Privacy

Privacy policy

This policy covers the Fainto Android app, this website, and the Fainto Web browser companion. In short: your financial data lives on your device by default, we run no ads, analytics, or trackers, and nothing about your money leaves your phone unless you deliberately switch on an optional feature — an account for backup & sync, Cloud AI, or the web companion. It's written to meet the EU/UK GDPR and Google Play's User Data policy.

Who we are

Fainto is made by Mohsen Rezania, based in Poland — the data controller under the GDPR. For anything privacy-related — including exercising your rights below — contact [email protected].

What the app stores, and where

Everything you put into Fainto — accounts, balances, transactions, income, bills, budgets and the figures used by the tax tools — is stored locally on your device. No account is required to use Fainto, and until you create one, we never receive, see, or store your financial data on any server. Your data is never sold, rented, or shared — with or without an account.

Optional account: backup & sync (off unless you sign in)

Creating a Fainto account (email & password, or Google Sign-In) is optional. If you sign in, the app backs up and keeps in sync your financial data — transactions, budgets, net-worth entries, portfolio and crypto holdings, detected subscriptions, recurring payments, app preferences and your AI coach chat history — in Google Firebase (Firestore), stored under your account and protected by per-user access rules. It is encrypted in transit and at rest on Google's infrastructure, though not end-to-end. If you join a household, the budgets you choose to share are visible to the other members of that household. Google acts as our data processor and may store this data on servers outside the EEA under Google Cloud's data-processing terms (including the EU's standard contractual clauses); nobody else receives this data, and we run no ads or analytics on it.

Fainto Web (the browser companion)

fainto.app/web shows your finances on a bigger screen, two ways. Pairing (no account): your phone streams your data straight to your browser over an encrypted peer-to-peer connection — it is never stored on a server. To establish the link, a short-lived pairing record (connection metadata, including the network addresses the two devices need to find each other) is held in Firebase only while pairing — it is deleted when the connection is made, and marked to expire after five minutes in any case — and Google's STUN service is used for address discovery. What you see stays in the browser tab and is cleared when the tab closes. Sign-in: the browser reads the data your account already syncs, over an encrypted connection; the Google sign-in window is provided by Google and governed by Google's own privacy policy. A sign-in session stays in this browser until you clear the site's data. The web companion loads the Firebase software from Google's servers and contains no ads, analytics, or trackers.

The on-device AI coach

Fainto's AI coach runs language models directly on your phone. In the default on-device mode, your questions and financial context are processed locally and never leave the device.

Optional Cloud AI (off by default)

Fainto includes an optional Cloud AI mode — a Premium feature that is turned off unless you enable it. If, and only if, you switch it on and send a message, that message plus an aggregated financial summary (totals and categories — never your name, email, or payment names) is transmitted over an encrypted (HTTPS) connection to our AI gateway, OpenRouter, and the model provider you choose, solely to generate a reply. We don't use it for advertising. You can leave Cloud AI off to stay fully on-device; if you use it, please also review OpenRouter's own privacy terms.

What we never do

No advertising, no analytics or usage tracking, no third-party trackers or profiling SDKs, and no selling or sharing of your personal or financial data. By default the app makes 0 requests.

Permissions

The app requests only what a feature needs — chiefly internet access, used to download the on-device AI models you choose, to power optional Cloud AI, and — only if you use them — account backup & sync and web pairing. Granting or withholding access is your choice.

Keeping and deleting your data

Because your data lives on your device by default, you control it: to remove everything stored locally, clear the app's data or uninstall Fainto. If you created an account, delete it in the app (Settings → Account → Delete account) — this removes your synced data and the account itself from our servers; a separate Cloud reset removes just the server copy. You can also email us and we'll delete it for you. If you have emailed us, you can ask us to delete that correspondence at any time.

Security

Keeping your data on your device by default removes the biggest source of risk. Anything you opt to send — Cloud AI messages, account sync, web pairing — travels over encrypted connections, and synced data is encrypted at rest on Google's infrastructure.

Children

Fainto is a general-audience finance tool and is not directed to children under 13 (or the equivalent age where you live). We do not knowingly collect data from children.

This website

The pages of fainto.app set no cookies and run no analytics, ads, or trackers; the fonts are served from this domain. The contact form sends nothing to a server — pressing Send opens your own email app so you decide whether to email us. The one exception to "no third-party requests" is the web companion: it loads Firebase from Google and talks to Firebase only to deliver the pairing or sign-in you asked for, using browser storage strictly for that purpose — never for advertising or analytics — so no consent banner is required. Our web host may keep standard short-lived access logs (which can include your IP) purely to keep the site online.

Your GDPR rights

If we ever hold personal data of yours (for example, an email you send us), you have the right to access, correct, delete, or object to its use, and to complain to your local data-protection authority. Email [email protected] and we'll action it.

Changes

If this policy changes, we'll update this page and the date below.

Last updated: 17 July 2026 · [email protected]