Privacy Policy

Most visitors never sign in — they just leave an email to reserve a spot. In that case we store only your email address, your answers to the four optional questions, your place in line and referral code, and basic joining context (which link brought you here). No financial data, because you haven't given us any.

We use that email for one thing: to tell you when your wave opens. No newsletters, no marketing blasts, and we never pass it on. Ask us to remove you at any time (address below) and the row is deleted.

Account details. When you sign in with Google we receive your name, email address, and profile picture — nothing else from your Google account.

What you declare. The holdings, balances, coverages, and documents you add to your record yourself.

Statements. Bank and card statement PDFs you upload, or that fyna files for you from Gmail when you explicitly connect it (see below).

Usage analytics. We use PostHog to understand how the product is used (pages visited, features used, errors) and to replay sessions with every input masked— nothing you type is recorded. Analytics never see your statement contents or your balances. To be precise about location: your financial records live in India (below), while these product analytics are processed on PostHog's US infrastructure.

Connecting Gmail is optional and read-only (gmail.readonly). fyna searches only for e-statement emails from known banks and card issuers, and files the statement PDF attachments into your record. We do not read, store, or analyse the rest of your inbox, and we never send email on your behalf. You can disconnect Gmail at any time from within the app, which stops all access immediately.

fyna's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to provide the statement-filing feature you see in the product — never for advertising, never sold, never used to train generalised AI models, and never read by humans except with your explicit consent, for security, or to comply with law.

Your data lives in a managed Postgres database (Supabase) hosted in Mumbai, India, encrypted at rest and in transit. Every row is isolated to your account with row-level security — no other user can query your data. Statement passwords, Gmail tokens, and identity details used to open PDFs are stored in an encrypted vault, never in plain text and never in logs.

When a statement is parsed, identifying details are redacted before any text is sent to our AI parsing provider (Google Gemini). The AI sees transaction lines, not who you are.

We never sell or rent your data. We never share it with brokers, lenders, insurers, or advertisers. We don't cross-sell financial products. Your net worth is your business, not our inventory.

Deleting your account removes your record — holdings, statements, documents, tokens, and analytics identity — from our systems. You can also disconnect Gmail alone at any time. For deletion requests or anything else, write to jaygosalia4@gmail.com.

If this policy changes materially, we'll note it here with a new date. Continued use after a change means you accept the updated policy.