Finsta
Privacy policy
Finsta is a personal and family finance app operated by Samchita, India. This policy explains what we collect, why, and what we cannot see. It applies to the Finsta Android, iOS and web apps.
What we can't see
Everything you enter in Finsta (your name, entries, amounts, notes, vault names and documents) is encrypted on your device with keys derived from your password before it is sent to us. We store only the encrypted result. We cannot read it, and we cannot recover it if you lose both your password and your recovery key. Your password never leaves your device.
What we collect
- Email address: to identify your account, confirm sign-up and send recovery codes.
- Phone number, if you choose to add one.
- Security events: sign-ins, password and recovery-key changes, with the IP address and device (browser or app version) used. These protect your account and are kept for up to 12 months.
- Usage counts: how many entries and documents you have, their encrypted sizes, and when a device was last active. We use these for plan limits and to run the service, never their contents.
- Subscription status: your plan, its renewal date, and the payment provider's subscription reference. We never receive your card, UPI or bank details.
- Referrals: if you sign up with a friend's invite link, which account invited you, so you both get the reward. Your friend only sees how many people joined, never who.
We do not use advertising, analytics or tracking tools, and we do not sell or share your data for marketing.
Who processes data for us
- DigitalOcean (Bangalore, India): our servers and database.
- Cloudflare R2: encrypted documents and encrypted-at-rest backups.
- Resend: delivers our emails (your email address and the message).
- Razorpay: web payments, under its own privacy policy.
- Google Play and the Apple App Store: in-app payments, under their own policies; RevenueCat receives your account ID (not your email) to confirm store purchases.
How long we keep data
We keep your account while it exists. When you delete it, your account, vaults, entries, documents and subscription records are deleted immediately. Copies in our encrypted backups are removed within 30 days. Security events are deleted after 12 months. We keep payment records our providers or the law require.
Your rights
You can view and export all your data from the app at any time (Menu, Export data), correct it, and delete your account (Menu, Delete account, or see how to delete your account). Under India's Digital Personal Data Protection Act, 2023 you may also ask us about the data we hold, ask for corrections, nominate someone to act for you, and complain to us or to the Data Protection Board of India.
Children
Finsta is not meant for children under 18, and we do not knowingly collect their data.
Security
Besides end-to-end encryption, all traffic uses HTTPS, staff access to the admin system requires two-factor authentication, and staff can never see your encrypted data.
Changes and contact
We'll post changes here and update the date above; for significant changes we'll also email you. Questions, requests or grievances: support@samchita.com.