Privacy Policy
Last updated
YFINIQ is a personal finance app. This page explains what it stores, who else sees it, and what you can do about it. It is written to be specific rather than reassuring — where something might surprise you, it is called out rather than smoothed over.
The short version
- YFINIQ has no bank connection. Everything in your account is data you typed in.
- If you use the AI assistant, the relevant parts of your financial data are sent to an external AI provider to answer your question. This is the most important thing on this page.
- There is no advertising and no behavioural tracking. YFINIQ does measure page-load performance (how fast pages load, not what you do on them) — see below.
- You can export everything, and you can delete your account outright. Both work today.
What YFINIQ stores
Data you provide:
- Account details — your email address, and a password stored only as a hash by our authentication provider.
- Financial data you enter — accounts, transactions, categories, budgets, goals, investments, businesses, debts and tags. YFINIQ never retrieves this from a bank; it exists because you or the assistant entered it on your instruction.
- Assistant conversations— your messages and the assistant’s replies, so a conversation follows you between devices.
- Preferences — display currency, theme and similar settings.
YFINIQ also records limited technical information about each assistant request for reliability monitoring: which provider answered, how long it took, whether it succeeded, and the first 200 charactersof your message. The assistant’s reply is never stored in those records, and neither are the arguments of any action it takes. These records are not readable by any user account, including yours.
Who else receives your data
YFINIQ relies on the following processors. This list is exhaustive as of the date above.
| Processor | Role | What it receives |
|---|---|---|
| Supabase | Database, authentication, file storage | Everything listed above. This is where your account lives. |
| Vercel | Application hosting | Requests to the site, including IP address and standard server logs. |
| Vercel Speed Insights | Page performance monitoring | Core Web Vitals for the page you are on (how long it took to load and render) — not what you clicked, typed, or viewed. No cookie and no persistent identifier; see below. |
| Sentry | Error diagnostics | When something breaks: the error and the code path that produced it. Request bodies, query strings, cookies and headers are stripped before sending, and your email address and IP are never included — see below. |
| Groq | AI model provider | Assistant requests — see below. |
| Cerebras | AI model provider | Assistant requests — see below. |
| Google (Gemini) | AI model provider | Assistant requests — see below. |
| OpenRouter | AI model gateway | Assistant requests, which it forwards to a further model provider that it selects. YFINIQ does not control that onward choice. |
YFINIQ does not sell your data, does not share it for advertising, and has no affiliate or data-brokerage arrangements.
How the AI assistant uses your data
When you ask the assistant something, YFINIQ sends the parts of your financial data needed to answer it — for example your recent transactions if you ask about spending — together with your message, to one of the AI providers listed above.
If a provider is unavailable or rate-limited, the same request is sent to the next provider in turn. A single question can therefore reach more than one provider before you get an answer. We have no way to predict which one will serve any given request.
Each provider handles data under its own terms, which YFINIQ does not control. If you would rather no third party ever sees your financial data, do not use the assistant — the rest of YFINIQ works without it.
The assistant can also take actions on your behalf, such as recording a transaction or deleting a budget. Destructive actions always require your explicit confirmation first.
When something breaks
YFINIQ reports its own errors to Sentry so problems can be found and fixed without waiting for someone to report them. What gets sent is deliberately narrow: the error, the code path that produced it, and an anonymous identifier for your account so a recurring problem can be recognised as recurring.
What is removed before an error report leaves YFINIQ:
- the contents of whatever you were submitting at the time
- anything in the page address after the path, such as a search term
- cookies and request headers
- your email address and IP address
- anything resembling an amount of money, a token, or a record identifier
YFINIQ does not record your screen. Session-replay recording — which would capture your balances and transactions as you see them — is switched off and its code is not loaded.
Cookies
YFINIQ sets only the cookies required to keep you signed in. There are no advertising cookies and no behavioural trackers.
Vercel Speed Insights, which measures page performance (see above), was added without changing that: it sets no cookie and uses no persistent client-side identifier — nothing ties one page load to the next or to you specifically, it is just a performance sample for the page you were on. So there is still nothing here that needs consent, and no consent banner. If that changes, non-essential cookies will be blocked until you opt in, and this page will say so before they are used.
How long data is kept
Your data is kept for as long as your account exists. YFINIQ does not expire or archive it on a schedule.
When you delete your account, your records are removed from the live database immediately — this is a real deletion, not a hidden flag. Reliability records described above have their link to your account cleared at the same time, leaving no association with you. Encrypted backups held by our database provider may retain copies for a short period before rotating out; those are not readable by YFINIQ and are not used to restore deleted accounts.
Your data, and how to actually get it
These are working features, not requests you have to send to someone:
- Export everything. Settings → Privacy → Export. Produces a single JSON file containing every record YFINIQ holds for you, across all areas of the app.
- Delete your account. Settings → Privacy → Delete account. You confirm by typing your email address. This permanently removes your account and every record attached to it — accounts, transactions, categories, budgets, goals, investments, businesses, debts and your entire chat history. It cannot be undone, and you are offered an export first.
- Delete only your chat history. Available from the assistant itself, if you want to clear conversations without touching the rest of your account.
- Correct your data. Every record is editable in the app.
For anything not covered by the above, contact privacy@YFINIQ.com. The in-app export and deletion controls remain the fastest route, because they act immediately and do not depend on anyone answering an email.
Company Details
[COMPANY_LEGAL_NAME]
[COMPANY_ADDRESS]
TODO: Founder to replace the above placeholders with real legal entity details.
Age
YFINIQ is for people aged 18 or over. It is not directed at children, and accounts are not knowingly created for anyone under 18. If you believe someone under 18 has an account, please get in touch and it will be removed.
Security
Every query is restricted to your own account at the database level, and that restriction is tested against a real database on every change rather than assumed. No security measure is absolute, and YFINIQ is early-access software — please do not treat it as a system of record for anything you cannot afford to lose.
Changes
If this policy changes, the date at the top changes with it. Material changes to what is collected or who receives it will be surfaced in the app rather than only here.
See also the Terms of Service.