fintrack by Nudge Labs LLC

1. Who We Are

fintrack is a personal finance tracking application developed and operated by Nudge Labs LLC, a Georgia limited liability company. We can be reached at nudgelabsllc@gmail.com.

2. Information We Collect

We collect only what is necessary to provide the service:

• Account information: your email address and a cryptographic hash of your password. We never store your password in plain text.
• Encrypted financial data: your transaction records, categories, and budgets — encrypted end-to-end using your password as the key. We have no ability to decrypt this data.
• Subscription information: your plan tier (Free, Household, or Premium) and subscription status.
• Usage metadata: basic server logs including request timestamps, IP addresses, and HTTP status codes, retained for up to 30 days for security and debugging purposes.

We do not collect device identifiers, location data, advertising IDs, or any behavioral analytics.

3. Zero-Knowledge Encryption

fintrack uses end-to-end encryption. Your financial data is encrypted on your device using NaCl SecretBox with Argon2id key derivation before transmission to our servers. Your encryption key is derived from your password and is never transmitted or stored by us.

This means: if you forget your password, your encrypted data cannot be recovered. There is no "forgot password" pathway that gives us access to your data.

4. How We Use Your Information

• To authenticate your account and provide access to the application
• To store and retrieve your encrypted financial data
• To manage your subscription and process payments (via Stripe)
• To send transactional emails such as MFA codes and account notifications
• To maintain security and prevent abuse

We do not use your information for advertising, profiling, or sale to third parties.

5. Data Sharing

We do not sell, rent, or trade your personal information. We share data only with the following service providers who assist in operating fintrack:

• Amazon Web Services (AWS): cloud infrastructure and encrypted data storage (us-east-1 region)
• Stripe: payment processing for paid subscriptions
• Email service provider: for delivery of transactional emails (MFA codes, account notices)

All service providers are contractually required to protect your data and may not use it for their own purposes.

6. Data Retention

We retain your account and encrypted data for as long as your account is active. Free tier accounts with no activity for 24 consecutive months may be deleted after notice. You may delete your account and all associated data at any time by contacting us at nudgelabsllc@gmail.com.

7. Your Rights

You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and data
• Export your data in CSV format at any time using the Export feature in the app

To exercise any of these rights, contact us at nudgelabsllc@gmail.com.

8. Security

We implement industry-standard security measures including TLS encryption in transit, encrypted storage at rest, and zero-knowledge architecture that ensures your financial data is inaccessible even to us. Access to our production systems is restricted and logged.

9. Children's Privacy

fintrack is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this policy from time to time. We will notify registered users by email of any material changes at least 30 days before they take effect. Continued use of fintrack after that date constitutes acceptance of the updated policy.

11. Contact Us