Skip to main content
← Back to FinTracker

Privacy Policy

Last updated:

The short version

  • Your ledger stays on your iPhone. There is no personal login or cloud ledger sync. Online features use pseudonymous service identifiers.
  • Earlier waitlist signups are stored in the EU (Frankfurt) for the launch updates those subscribers requested.
  • We don’t sell your data, we don’t run ads, and we don’t embed Google or Meta tracking.
  • Online AI sends the text or compact summaries needed for a request through our service to an AI provider. Audio, receipt photos, and statement files stay on your device.

1. Who we are

Data Controller: Bao Labs LLC, a Wyoming limited liability company, located at 30 N Gould St, Ste N, Sheridan, WY 82801, United States.

Privacy contact: privacy@baolabs.dev.

For users in the European Economic Area, United Kingdom, or Switzerland: Bao Labs LLC is the data controller under the General Data Protection Regulation (GDPR) and equivalent regulations. You may exercise your rights of access, rectification, erasure, restriction, portability, and objection by contacting privacy@baolabs.dev.

For users in California: under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), you have rights including the right to know, right to delete, and right to opt out of the sale or sharing of personal information. We do not sell personal information. Contact privacy@baolabs.dev to exercise your rights.

2. What this policy covers

This policy explains how we handle personal data in two contexts:

  • This website and the earlier email waitlist: site use and the launch updates requested by existing subscribers.
  • The iOS app: local manual tracking and optional online AI, purchases, rate suggestions, diagnostics, and analytics.

We’ll update this policy before any new processing activity goes live.

3. What we collected through the former waitlist

Before the waitlist form closed, signups included:

  • Your email address.
  • The timestamp of your consent and the version of this policy you consented to.
  • To deter abuse, we counted submissions against a keyed hash of the network address; we did not store the raw address in the waitlist database.

We do not set tracking cookies on this website. We do not run analytics today. We do not embed third-party ad pixels.

4. How the app handles your data

FinTracker stores your ledger locally in an on-device SwiftData store. It has no personal login or cloud ledger sync. Optional online features send limited data as described below.

  • Backups and new phones: your data is included in your normal iPhone backup, and that’s how it moves to a new iPhone. The app also offers a manual JSON export and a restore-from-export. Files you control.
  • Voice logging: your iPhone transcribes speech locally; audio is not sent to our AI service. The transcript and selected category or account names go through our Supabase service to the configured AI provider for parsing. Review the result before saving.
  • Bao chat and weekly insights: the app sends your message and recent chat context where applicable, plus compact spending, budget, goal, and streak summaries through our service to the configured AI provider. Weekly insight generation can happen automatically when enabled and enough history exists. We do not store a cloud copy of your ledger or chat history.
  • Purchases: Apple processes payments and RevenueCat validates subscriptions and Bao outfit purchases using App Store transaction data and a pseudonymous app-user identifier. FinTracker displays the subscription offer in the app. For online AI access, the app also sends an Apple-signed subscription transaction to our relay, which verifies it with Apple’s trust services and matches the purchase to active RevenueCat access. We do not receive your payment card details from Apple. See the Subscription Terms.
  • Receipt scans, statements, and exchange rates: Apple Vision reads receipt photos on your iPhone. Only recognized text, after best-effort masking of obvious bank and card details, is sent for AI parsing; masking can miss sensitive text. Statement files are parsed locally. For foreign-currency suggestions, Frankfurter receives a currency pair and date directly from your device, but not your amount, merchant, note, or statement file. You can edit the suggested rate or enter one manually.
  • Service identifiers, purchase security and fair-use counters: AI requests include a random installation identifier saved in app preferences and a separate RevenueCat app-user identifier. There is no Supabase anonymous sign-in in this release. To prevent forged purchases and replayed requests, Apple App Attest checks an app-specific device key. Our EU relay stores the attested public key and its handle, the RevenueCat identifier, request counters, environment and timestamps. The private key stays on the device. Short-lived security challenges contain random nonces and request hashes. Fair-use counters use the original Apple purchase identifier so reinstalling does not reset an allowance. These identifiers are pseudonymous, not necessarily anonymous, and can connect feature use with purchases. We do not store the signed Apple transaction, your ledger or AI request text in these security tables. For eligible remote-data requests, email privacy@baolabs.dev. See How to delete your data.

Apple Pay logging requires you to create a Wallet automation in Apple Shortcuts and connect its transaction fields. The in-app intake switch starts on, but FinTracker cannot read Wallet purchases until you set up that automation. Supported purchases are categorized using local rules without AI requests. Incomplete purchases wait in a protected local review inbox and do not affect spending totals. Import records and merchant rules are included in manual JSON exports; restoring an export leaves automatic logging off. Delete all data clears this information and disables intake. No bank-account aggregation is used. See the AI Disclaimer for the separate AI data flows.

4a. Website feedback and feature requests

If you use our website feedback board, we store the title, description and type of your request, votes and any team responses. We review new requests before publishing them. Approved requests and their vote counts are public. Please do not include names, account details or private financial information. No account or email address is required to use the board.

An essential, signed browser cookie remembers your votes and lets that browser manage your requests for up to one year. We store a keyed hash of the browser identifier, and short-lived keyed network hashes to limit spam and vote abuse. Our feedback database does not store the raw network address. Rate-limit records older than 48 hours are removed on subsequent activity. Our hosting provider may separately process ordinary access and security logs as described in this policy.

We use this information to operate the board, prevent abuse, review feedback and plan improvements. Requests and votes remain until removed as part of moderation, by the originating browser where available, or following a supported deletion request. You can delete your own request from the browser used to submit it. Clearing the cookie removes that browser’s ability to manage previous votes and requests. For help removing a post, contact privacy@baolabs.dev with its title and details that help us verify the request. We do not use feedback-board content for advertising or sell it.

The board cookie is necessary for the voting and request-management functions you choose to use. We process feedback and limited abuse-prevention records for our legitimate interests in operating a useful, safe feedback service and improving FinTracker. The rights and contact options in this policy also apply to feedback-board data.

5. Data we do not ask for

  • We do not ask for bank login credentials. Text you choose to speak, type, or scan may still contain financial identifiers; receipt-text masking is best-effort.
  • We do not ask for government identification numbers. Please avoid including them in AI requests.
  • Your precise or coarse location. FinTracker has no geolocation.
  • Your contacts, calendar, or photos beyond receipts you explicitly attach.
  • We do not use an advertising identifier or track you across other companies’ apps and websites for advertising.

6. How we use what we collect

  • Waitlist email: to send launch-related updates you agreed to receive. You can request removal at privacy@baolabs.dev or use an unsubscribe link when provided.
  • App functionality: local tracking, optional AI, purchases, rate suggestions, and fair-use enforcement. Your ledger stays on your device; limited request content is transmitted for online features.
  • Product analytics: when enabled, PostHog receives a persistent pseudonymous identifier and feature-use events. FinTracker does not intentionally attach ledger amounts, notes, or AI text to analytics. You can turn off app-side product analytics under Settings → Privacy & data. Necessary subscription records and server-side purchase-event forwarding remain separate. Sentry crash and performance diagnostics are collected separately from this toggle.

We do not sell your data. We do not share it with advertisers. We do not use it to train AI models.

7. Where your data is stored

  • Website waitlist data: Supabase, Frankfurt, Germany (EU).
  • Supabase service: fair-use counters, purchase-security records and website feedback-board records in our EU project. AI content passes through the relay to the configured provider; the relay does not keep a cloud ledger or chat-history database.
  • Website hosting: Vercel, with global edge delivery for static assets. Earlier waitlist form submissions were stored in the EU.

Some processing happens outside the EEA where strictly necessary:

  • AI providers: voice transcripts, Bao messages, receipt OCR text, and compact summaries may be processed outside the EEA. We do not promise EU-only AI processing or zero data retention. OpenAI’s default API abuse-monitoring logs may retain request content for up to 30 days, subject to its stated exceptions.
  • Apple and RevenueCat for App Store delivery, payments, and subscription validation and purchase-integrity checks.

8. Third parties we use

  • Supabase: earlier waitlist storage, AI relay, and website feedback-board records, fair-use counters and purchase-security records in our EU project.
  • Vercel: website hosting and edge delivery. Region: global with EU preference for compute.
  • AI providers: online voice, chat, receipt, and weekly-insight processing. FinTracker supports OpenAI, with Anthropic and Gemini alternatives for some features. Processing follows the provider selected for the service and its data terms. We do not use API content to train our own models. OpenAI states that API content is not used for training by default.
  • PostHog: product analytics under a pseudonymous identifier, with an in-app opt-out (Settings → Privacy & data). Region: PostHog EU Cloud.
  • Sentry: crash and performance diagnostics, separate from the analytics toggle. Reports may include technical device, app, and error information. FinTracker does not intentionally attach financial entries or AI request content.
  • RevenueCat: validates subscriptions and one-time Bao outfit purchases with App Store transaction data and a pseudonymous app-user identifier. It supplies subscription access information to the app and our AI relay.
  • Apple: App Store distribution and payment processing and app/purchase-integrity checks. Region: per Apple.

These services handle limited data for the purposes described here under their applicable terms. They may maintain security, operational, or legally required records. Contact privacy@baolabs.dev for help with an eligible data request.

9. Your rights under GDPR

If you’re in the EEA or UK, you have the right to:

  • Access the personal data we hold about you.
  • Correct anything inaccurate.
  • Delete your data (the "right to be forgotten").
  • Export your data in a portable format.
  • Object to processing, or restrict it.
  • Withdraw consent at any time. For the waitlist, use an unsubscribe link when provided or contact privacy@baolabs.dev.

To exercise any of these rights, email privacy@baolabs.dev. We’ll respond within 30 days, free of charge. Because your finance data lives on your device, you can exercise most of them yourself: export everything as JSON or delete everything in the app’s Settings or read-only access screen. See How to delete your data.

You can also lodge a complaint with your local data protection authority. For UK residents, that’s the ICO (ico.org.uk). For EU residents, it’s your national DPA.

10. Children

FinTracker’s launch edition is for adults 18 and older under the Terms and Conditions accepted during setup. The app does not verify age or identity. We will review safeguards and access for minors before expanding eligibility.

A parent or guardian can contact privacy@baolabs.dev about a child’s waitlist email or other eligible data request.

11. How long we keep your data

  • Waitlist signups: kept while we administer launch updates, then deleted when no longer needed. You can request earlier deletion at privacy@baolabs.dev.
  • Local app data: remains on your device until you erase it or remove the app. Delete all data clears the local ledger, chat history, Apple Pay import records, and merchant rules and disables Apple Pay intake. It does not cancel Apple purchases or erase separate backups, exports, or prior records held by service providers. Email privacy@baolabs.dev for an eligible remote-data request.
  • AI request content: FinTracker does not keep a cloud chat-history copy. OpenAI requests disable stored completions, but this is not zero data retention: default abuse-monitoring logs may retain content for up to 30 days, subject to OpenAI’s stated exceptions. Other configured providers apply their own retention terms.
  • Purchase-security and fair-use records: security challenges are usable for five minutes. Issuance-rate records expire after two days, and app-key records expire after 90 days without use. Expired records are cleaned up when the challenge service runs, so physical removal can occur later. Fair-use counters currently remain until an eligible deletion request is completed or we apply an operational retention policy. Local reset does not automatically delete remote purchase-security, fair-use or provider records.

12. Security

  • Data sent to our online services uses encrypted HTTPS connections. Your local ledger is protected by iOS data protection. Optional Face ID protects viewing inside the app; Shortcuts can still save purchases in the background when Apple Pay logging is enabled.
  • Our Supabase project stores earlier waitlist data and pseudonymous fair-use counters and purchase-security records. It does not store a cloud copy of your ledger. AI request text is processed by the relay and configured provider.
  • We restrict production access and review provider and release configuration. No system can be promised risk-free.
  • If a personal-data breach occurs, we will assess notification obligations under applicable law, including GDPR Article 33 where it applies.

13. Changes to this policy

We will update this page and its last-updated date when practices change. We will provide any advance notice required by applicable law for material changes.

14. Contact