What Finy keeps, and what never leaves your phone.

Dated 2 November 2026. Applies to the Finy app on iPhone and Android, and to this site.

Draft. This policy is written ahead of Finy's release, from how Finy is built and planned. It is reviewed before the first store listing, and this note is removed then. Where it says "once the cloud ships" or "once billing opens", that part is not live yet.

The short version

Finy knows who you are. Your ledger stays on your phone.

You sign in with Apple or Google so that your plan is yours and, later, so a paid plan can keep a copy of your ledger. On the Free plan, nothing of your ledger is ever uploaded: not a record, not an account, not a balance. Finy has no ads, no ad network and no analytics. It never connects to a bank.

Who is responsible

Finy is made by HYL Works, Indonesia. For anything in this policy, write to hello@finy.id.

What Finy keeps on your phone

Your ledger: accounts, records, categories, labels, templates, budgets, goals, planned payments, debts, your bill splits and the people you split with, and your settings. It is a database in Finy's own storage on the phone, which other apps cannot read. Finy keeps it out of your phone's own backup (iCloud, Google), on every plan, so a Free ledger exists only on the phone and in the backup files you make. Finy reminds you to make one.

A backup file (.finy) and a readable export (CSV and JSON) are made only when you ask, and go only where you send them. A backup file is not encrypted; anyone with the file can read it.

What Finy keeps on its server

Finy's account server holds, for each person who signs in:

An accountIts id, your email address and the day it was made.
Your sign-in identitiesThe provider (Apple or Google) and the id that provider gives Finy for you. Finy never keeps the provider's own token. With Apple's Hide My Email, Finy holds the relay address.
Your sessionsWhich devices are signed in, by a device name such as "iPhone 17" and the day each was last seen, so you can sign one out.
Your planWhich plan you hold and until when, as the store reports it.
Your name and Finy IDThe name you typed, and a six-character Finy ID with its code, so a friend can send you a bill split. Anyone who has your ID can learn your name and send you a card, as a phone number lets anyone message you; a card writes nothing until you accept it, and you can ignore it or block the sender.
A bill split you sendThe store, the day, the total, each person's share and items, and each person's account id, kept while the split is open so each friend can fetch it, and deleted 30 days after its last line is paid and checked, or 30 days after you stop sharing it. A split's public link shows the store, the day, the total and each person's name and share, nothing else; stop sharing, and the page shows only that the split is closed.

On Free, that is everything. No row of your ledger reaches the server. The server runs on a virtual machine in Jakarta, Indonesia, with a nightly encrypted copy kept off the server for recovery.

Once the cloud ships, for Rinjani and Carstensz: a copy of your ledger is kept on Finy's server so it can sync between your devices and the web. It is encrypted in transit and at rest on disk. Finy can read it, as your bank can read your statement; it is not end-to-end encrypted for now, and this policy will say so plainly if that changes. The email address is the one personal field on the server and is kept out of the synced data. When a paid plan ends, everything stays readable and writable on your phone, and the server deletes its copy 30 days later.

What Finy reads for you, and where

Screenshots and receipts you share, and a bill you point the camera atRead on the phone, by Apple's Vision on iPhone and Google's ML Kit on Android. Finy deletes its own copy of the image as soon as its words are read. The original stays wherever it was. Finy opens the camera only to read a receipt or a friend's Finy code, when you ask, and never reads your photo library on its own; it reads only what you share, pick or point it at.
VoiceWhen you tap Say it, speech is recognised by the phone's own service. On an iPhone, Indonesian speech goes to Apple's speech recognition servers, because Apple has no on-device Indonesian; Finy says so in the app. The words are turned into records on the phone and are not stored by Finy.
Payment notifications (Android only)If you turn it on, Finy reads the notifications of the bank and e-wallet apps you allow, keeps each waiting on the phone for up to 30 days until you confirm or ignore it, and writes nothing until you tap. The allow-list and the inbox are visible, and stopping is one tap. The notifications' words stay on the phone and out of every backup.
A card tap (Android only)A Flazz, e-money, TapCash, Brizzi or JakCard is read by your phone's NFC, on the phone. Nothing is sent anywhere.

Every insight Finy shows, from a suggested category to a budget's forecast, runs on the phone from your local ledger. No model is trained on your ledger, readable or not.

What leaves the phone without you

Google's ML Kit diagnostics, on AndroidThe library that reads a screenshot's text sends Google its own diagnostics: device and app information, performance metrics, its configuration and a per-installation identifier. Google's list names neither the image nor its words. Finy cannot turn this off and discloses it in Google Play's Data safety form.
Apple's speech recognition, on iPhoneOnly for Indonesian voice, as above, and only while you listen.
The storesPurchases, once billing opens, are made through the App Store or Google Play and the billing service Finy uses to verify them. Finy receives which plan you hold, never your payment details.

Nothing else. Finy has no analytics SDK, no crash reporter that leaves the phone, no ad SDK and no push service: budget alerts are made on the phone, and by default carry no amounts.

The store labels

On the App Store, Finy's privacy label lists email address and user ID, used for account management and linked to you. On Google Play's Data safety form, the same two lines, with ML Kit's diagnostics under App info and performance and Device or other IDs. Financial info is not collected on either.

This site

This site sets no cookies, loads nothing from a third party and runs no analytics. If you choose Ivory or Night with the toggle, that choice is kept in your browser alone. The waitlist form, once it is connected, sends your email address to Finy's server and nothing else; it is used for one message when Finy opens, and deleted after.

Your choices

See and sign out your devicesSettings → Profile lists your sessions. Sign out keeps your ledger on the phone.
Delete your accountSettings → Profile → Delete account removes the account, its identities, its sessions, the splits you sent with their evidence images, and any cloud copy at once, and revokes Finy's sign-in at Apple or Google. It leaves the ledger on your phone alone.
Take your data with youBack up makes a file of the whole ledger; Export makes a readable one. Both are on every plan.
Start overSettings → Backup → Start over empties the ledger on the phone.

Children

Finy is not made for children under 13 and asks for no age. If a child's account is found, it is deleted.

The law

Finy follows Indonesia's Personal Data Protection Law (UU PDP). Your email address is processed to run your account and your plan, with your consent given at sign-in. You may ask what Finy holds about you, ask for it to be corrected or deleted, or withdraw consent by deleting your account, at hello@finy.id.

Changes

When this policy changes, the date at the top changes and the app says so once. The current version is always at finy.id/privacy.