Finance Tracker Back to login

Privacy Policy

Last updated: 9 October 2026

1. Who we are

Finance Tracker is operated by FDO S.R.L. ("we", "us"), a company registered in Romania (sole registration code / CUI 33914411, Trade Registry J05/1943/2014), with its registered office in Oradea, Bihor County, Romania. We operate the Finance Tracker application at https://eu.financetracker.net. For any privacy or data-protection question, contact privacy@financetracker.net.

2. Data we collect

  • Account & profile data you provide (name, email, language and preferences).
  • Financial records you enter (accounts, transactions, categories).
  • Bank account information you choose to link (balances, transactions, account details), retrieved on a read-only basis via Account Information Services — see §3.
  • Technical data (application logs, device / usage) needed to operate and secure the service.

3. Open Banking / Account Information Services (AIS)

When you link a bank account, we access your account information on a read-only basis under PSD2, through a licensed Account Information Service Provider (for example, Enable Banking). We never initiate payments. Access occurs only with your explicit consent, which you grant at your bank and may withdraw at any time; consents expire periodically (typically up to 90 days) and must be renewed.

4. How we use your data

To provide the service (track and reconcile your finances), secure your account, comply with legal obligations and — only where applicable — communicate with you about the service.

5. Legal basis (GDPR)

Performance of our contract with you; your explicit consent (for bank-account linking); and our legitimate interests in operating and securing the service.

6. Sharing & processors

We share data only with service providers that help us run the application (for example, cloud hosting and the Open Banking aggregator). We do not sell your data. Our key processors are Amazon Web Services (cloud hosting in the EU region) and Enable Banking (the licensed Open Banking / Account Information Service provider).

Push notifications for the mobile app are delivered through Google LLC's Firebase Cloud Messaging. A push carries only a short title and text, never amounts or merchant names, and you choose per category whether to receive in-app, push or email notifications under Settings → Notifications (the security category is always on).

7. Retention

We keep your data while your account is active and as required by law. When you unlink a bank, we stop syncing and end our access at the bank-data provider; the transactions already imported stay in your records until you delete them or your account. When you delete your account, it is erased as described in section 8a, except where we are legally required to retain specific records (for example to meet accounting or anti-fraud obligations), in which case those records are kept only for the period required by law. Our application logs, which record sign-ins and other security events, are kept for up to 12 months and then deleted automatically; our database backups are kept for 7 days.

8. Your rights

Subject to applicable law you may access, correct, export or delete your data, object to or restrict processing, and withdraw consent. Contact privacy@financetracker.net; you may also lodge a complaint with your data protection authority.

8a. Deleting your account and data

You can permanently delete your account and all of its data at any time, directly from the app, without writing to us:

  • Mobile app: open the menu, tap your profile, choose View & Edit Profile, scroll to Delete account, and confirm.
  • Web: go to your profile, scroll to Delete account, and confirm.

Deletion is irreversible. The moment you confirm, you are signed out, your account can no longer be used, and we end every linked-bank connection, at the bank-data provider too. Thirty days later we erase your profile, all of your accounts, transactions and categories, and the bank data derived from your connections; until then that data is kept out of use, only so that a mistaken or unauthorised deletion request can be investigated. Copies in our database backups expire within 7 days of the erasure. We keep only a specific record we are legally required to retain, for the period the law requires. If you cannot access the app, you may instead request deletion by emailing privacy@financetracker.net.

9. Automated transaction categorisation (GDPR Art. 22)

When you import bank transactions, Finance Tracker automatically assigns a spending category to each transaction using a rule-based system. The categoriser checks (in order): MCC merchant codes, your personal merchant aliases, your bank's own category labels, keyword rules, and finally an "Uncategorised" fallback.

This automated assignment does not produce any legal or similarly significant effect on you — it is a UI convenience label you can correct at any time by tapping the category on any transaction. No access to credit, insurance, or any other product or service is gated on the auto-assigned category. The processing therefore falls within the Art. 22(2)(a) exception (necessary for the performance of the contract you requested).

We do not send your transaction data to external AI or machine-learning services. All categorisation runs locally within Finance Tracker.

10. Security

Passwords are stored only as salted hashes. Provider access tokens and two-factor secrets are encrypted at rest, and all transport is encrypted (TLS). Repeated failed sign-ins and wrong two-factor codes are blocked for 15 minutes, and access is strictly scoped to your own data. Access to the administration console requires two-factor authentication and is logged.

11. Changes

We may update this policy; material changes will be notified within the application.