FinanceTracker Privacy Policy

Effective date: October 31, 2026

This policy covers the FinanceTracker app for iPhone, iPad and Mac (listed on the App Store as "MaisonSFinanceTracker"), its TestFlight beta, and the web page that hosts this policy.

In short

• Your ledgers live on your device. There is no FinanceTracker account and no sign-in. We run no server that stores your financial data.
• No analytics, ads or tracking. The app has no third-party SDKs. We don't sell or share your personal information, and we don't use it to train AI models.
• Data leaves your device only through features you turn on, and each one is off until you do:
  • iCloud sync: your records are encrypted on your device before they reach your own iCloud.
  • Bank sync with SimpleFIN: your device fetches your bank data directly from SimpleFIN.
  • A cloud AI provider (Anthropic, OpenAI or Google): shows a consent screen first, then sends a reduced view of your ledger to the provider you picked.
  • Feedback you choose to send: through TestFlight, by email, or (when it's switched on) from inside the app.
• What we, the developer, can see: feedback you send us; the details TestFlight shares about beta testers; and, if you use a beta AI key we give you, your email and how much that key has used. We can't see your ledgers, your iCloud data or your AI conversations.

1. Who we are

FinanceTracker is made by Jorge Sinclair, an individual developer trading as Maison Sinclair Ventures ("we", "us"). We are responsible for the personal information described in this policy that reaches us. For the European Union and United Kingdom, that makes us the "controller" of it.

Contact: support@maisonsinclairventures.com

Much of what FinanceTracker does never reaches us at all: it happens on your device or between your device and a service you chose. Sections 2 to 6 say which is which.

2. Data that stays on your device

• Ledgers. Transactions, accounts, balances, budgets, categories, rules, sales, inventory, import history and reminders are saved as files in the app's private storage.
  • On iPhone and iPad these files use iOS Complete Protection, so they can't be read while the device is locked.
  • On Mac they sit in the app's sandboxed container, protected by your login and by FileVault if it is on.
• Assistant conversations are saved on the device where they happened, in the app's private storage. They never sync. You can clear them from the assistant's History menu.
• Settings are kept in the app's preferences on the device.
• Secrets (AI provider keys, a beta AI key, your SimpleFIN access key, and the iCloud sync key described in section 4) are kept in the Keychain.
• Notifications. Import reminders are scheduled on the device. Nothing is sent to us.
• Imports. Bank files you import (CSV, OFX, QFX, QIF, PDF) are read on the device. PDF text recognition uses Apple's on-device Vision framework. On Mac, the assistant can look for recent statement files in your Downloads folder when you ask it to.

Device backups. If you back up your device with iCloud Backup or to a computer, your ledger files are included, so restoring the device brings them back. Apple encrypts iCloud backups. They are end-to-end encrypted only if you turn on Advanced Data Protection for iCloud.

Deleting. You can delete ledgers, transactions and conversations in the app. Deleting the app removes its local data from that device, apart from any backups and any files you exported.

3. Export and auto-save files (.fintrack)

You can export a ledger, or have the app auto-save one, as a .fintrack file in a place you choose: Files, iCloud Drive, a USB drive, or an email attachment.

• With a passphrase, the file is encrypted on your device (AES-256-GCM, with a key derived from your passphrase using PBKDF2-SHA256 and HKDF-SHA256). The passphrase is kept in memory only. We never see it, and nobody can recover it if you forget it.
• Without a passphrase, the file is readable by anyone who has it, and it includes account details. Keep it somewhere private.
• The auto-save file always records which device saved it and when, even when encrypted, so your other devices can tell you about newer copies.
• Where you save the file decides who stores it. For example, a file in iCloud Drive is stored by Apple under your iCloud account, and one in Dropbox by Dropbox. These copies are not sealed the way iCloud sync is (section 4); a passphrase is what protects them.

4. iCloud sync (optional, off by default)

iCloud sync keeps your ledgers the same on your iPhone, iPad and Mac. It starts only after you turn it on in Settings › Data & iCloud and accept its consent screen. Nothing in the app turns it on for you.

• Your data goes to your own iCloud, not to us. Your ledgers are stored in FinanceTracker's area of your private CloudKit database, and they use your iCloud storage. We have no access to it.

• Sealed on your device. Each record is encrypted on your device (AES-256-GCM) before it is uploaded. The key is created on your device and stored in your iCloud Keychain, which Apple end-to-end encrypts. Apple stores the encrypted records but can't read their contents.

  • Apple can still see technical details it needs to run the service: how many records there are, their sizes and times, and a label for each record's type (for example "Transaction").

• Some preferences are stored unencrypted in iCloud key-value storage, so they can follow you between devices. This is the complete list:

  • your appearance (light or dark) and app language, unless you choose to keep these on each device;
  • whether you have finished onboarding, and whether you have seen the personal and business introductions and the first-sale celebration;
  • the name of the device that turned sync on (on a Mac, its computer name) and when;
  • the time iCloud data was last deleted, so your other devices can stop syncing.

  Amounts, balances, account names, bank details, AI settings and conversations never go into key-value storage.

• Some things never sync. SimpleFIN access keys never sync. AI consent and assistant conversations stay on each device.

• AI keys sync only if you ask. A separate option, with its own confirmation, stores your AI provider keys in iCloud Keychain so your other devices can use them.

• Handoff. If Handoff is on in your device settings, your other Apple devices can open the same ledger, section, month and transaction you were viewing. Apple passes this between your own devices. It isn't offered to Spotlight or Siri.

• Stopping and deleting.

  • "Stop syncing on this device" turns sync off and leaves everything else where it is.
  • "Stop syncing and delete from iCloud" deletes the encrypted ledgers and their key from your iCloud, and turns sync off on your other devices. The ledgers on each device are not touched.
  • You can also delete FinanceTracker's iCloud data in your device's iCloud storage settings.
  • The few preference entries listed above can stay in iCloud key-value storage after sync is turned off. None of them contain financial data.

5. Bank sync with SimpleFIN (optional)

If you connect a bank through SimpleFIN Bridge, a paid service you sign up for with SimpleFIN:

• You paste a setup token. Your device exchanges it with SimpleFIN for an access key, then uses that key to fetch your accounts and transactions directly from SimpleFIN over HTTPS. Nothing passes through us.
• The access key is stored in this device's Keychain. It never syncs and is never sent to us.
• With iCloud sync on, details of the connection (institution and account names, the last sync time, and which device fetches) sync with your ledger, encrypted as described in section 4. Only the device that holds the key contacts SimpleFIN.
• Disconnecting in the app deletes the access key from the device. Transactions already imported stay in your ledger.
• SimpleFIN and the bank-connection providers it uses handle your bank data under SimpleFIN's own terms and privacy policy. To remove data held there, delete the connection in your SimpleFIN account.

6. AI features (optional)

FinanceTracker's assistant, smart categorization and insights can run in three ways. You choose which in Settings › AI.

On-device (the default). Apple's on-device model (Apple Intelligence, on devices that support it) does the work on your device. Your data doesn't leave the device. "Automatic" picks between on-device and your own local server, and never picks a cloud provider.

A server on your own network. You can point the app at an AI server you run on your local network, such as LM Studio. Your ledger data then goes only to that server. The app only connects to local and private network addresses for this. If you use plain http, data crosses your network unencrypted, and the app warns you.

A cloud provider: Anthropic (Claude), OpenAI or Google (Gemini). Off until you choose one, add an API key and accept a consent screen. After that, the app sends these directly from your device to that provider:

• your messages;
• a compact summary of your ledger (totals by category and month);
• the results of the tools the assistant uses to answer you. These include matching transactions, capped at 50 rows, and, on Mac, the names of statement files in your Downloads folder.

By default the app leaves out account numbers, account owner names, birth years and free-text notes, and masks long runs of digits. A second, separate opt-in ("full detail") sends the fuller ledger snapshot, including those names, birth years and notes. To stop sending, switch back to Automatic, On-device or Local network, or remove your key.

Whose terms apply depends on the key.

• Your own API key. You are the provider's customer, and the provider handles the data under its terms with you. The app links to each provider's data-use terms. We are not involved and see nothing.
• A FinanceTracker beta key (TestFlight only). During the beta we may give you a key for Anthropic's Claude. It has its own consent screen.
  • Requests still go directly from your device to Anthropic, but under our Anthropic account: we are Anthropic's customer for these requests, so Anthropic's commercial terms and data processing addendum with us apply, not a contract between you and Anthropic.
  • Under those terms Anthropic doesn't train its models on this content. It deletes it within 30 days, except where it keeps it longer to enforce its usage policy (for example, flagged content for up to 2 years) or where the law requires.
  • What we see: your email address and which key we sent you (we keep this in a private list), and, for each key, usage reports from Anthropic: tokens and cost over time, and which model ran. We don't see your messages or the ledger data in them.
  • Beta keys are not offered in App Store builds.

7. Feedback, support and crash reports

TestFlight (beta). When you send beta feedback, or share a crash report, Apple passes it to us. Per Apple's TestFlight terms this can include:

• your comments and screenshots;
• device and app details (model, OS version, language, carrier, time zone, battery, disk space and similar);
• crash logs, which TestFlight sends automatically;
• usage details such as installs, sessions and crash counts;
• the name and email you were invited with (not shared if you joined through a public link).

Screenshots can show balances, so crop them if you prefer. We use this only to fix and improve the app.

Email. You can email us at any time. Help › Send feedback can also copy a report for you and open your mail app. We see whatever you put in the email.

In-app reports (when switched on). A future build may offer "Send to the developers" in Help › Send feedback, or let the assistant draft a report for you. It is not switched on in the first beta build. When it is:

• Nothing is sent until you press Send, after a preview that shows exactly what will go.
• A report contains:
  • the kind of report and your message (whether you typed it or the assistant drafted it for you);
  • the screen you were on;
  • an optional contact email, only if you enter one;
  • the app version, build and channel, OS version, device type (Mac, iPad or iPhone) and app language.
• Diagnostics are added only if you tick the box. They are counts and on/off flags: whether the ledger is personal or business; how many ledgers, accounts, rules and linked institutions you have; a rough transaction-count range; whether bank sync is on and which kind of AI provider is selected. They also include a few recent app log lines with personal details removed. They contain no amounts, merchants, account names or numbers.
• The report travels over HTTPS to a small relay we run on Cloudflare. The relay files it as an issue in a private GitHub repository that only our development team can see.
  • The relay doesn't log message contents, contact details or IP addresses.
  • To limit spam, it keeps a salted hash of your IP address in counters that expire within a day, and a report ID for 24 hours to avoid duplicates. On a very busy day, a report may wait up to 7 days in Cloudflare storage before it is filed.
• Reports that can't be sent yet wait on your device until they can.

8. What we don't do

• No analytics, advertising, tracking, data brokers or third-party SDKs.
• No accounts and no sign-in.
• We don't sell your personal information or share it for cross-context behavioral advertising.
• We don't use your data to train AI models.
• We don't combine your data with data from other sources.

9. Why we use data, and our legal bases

This matters mostly if you are in the European Economic Area, the UK or Switzerland. It covers only data that reaches us.

You don't have to give us any of this. If you don't, the app works the same, apart from the feedback or beta key you didn't use.

10. Who else handles data

• Apple: iCloud, CloudKit, iCloud Keychain, Handoff, TestFlight, App Store and crash reporting, under Apple's terms and privacy policy.
• The AI provider you choose (Anthropic, OpenAI or Google), under its terms with you; or, for a beta key, Anthropic as our service provider.
• SimpleFIN, for bank sync you set up with them.
• Cloudflare, which hosts this website and the feedback relay.
• GitHub, which stores feedback reports in our private repository.
• Our email provider, for messages you send us.

The services we pick ourselves (Anthropic for beta keys, Cloudflare and GitHub) handle data for us under contracts that limit how they can use it. Services you pick yourself (your own AI provider, SimpleFIN, your iCloud account) act under their own terms with you. We may also disclose information if the law requires it.

11. International transfers

We are based in the United States, and so are Anthropic, OpenAI, Google, Cloudflare and GitHub. If you are outside the US, data that reaches us or our service providers is handled in the US. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework, as offered in those providers' terms.

12. How long data is kept

13. Your choices and rights

Withdrawing consent and turning features off

• Cloud AI: choose Automatic, On-device or Local network in Settings › AI, or remove your key.
• iCloud sync: Settings › Data & iCloud.
• AI key sync: Settings › Data & iCloud.
• Bank sync: disconnect in the app's bank sync settings, and delete the connection in your SimpleFIN account.
• Handoff: in your device's system settings.

Turning a feature off stops new data from flowing. Section 12 says what happens to data already sent.

Your rights. You can ask us for a copy of the personal information we hold about you, or ask us to correct or delete it. Email support@maisonsinclairventures.com, and say roughly when and how you contacted us so we can find it (for example, the date of a feedback report). Depending on where you live you may have further rights, for example to object, to restrict processing or to move your data. We will answer within the time the law sets, usually one month, and we won't treat you differently for asking.

Data on your device or in your iCloud never reaches us, so you control it directly: export it, change it or delete it in the app. For Apple, SimpleFIN or your own AI provider, contact them directly.

If you are in the EEA, UK or Switzerland you can also complain to your local data protection authority.

14. California residents

We don't sell personal information, and we don't share it for cross-context behavioral advertising. The categories we may receive are listed in sections 6, 7 and 9: identifiers (name, email), information you put in feedback, and technical device information. Our sources are you, Apple (TestFlight) and Anthropic (usage reports for beta keys). We use them only for the purposes in section 9. You can ask to know, correct or delete them as section 13 describes.

Do Not Track. The app and this website don't track you over time or across other sites, and we don't let third parties do so. A Do Not Track or Global Privacy Control signal therefore changes nothing: there is no tracking for it to turn off.

15. Children

FinanceTracker is meant for adults managing their own or their business's finances. It isn't directed at children under 13, and in the EEA and UK we don't knowingly process data of anyone under 16. If you think a child has sent us personal information, email us and we'll delete it.

16. Security

• Encryption on the device: iOS Complete Protection for ledgers, the Keychain for secrets, and optional passphrase encryption for exports.
• iCloud sync records are sealed on your device before upload.
• Every connection the app makes uses HTTPS, except a plain-http server you set up yourself on your local network.
• The app accepts no incoming connections.
• Access to feedback reports and beta key records is limited to our development team.

No system is perfectly secure. If a breach affects personal information we hold, we will tell affected people and the authorities as the law requires.

17. This website

This page is a static site hosted by Cloudflare. It sets no cookies and runs no analytics or advertising. To deliver and protect the site, Cloudflare processes technical details of each visit, such as your IP address and browser, under Cloudflare's privacy policy. We don't use them to identify you.

18. Changes to this policy

When we change this policy, we update this page and the effective date at the top. For a significant change, especially one that sends data somewhere new, we'll also say so in the release notes (TestFlight "What to Test" during the beta). Where the law requires, we'll ask for your consent in the app before the change applies to you.

19. Contact

Questions, requests or complaints: support@maisonsinclairventures.com Jorge Sinclair, trading as Maison Sinclair Ventures