Privacy Policy
Document version: 2026-10-20-v1
Finmonk is a free alpha operated by Farhat Ali Khan in Bengaluru, Karnataka, India. For privacy questions, access or deletion requests, contact gullakpilot@gmail.com.
Alpha privacy notice. The operator has not provided a postal address for publication. The applicability of Indian address-disclosure and grievance-contact requirements remains unresolved; no registered company, exclusive court jurisdiction or legal-compliance claim is implied.
Your financial records and Gmail
Finmonk stores the plans, caps, bills and financial records you save in its authenticated cloud account infrastructure (Supabase). Connecting Gmail is optional and requires its separate explicit read-access permission. Gmail processing looks for supported financial emails and stores extracted records and evidence references for your review. Statement import and manual tracking are alternatives. Agreeing to the Terms does not connect Gmail, authorize a new financial import or grant additional Gmail access. The Gmail and financial-data permission controls remain separate.
Imported statements and inbox processing may contain financial and personal information. They are separate from usage analytics. Enter statement passwords only in the statement-password control; never send them in feedback or support messages. Review extracted records; statement evidence does not establish complete transaction coverage.
Optional remembered statement passwords
Optional consent notice version: 2026-10-22-v1. Without the unchecked Remember choice, a statement password is used only for that request/session. Remembering requires a confirmed card/account and a separate server-recorded approval. The password is encrypted with authenticated owner/source binding; its versioned server key is separate from the database. It is not included in usage analytics, financial backups, exports or error messages. Future supported Gmail attachments may be retrieved and parsed for review; this does not prove full coverage or automatically record purchases. Replace requires another explicit Remember choice. Forget disables future reuse and removes the stored ciphertext and cached statement-processing results. Account/data erasure removes owner-linked passwords and receipts. There is no automatic age-based expiry for remembered passwords or these receipts; use Forget or account deletion. Consent receipts remain after Forget until account/data erasure. In-flight parsing is denied publication after revocation.
Optional usage analytics and PostHog
The separate optional analytics choice controls collection of approved usage events and forwarding to PostHog US Cloud, to understand financial clarity, decisions and use of the alpha. Acknowledging this policy does not opt you in. Existing opt-outs remain in effect; an unknown or declined choice must not forward events.
Events use a stable server-generated pseudonymous identifier, event ID, event name, time and tightly allowlisted categories such as an explicitly selected decision. These are pseudonymous, not anonymous: the operator can associate activity with an account through protected server information. Retry event IDs are preserved to avoid counting an action twice. Analytics failures do not block financial saves.
Analytics excludes amounts, balances, descriptions, merchant text, email addresses, account or card details, tokens, free text and full URLs. Autocapture, session replay, automatic pageviews and person-profile creation are disabled. Finmonk does not forward your browser IP or browser metadata in these events. Infrastructure providers may separately process connection information when serving requests.
Founder accounts and configured test accounts are excluded. One explicitly authorized disposable verification account may be used for synthetic checks. There is no historical backfill to PostHog. Forwarding remains disabled until its server configuration validates.
Retention and deletion
Current limitations: account records remain until you delete them or request removal; no general automatic financial-record or analytics expiry is promised. Actual PostHog project retention and provider backup expiry have not been verified. Opting out stops future collection/forwarding; it does not automatically erase events already received by Finmonk or PostHog.
There is no verified automatic age-based expiry for saved financial records, first-party usage events or approval records. They may remain while the account exists. Successful account deletion removes the login and its owner-linked records, including first-party usage events and document approvals, from active database tables. The deletion flow also removes stored incoming statement files and revokes connected Gmail access; a failed cleanup can require retry.
Incoming forwarded files have a seven-day access expiry and scheduled batch cleanup. A backlog or failure can delay physical deletion beyond seven days. This does not expire the extracted financial records. Provider backup expiry and this PostHog project's event retention have not been independently verified, so no 30-day or 90-day deletion guarantee is made.
For deletion of previously forwarded PostHog events, contact the operator. The app's account deletion does not call PostHog's deletion API. Provider deletion must be handled separately and is not claimed complete until confirmed. Declining analytics stops future collection and forwarding without erasing past events.
Your controls
Use Profile → Legal & privacy to decline or change optional analytics. You can pause or disconnect Gmail, review and correct saved records, export your data, or use the account deletion control. Gmail disconnection does not itself erase extracted records. Account deletion does not currently prove deletion of previously forwarded PostHog events or provider backups; request those separately at the privacy contact above.
Approval records and changes
When you explicitly submit the unchecked agreement control, Finmonk records the Privacy Policy and Terms versions and a server-generated approval time. Optional analytics is recorded separately. Changes to documents must use new versions and must not silently change your analytics choice. The server receipt is separate from the browser-supplied timestamp; finance-only saves and retries do not create another approval.