Privacy Policy

1. Who We Are

FinCommand ("we", "us", "our") is a personal finance platform operated as a private business. Our service is accessible at fincommand.net. For questions about this policy, contact us at [email protected].

We are based in Canada and comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. Where our users are located in the European Economic Area, we also comply with the General Data Protection Regulation (GDPR). For users in California, we comply with the California Consumer Privacy Act (CCPA).

2. Data We Collect

When you create an account, we collect:

• Email address — used for authentication and to contact you about your account
• Full name — used to personalize your experience
• Password — stored as a cryptographic hash via Supabase Auth; we never see your plaintext password
• Account creation date and last login timestamp

If you sign in with Google, we receive your email address and name from Google. We do not receive your Google password or phone number.

FinCommand processes personal financial data that you voluntarily enter, including:

• Income amounts, expense categories, and monthly budget figures
• Asset and liability values for net worth tracking
• Investment account balances and stock positions
• Real estate property details and mortgage information
• Retirement projections and savings goals
• Bank and credit card transaction data imported from statements you upload

This data is stored locally in your browser (localStorage) by default and optionally synced to your private cloud account. It is never analyzed, sold, or shared with third parties.

We collect limited usage data to improve the service and understand how features are used:

• Session timestamps (when you open the app)
• General feature usage patterns (which modules you use)
• Browser type and operating system (for compatibility purposes)
• IP address (collected by Cloudflare for security and routing; see Section 5)

We do not use session recording, heatmaps, or invasive analytics tools.

When you use the Import Statement feature, you upload CSV or PDF files from your bank or credit card. These files are processed locally in your browser — the raw file content is never transmitted to our servers. Only the parsed transaction data (date, description, amount, category) is stored in your browser's localStorage and optionally synced to your account.

If you use the AI Advisor feature, your conversation messages are sent to Anthropic's Claude API via FinCommand's secure server-side proxy. Your messages are never sent directly from your browser to Anthropic — they pass through FinCommand's infrastructure first, where your subscription token is validated before the request is forwarded. Conversations are stored in your browser's localStorage. Please do not include sensitive personal information (SIN, account numbers, passwords) in AI conversations. Refer to Anthropic's Privacy Policy for their data handling practices.

3. How We Use Your Data

We use your data solely to provide and improve the FinCommand service:

We do not use your data for advertising, profiling, or any purpose not listed above. We do not sell your data to third parties.

4. Data Storage & Security

By default, all your financial data is stored in your browser's localStorage — a private, sandboxed storage area on your own device. This data does not leave your device unless you explicitly choose to sync it to your account or export a backup file.

When you are signed into your FinCommand account, your financial data is synced to Supabase, our cloud database provider. Your data is:

• Transmitted over HTTPS (TLS encryption in transit)
• Stored in a Supabase database with row-level security (only your account can access your data)
• Hosted on infrastructure in Supabase's data centers (primarily AWS US-East)

We implement the following security measures:

• HTTPS enforced on all connections to fincommand.net
• Passwords hashed using industry-standard bcrypt via Supabase Auth
• Row-level security policies ensure users can only access their own data
• API keys for third-party services are stored server-side in Cloudflare environment secrets — never exposed to the browser
• JWT-based authentication with automatic token refresh

No method of electronic transmission or storage is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security.

5. Third-Party Services

FinCommand uses the following third-party services to operate. Each has its own privacy policy:

We do not share your financial data with any of the above services except Supabase (which stores it for your cloud sync). Stock data services only receive ticker symbols — never your account balances or personal information.

6. Google OAuth (Sign in with Google)

If you choose to sign in with Google, you will be redirected to Google's authentication page. We receive the following information from Google after successful authentication:

• Your Google account email address
• Your display name (as set in your Google account)
• A unique Google user identifier (used internally, never exposed)

We do not receive your Google password, phone number, contacts, calendar, or any other Google account data. The information received from Google is used solely to create and authenticate your FinCommand account.

By signing in with Google, you also agree to Google's Terms of Service and Privacy Policy. You can revoke FinCommand's access to your Google account at any time through your Google Account permissions settings.

FinCommand's use of Google user data is limited to the practices described in this privacy policy and complies with the Google API Services User Data Policy, including the Limited Use requirements.

7. API Keys & Service Credentials

The following API keys belong to FinCommand and are stored securely as server-side environment secrets in Cloudflare. They are never exposed to your browser:

• Anthropic (Claude) — powers the AI Advisor feature for all subscribers
• Financial Modeling Prep (FMP) — powers real-time stock quotes and financial data

Some optional features allow you to provide your own API keys for enhanced functionality (e.g., Alpha Vantage for additional earnings data). If you choose to provide these:

• They are stored only in your browser's localStorage on your own device
• They are never transmitted to FinCommand's servers
• They are your responsibility to keep secure

You can delete any stored keys at any time from the Settings section of the app.

8. Cookies & Local Storage

FinCommand uses browser localStorage (not traditional cookies) to store your data and preferences. localStorage is a standard browser feature that stores data on your device only — it is not transmitted with every request like cookies are.

We use the following types of browser storage:

We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies.

9. Data Retention

Local data: Financial data stored in your browser's localStorage persists until you clear your browser data or explicitly delete it from within the app. It is entirely under your control.

Cloud data: Financial data synced to your account is retained for as long as your account is active. If you delete your account, all associated cloud data is permanently deleted within 30 days.

Account data: Your email address and account information are retained for as long as your account is active. Upon account deletion, your personal information is removed from our systems within 30 days, except where retention is required by law.

Usage logs: Session logs (open timestamps) are retained for up to 12 months for product improvement purposes, then deleted.

Backup files: If you export a backup file, that file is downloaded entirely to your device. We do not retain a copy.

10. Your Rights

You have the following rights regarding your personal data:

You can export all your financial data at any time using the Export All Data feature in the Backup section. This downloads a complete JSON file of everything stored in your account.

You can edit or correct any data you have entered directly within the app at any time.

You can delete your account and all associated data by contacting us at [email protected]. We will process deletion requests within 30 days. You can also clear your local browser data at any time through your browser settings.

You can sign out at any time, which stops cloud sync. You can revoke Google OAuth access through your Google Account settings at any time without affecting your FinCommand account.

If you are located in the European Economic Area, you have additional rights under GDPR including the right to object to processing, the right to restriction, and the right to lodge a complaint with a supervisory authority. Contact us at [email protected] to exercise these rights.

California residents have the right to know what personal information is collected, the right to delete personal information, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact us at [email protected].

Canadian users have the right to access their personal information and to challenge its accuracy. You may contact our privacy officer at [email protected] with any privacy-related inquiries or complaints.

11. Children's Privacy

FinCommand is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at [email protected] and we will promptly delete the information.

Users between 13 and 18 should use FinCommand only with parental or guardian consent.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify signed-in users via email at least 14 days before the changes take effect
• Post a notice within the app for at least 30 days

Your continued use of FinCommand after changes take effect constitutes acceptance of the updated policy. If you disagree with the changes, you may delete your account before they take effect.

Previous versions of this policy are available upon request by contacting [email protected].

13. Contact Us