Privacy — Finora

The short version

Two separate parts. Your account (username, email, password) and your vault (your financial records) are not linked anywhere. A vault opens only with its Secret Key, and we never store the key.
We never connect to your bank and never ask for bank log-ins or card details to track your money.
We don't sell your data, show ads or use advertising or analytics trackers.
The AI tools only when you use them: a receipt photo or a chat question is sent to our AI provider for that one answer, and we don't keep it.
You can see, change and delete your data — see “Your rights” below.

1. Who we are

Finora (“we”, “us”) is a personal finance tracker run in Georgia. We are responsible for the personal data described here. Questions and requests: support@finora.app or the contact form on the Help page.

2. Your account and your vault

Finora keeps two kinds of information apart on purpose:

Your account — who you are when you sign in: username, email, password and your plan. This is personal data.
Your vault — your financial records: transactions, balance, categories, budgets, loans, deposits, shares, crypto, exchange rates and the vault's name. A vault is stored under a random number and opens only with its Secret Key. We keep only a one-way fingerprint of the key, which cannot be turned back into it, and nothing in our database says which account a vault belongs to. Even our team cannot tell which vault is yours.

Because a vault is not linked to anyone, we cannot open it for you, recover it if you lose the key, or send its owner a reminder.

3. What we collect

Your account

Username, email address and password — the password only as a secure hash.
What you choose to add in Settings: first and last name, a profile photo and your time zone; and the language you use.
Your plan: which plan, from and until when, and how you got it (a payment, or given by us).
For the AI tools: how many receipt scans and AI Chat messages you used each month and what they cost us — numbers only, never the photo, the question or the answer.
If you ask to delete your account: the date and, if you give it, the reason.

Signing in

One-time codes we email you (registration, sign-in, password reset). A code works once and expires within minutes.
While you are signed in: your session with your IP address, your browser and the time of your last activity.
Wrong passwords, codes and Secret Keys are counted for a short time, per account and per network, to block guessing.

Messages to us

Your name, email, topic and message from the Help contact form and, if you were signed in, which account sent it. We use them only to answer you.

Payments

Payments are handled by our payment provider, a licensed bank. We receive only what we need for your plan — the payment's status, amount, date and plan. We never receive or store your full card number.

What we never collect

bank log-ins, bank statements or card details for tracking your money;
your location, contacts or anything else from your device;
a link between your account and your vault.

4. Why we use it

To provide Finora — your account, sign-in, plan and its limits (our agreement with you — the Website Rules).
To keep it secure — two-step sign-in, blocking guessing and abuse (our legitimate interest in a safe service).
To email you — codes, important notices about your account or plan, and changes to our terms. We don't send marketing emails without your consent.
To meet the law — for example accounting and tax records of payments.

5. The AI tools

The receipt scanner and AI Chat (Finora Pro and Max) use Claude, an AI model made by Anthropic.

Receipt scanner: the photo you take and the names of your vault's expense categories are sent to Anthropic for one answer. We delete the photo right after it is read. Your name and email are not sent — but anything printed on the receipt (for example a name on a pharmacy receipt) is part of the photo.
AI Chat: your question is sent together with the records from your open vault that are needed to answer it. The conversation stays only in your session and is gone when you clear it or sign out. AI Chat only reads the vault and changes nothing.
Under its commercial terms, Anthropic does not use this data to train its models.
AI can make mistakes — check its answers before you rely on them.

6. Who else processes data

We share data only with the providers that run Finora for us, and only what each of them needs:

Hosting — DigitalOcean: our servers, where everything Finora stores is kept.
Email delivery — our email provider: your email address and the emails we send you.
Payments — our payment provider (a bank): the payment details you enter on its page.
AI — Anthropic (USA): only what you send with the AI tools, as described above.
Prices — NarwhalAPI gives us share and crypto prices; we send it only the symbols from our list (such as AAPL), never anything about you. Exchange rates come from the National Bank of Georgia in the same way.
Fonts — our pages load fonts from Google Fonts, so your browser connects to Google, which sees your IP address.

We don't sell or rent data. We give it to authorities only when the law requires it.

7. Data outside Georgia

Some providers (Anthropic, and possibly our email and hosting providers) process data outside Georgia, including in the USA and the European Union. We use only providers that commit to protecting it, and send them only what is needed.

8. Cookies

We use only the cookies Finora needs to work — no advertising or analytics cookies, so we don't ask for cookie consent.

Session — keeps you signed in and protects forms; it ends when you sign out or after a while without activity.
Remember me — if you tick it, keeps you signed in on that device for 30 days.
Vault — remembers which vault is open on this device: until you close the browser, or up to 30 days on a trusted device. It holds the vault's number and a random token — never your Secret Key.
Language — remembers the language you chose.

9. How long we keep data

Account — while you have it. When you delete it (Settings → Delete account), the account is anonymized after 30 days: your username, email, name and photo are erased, and what remains (your plan and payment records) is no longer linked to you; signing in during those 30 days cancels the deletion. Messages you sent us are kept without your name and email.
Vault — until you delete it, or until 12 months pass without anyone opening it; then it is deleted with everything in it. A deleted vault can't be opened by anyone; its records remain only as deleted entries that are not linked to any person.
Sessions — until you sign out or the session ends.
Email codes — they expire within minutes and work only once.
Messages to us — as long as needed to answer you and keep the history of your request.
Payment records — as long as accounting and tax law requires.
Receipt photos — not kept at all.

10. Security

Every connection is encrypted (HTTPS).
Passwords are stored only as secure hashes, and signing in takes two steps: your password and a one-time code by email.
Your Secret Key is never stored — only its one-way fingerprint.
After repeated wrong passwords, codes or keys, that action is blocked for 15 minutes.
Uploaded files are checked by their content; only images are accepted.
Our team works with accounts (sign-in, plan), never with what is inside a vault.

We will never ask you for your password, an email code or your Secret Key.

11. Your rights

Under the Law of Georgia on Personal Data Protection you can:

ask what data we have about you and get a copy of it;
download everything in your vault yourself, at any time — on the Vault page, as Excel or CSV;
have it corrected — most of it you can change yourself in Settings;
have it deleted — Settings → Delete account;
object to how we use it or ask us to limit it;
withdraw a consent you gave, at any time.

Write to support@finora.app from your account's email address. We answer without undue delay and within the time the law sets. Because vaults are anonymous, we can't find, show or delete a vault for you — open it with its key and use Clear or Delete on the Vault page. If you think we handle your data wrongly, you can complain to the Personal Data Protection Service of Georgia.

12. Children

Finora is for people aged 18 and over. We don't knowingly collect children's data; if you think a child has an account, write to us and we will close it.

13. Changes to this policy

When we change this policy, we update the date at the top. If a change is important, we email you before it applies.