nobody browses your portfolio. Technical access to the production database is limited to operating and troubleshooting needs, and restricted to the people responsible for them. Our internal back office is designed never to display an identity: it shows no name, no email address and no account identifier, not even to our own team. Only exception: when you report an answer from the AI assistant, the team reads the reported question and answer, without the report recording or showing the account they come from.

10. Sharing your data

We never sell your data and never use it for advertising. We rely on a small number of providers, each for a specific purpose:

• Railway, a US company: hosting for the application, the database and its cache, on servers located in Amsterdam
• Vercel, a US company: hosting for the website, rendered from Paris, and cookieless audience and performance measurement
• Sentry, on its European region in Germany: technical error reports, to which we attach neither your name, nor your email, nor your account identifier; for a payment anomaly, only your billing identifier appears there
• Resend, a US company: delivery of your sign-in codes by email
• Google and Apple: sign-in, if you choose their button; the sale of Premium in their app stores, where they are the sellers; delivery of notifications to your phone
• RevenueCat, a US company: management of Premium subscriptions on the website and in the apps. From the first time you open the subscription screen, or as soon as the message announcing the end of your trial or of your six free months is due to appear, RevenueCat receives your billing identifier, then your purchase history, your country and technical data about the device; for a purchase on the website, it also receives the email address and country entered at payment. A purchase in the App Store or Google Play passes it neither your name nor your email.
• Stripe: collection of Premium purchases on the website, from the card, the email address and the country you enter on the payment page
• Expo, a US company: delivery of notifications to your phone, with the device token and the text of the notification, without an amount or an asset name unless you turn on the detail
• Our market data providers, including EODHD, which receive the identifier of the assets to be valued, of the assets whose news the AI assistant looks up and, when you search for an asset, the text of your search, never your quantities, your amounts or your identity
• Anthropic, a US company: answers to the questions asked to the AI assistant, if you use it. Anthropic receives your question, the recent conversation history and the wealth data read to answer it (positions, amounts, labels you entered), never your name, your email address or your account identifier.
• Anthropic, a US company: AI help when importing files. For a file format we do not recognize, Anthropic receives the column headings as they appear in the file, after removal of account numbers, IBANs and email addresses, with the type of each column. If you launch the AI search, it also receives the name, symbol and ISIN of the lines that could not be found. Finvygo attaches neither your name, nor your email address, nor your account identifier, nor your quantities or amounts.
• Ankr and Blockstream, if you scan a crypto wallet: they receive its public address from our servers, with no information about you
• The services that host the logos of assets and brokers (EODHD, CoinGecko, jsDelivr, Google): your device loads them directly, which lets them know its IP address
• The competent authorities, where the law requires it
• The external applications you connect yourself: your wealth data is shared with them at your request, and then falls under their publisher's responsibility. You can withdraw this access at any time from your settings.

11. Your rights (GDPR)

The General Data Protection Regulation grants you the following rights, which you can exercise at any time by writing to us:

• Right of access to your data
• Right to rectification
• Right to erasure (the right to be forgotten)
• Right to restriction of processing
• Right to portability: we send you all of your data on request
• Right to object to processing
• Right not to be subject to a solely automated decision: we make none and carry out no profiling
• Right to lodge a complaint with the data protection authority of your place of residence

12. Cookies and storage on your device

The website uses technical cookies: to keep you signed in, remember your language, your time zone and your theme, and to know your country from your IP address, so as to show the right currency and the right version of our legal texts (this last cookie lasts 24 hours). It also keeps display preferences in your browser, a few amounts of your wealth to show you what has changed since your last visits, your wealth bet, the history of your conversations with the AI assistant and, if you arrive through a partner's link, the partner's code for 30 days at most, so as to attribute a possible sale to them. When you pay on the website, the payment page loads Stripe's code, which may set its own cookies for payment security and fraud prevention. On mobile, the app keeps on your device your session, in the system's secure keychain, as well as your preferences and a temporary copy of your data for faster display. No advertising cookies, no profiling, and our audience measurement works without cookies. Since these trackers all serve the operation of the service or an offer you chose to follow, we do not show a cookie banner.

13. Retention and deletion

Your data is kept for no longer than your account exists. Some of it has a shorter life, for example 10 minutes for a sign-in code, 90 days for the detail of your sessions, for a price alert once it has fired or for a phone that no longer connects, and 24 months for the log of payment messages. Deletion is immediate and final: deleting your account from the app erases your profile, your assets and your history straight away, with no retention period. Our technical backups, encrypted at rest, expire on their own after six days: after that, your data has gone from our systems. All that remains are records with no identifier and no link to your account: a statistical record of your departure (date, sign-in method, country, account age, platform used, reason for leaving and whether or not you had added an asset), technical traces of your file imports and of some changes, your reports of missing assets, your asset searches for 12 months at most, the metadata of the questions asked to the AI assistant already detached from your account (deleted 13 months after the question), the answers you reported (with no identifier, deleted after 90 days) and, if you had bought Premium with a partner's code, the sale itself, to calculate their commission. These records cannot lead back to you. If you leave a free text comment on your way out, it is kept exactly as you wrote it. Payment receipts stay with Apple, Google and Stripe, which keep them according to their own legal obligations, and we ask RevenueCat to erase your record.

14. Changes to this policy

We may update this policy, for instance if we change provider or add a feature. The date of the last update appears at the top of this page. If something important changes in the way we handle your data, we will tell you in the app.

15. Contact

The controller of your data is Exocore Group, a French simplified joint-stock company whose registered office is at 200 rue de la Croix Nivert, 75015 Paris, France. To exercise your rights or for any question about this policy: contact@finvygo.com. Our full details appear in our legal notice.