Privacy Policy

Who we are

Findure ("we", "us") is operated by Emam Shararah in Amman, Jordan, and provides the Findure app at app.findure.app and this website at findure.app. We are the controller of the personal data described here. For anything about your data, write to privacy@findure.app.

The short version

• Every amount, name, note and receipt photo you enter is encrypted before it is stored.
• We do not sell your data, show you ads, or share your figures with anyone for their own use.
• You can download everything you have entered, and delete your account, from Settings at any time.

What we collect

Your account. Your email address and a password, stored only as a bcrypt hash. We also keep a count of recent failed sign-ins so we can lock an account under attack for a few minutes, and, for each failed sign-in, a one-way, keyed hash of the network address it came from, for one day, so one network cannot try many accounts.

Your budget. What you enter: your income, currency, pay schedule, weekend and timezone; bills, subscriptions and categories; purchases with their dates, amounts, notes and up to two receipt photos each; and the history of your past pay cycles. Amounts, names, notes and photos are encrypted with AES-256-GCM before they reach the database. Dates, your pay schedule, timezone and currency are stored as they are, because the app needs to sort and compare them.

Notifications. If you turn on notifications, your browser gives us an address for its push service and the app address you subscribed from. We use it only to send payday reminders.

Requests to join. If you request access on this website, we keep the email address, name and note you send. If we decline, we delete the name and note and keep only the email address, so the same request is not reviewed twice. To limit abuse we keep a one-way, keyed hash of your IP address for one day.

Usage and performance. The app and this website use Vercel Web Analytics and Speed Insights, which count page views and measure loading speed without cookies and without identifying you. This website also uses Google Analytics. Until you choose “Allow” in the cookie notice it runs without cookies and sends Google only basic signals that a page was viewed; after you allow it, it uses cookies to recognise repeat visits.

We do not collect bank logins, card numbers or government IDs. Findure never connects to your bank.

Why we use it

• To run the service you asked for: showing your budget, working out your weeks and paydays, syncing your devices, and sending reminders you turned on. This is necessary to perform our agreement with you.
• To keep accounts secure: password hashing, sign-in limits, session management and abuse prevention. This is our legitimate interest, and yours.
• To understand and improve the website and app from anonymous usage counts, and from Google Analytics on this website only with your consent.
• To meet legal obligations where a law requires us to keep or disclose something.

We do not use your budget data for advertising, profiling or training models, and we do not make automated decisions about you.

Who processes it for us

• Vercel Inc. hosts the app and this website and runs the app’s server code (United States and its global network).
• Neon Inc. hosts the database, in Frankfurt, Germany.
• Google LLC provides Google Analytics on this website (with cookies only if you consent).
• Your browser’s push service (Apple, Google or Mozilla) delivers notifications you turned on. A reminder contains no figures from your budget.

Each acts on our instructions under its own data processing terms. Your data may be processed outside your country, including in the United States; where the law requires a transfer mechanism, these providers offer standard contractual clauses. We may disclose data if a valid legal order requires it.

Who can see your figures

Each account sees only its own data. Encryption protects your data if the database itself is ever exposed. Because the app has to decrypt your budget to show it to you, the encryption key lives on our servers, so we are technically able to read your data. We only access an account’s data when you ask us to help with it, or when the law requires it.

How long we keep it

• Your account and budget, including past cycles, until you delete them.
• When you delete your account, everything in it is removed from the live database at once. Copies in our database provider’s backups expire within 30 days.
• “Wipe all data” in Settings removes your cycles and purchases straight away, on the same backup schedule.
• Declined join requests keep only the email address. Hashed network addresses, from join requests and failed sign-ins, are deleted after a day.
• Hosting logs kept by Vercel expire within 30 days.

Your rights

Wherever you live, you can:

• See and export your data: Settings, then Account, then Download my data.
• Correct it: everything you entered can be edited in the app.
• Delete it: Settings, then Account, then Delete account.
• Withdraw consent to Google Analytics on this website at any time from the cookie notice link in the footer.
• Object, restrict or ask a question about how we use your data, by writing to privacy@findure.app.

We answer requests within 30 days. You can also complain to the data protection authority where you live; in Jordan that is the authority set up under the Personal Data Protection Law (No. 24 of 2023), and in the EU or UK your national supervisory authority.

Cookies

The app uses one cookie, to keep you signed in, and stores your theme and privacy-blur choice in your browser. These are necessary for the app to work and need no consent. This website sets Google Analytics cookies only after you choose “Allow” in the cookie notice, and the Cookies link in the footer lets you change your mind; choosing Decline also removes cookies already set.

Security

Connections use HTTPS. Budget data is encrypted at rest, passwords are hashed with bcrypt, sign-in attempts are limited, and changing your password signs out your other devices. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the relevant authority as the law requires.

Children

Findure is for people aged 16 and over. We do not knowingly collect data from anyone younger; if you believe a child has an account, write to us and we will delete it.

Changes

If we change this policy in a way that matters, we will show the new version in the app and ask you to accept it before you continue. The date at the top always shows the current version.

Contact

Emam Shararah, operating Findure, Amman, Jordan. privacy@findure.app