Privacy Notice
Last updated 23 August 2026
What this application is
This is a personal, self-hosted finance tracker. It is operated by a single private individual for their own use only. It is not a commercial service, it is not offered to the public, and it has no users other than its operator.
Who the data subject is
The operator of this application is its only end user. The only account data accessed is the operator’s own, held in the operator’s own name.
What data is accessed
Through Enable Banking Oy, a licensed Account Information Service Provider, and only after the operator authenticates directly with their own bank:
- account identifiers, including IBAN, account name, product type and currency
- account balances
- transaction records: amount, currency, dates, counterparty name and payment reference
No payment can be initiated. This application requests account information access only. It holds no payment initiation permission and contains no code capable of moving funds.
Bank credentials
This application never receives, requests, or stores bank credentials, passwords, PINs, or one-time codes. Authentication and strong customer authentication take place entirely within the bank’s own environment. What this application receives is an opaque session identifier.
Why the data is processed
To give the operator a consolidated view of their own finances. The data is not used for any other purpose.
Where the data is stored
In a database on hardware controlled by the operator. It is not hosted on a third-party platform, and it is not transmitted to any destination other than the bank interfaces described above.
Who the data is shared with
No one. There are no third-party recipients, no analytics, no advertising, no tracking, no profiling, and no automated decision-making. The data is not sold, shared, published, or transferred.
Data necessarily passes through Enable Banking Oy in transit, as the licensed provider through which bank access is obtained. Their handling of it is governed by their own privacy notice.
How long it is kept
Until the operator deletes it. As the sole data subject and sole controller, the operator may delete any or all of it at any time.
Withdrawing consent
Bank access consent can be withdrawn at any time, either by revoking the connection within this application, or directly through the bank. Consent expires automatically and requires periodic renewal.
Rights
As both the sole data subject and the operator, all rights under the GDPR — access, rectification, erasure, restriction, portability and objection — are exercisable directly and immediately.
Contact
Questions about data protection: riznica.paltry857@passmail.net