Privacy Policy

Who runs the service

The data controller for FinCosmos is MARS PRO IT SOLUTIONS S.R.L., of str. Alexandru Vaida Voevod nr. 14, Cluj-Napoca, Cluj county, 400592, Romania, registered under number J12/1677/2021, tax code 44052486. For any question about your data, write to [email protected]. Data protection contact: [email protected].

What we collect

Nothing you did not enter yourself, and nothing the service does not need in order to work. Specifically:

• The account: a username, an email address and a password. Signing up asks for nothing else — not your real name, not a phone number, not any identity document. Separately, Settings → Account offers an optional first name, last name, phone number and country; those are stored only if you type them, and nothing in the app requires them.
• Your records: amounts, dates, categories, descriptions, savings goals, debts, recurring templates and your workspace settings. All of it is there because you typed it, because it came from a template you set up, or because you confirmed it from a CSV file.
• Interface preferences: your language, your theme and the currency you ask to see totals in.
• Technical context, for a few sensitive actions only: your IP address and browser type, recorded when you ask for a password reset, when you share a workspace, and when a platform administrator acts on your account. The application does not store your IP address on every request you make. The web server in front of it does keep its own access log, as any web server does, and that log contains the address of every request; it belongs to the hosting infrastructure named below.
• We collect no payment data. There is no billing, so there is no card, no bank account number and no billing address to store.

Where your data lives

Every account gets its own schema in the PostgreSQL database. This is not a filter in a query over a shared table; it is a structural separation, and your account’s data sits in tables that belong to your account alone. The active schema is bound to the current request’s context and is never persisted by a transaction, precisely so that a request cannot end up in somebody else’s schema by accident.

Passwords and sessions

Your password is stored only as a hash and cannot be read back by anyone, ourselves included. If you forget it we cannot tell you what it was; we can only send you a reset link. Sign-in attempts are rate limited, so a password cannot be found by guessing repeatedly.

Signing in gives you a session cookie valid for 90 minutes. While you are using the app it renews itself quietly in the background; the renewal has a ceiling of its own, seven days from sign-in, after which you have to sign in again. Pressing Log out invalidates both tokens on the server immediately, rather than merely clearing them from the browser.

Encryption at rest: what it covers and what it does not

This has to be precise, because the usual phrasing — “your data is encrypted” — would be misleading. What we encrypt at rest are the service’s stored secrets: provider API keys and the mail server password. In production the application refuses to save such a secret at all when no encryption key is configured, rather than writing it in the clear and reporting success.

Your financial records are not encrypted row by row in the database. They cannot be, for as long as the server computes on them: the financial health score, the tax estimate, the safe-to-spend figure and the consolidation across workspaces are all arithmetic done on the server. The only design where the operator genuinely cannot read the data is one where the key is derived from your password and the server never sees plaintext — and that would end almost everything the app does, and turn a forgotten password into permanently lost books.

Encryption at rest defends against a database dump, a leaked backup, a stolen disk, or a read-only copy someone forgot about. It does not defend against anyone who can run the application, because the application holds the key. We would rather say so than leave the opposite impression.

In production the session cookies are marked Secure, so they travel only over an encrypted connection.

Where the server runs

The application and the database run on servers operated by MARS PRO IT SOLUTIONS S.R.L. in Romania, and on Microsoft Azure in Germany. Both are inside the European Union, so your data is not transferred outside it. Backups are kept for 60 days.

The language model: where it is used, and what leaves the server

A language model is used in exactly two places, both of them inside the statement import — CSV, PDF or ZIP: to guess what the file’s columns mean, and to suggest a category for each row. That is all.

No number displayed in the app comes from a model. The estimated tax, the safe-to-spend figure, the thresholds, the health score and the consolidation are arithmetic over your own records. The dates and amounts in a statement — CSV or PDF — are read out of the original text by ordinary code, not by a model, and nothing the model suggests enters your records until you press the import button.

If a hosted provider is configured — and, per the commitment below, only one inside the European Union — then what leaves the application server for it, without leaving the EU, is: the column names and the first five rows of the file, verbatim as they are written in it; then, in batches, each row’s description (the first 200 characters), its amount, its direction, and the list of your category names. Your username, your email address, the rest of your records and any account identifier do not leave.

The provider is a deployment setting rather than a choice written into the code. The operator commits to using only a model hosted within the European Union or a server it hosts itself — never a provider that would take the data outside the EU, precisely so that what is written above about hosting stays true. By default none is configured, and the import is then simply unavailable — the import screen says so before you upload anything, instead of failing on first use.

We do not connect to your bank

FinCosmos has no connection to your bank accounts. We do not use Open Banking, we never ask for bank credentials, and we cannot initiate a payment. Records reach the app in three ways: you type them, they are created from a recurring template you defined, or you confirm them from a statement — CSV, PDF, or a ZIP of several — that you exported from your own bank and reviewed before importing.

Sharing a workspace

You can invite another account to see one of your workspaces, by an invitation sent to an email address. That means exactly what it sounds like: that person sees the records in that workspace. The role you give decides what they can do — a viewer only reads, an editor can also write, an accountant reads everything and can pull the handover file for accounting. You can revoke access at any time, and an invitation that is never accepted expires after seven days.

The email address you invite is kept on that grant, so the invitee can accept it and so it is recorded who was given access. Granting and revoking access are written to the audit log, along with the IP address they were done from.

Email

The only messages we send you are transactional: a password reset, a workspace invitation, and a reply to a message you sent us through the support form. There is no newsletter, there is no marketing mail, and there is no list you are added to. We do not sell or rent your address to anyone.

Tracking and analytics: none

There is no Google Analytics, no Facebook pixel, no Hotjar, Mixpanel, Segment, Amplitude, PostHog or any other analytics tool. There are no advertising cookies and no third-party cookies. We build no profile of you and do not track which screens you open. That is a rare thing to be able to write, and we write it because it is true rather than because it sounds good.

The cookies we set are strictly the ones authentication depends on: the session token, the renewal token, and the two tokens that accompany them to protect against cross-site request forgery. None of them serves any tracking purpose.

Cookies and consent

The only cookies we set are the ones authentication cannot work without. There is no analytics cookie, no advertising cookie, and no third-party cookie. Here is each of them:

• The session token — keeps you signed in. Valid for 90 minutes, marked httpOnly and Secure, so it cannot be read from JavaScript and travels only over an encrypted connection.
• The renewal token — extends the session in the background, without re-authenticating, up to a limit of seven days from sign-in. It carries the same protective flags.
• The two anti-CSRF tokens — they accompany the tokens above and stop another site from acting in your name. Without them, any write is refused.

We ask for your consent to none of them, and you see no cookie banner — because the law does not require one here. The ePrivacy Directive, and the Romanian law that transposes it, exempt from consent the cookies strictly necessary to provide the service you asked for, and these four are exactly that: without them you cannot sign in. A banner asking for your “consent” to something that has no alternative would be misleading, not compliant. Consent becomes mandatory only for analytics, marketing or third-party cookies — which we do not use. Should that ever change, you will see a real consent request, with choices per category and refusing as easy as accepting, before any such cookie is set, and this section will be updated.

Your browser’s local storage keeps the language you chose and a copy of the interface state — the active workspace, your display preferences and the last data loaded — so the app does not start empty on every reload. It is not a cookie and it leaves your device for nowhere; you can clear it from your browser settings at any time.

What your browser contacts, and what the server contacts

The JetBrains Mono font used for figures is served from the application’s own servers, not from Google Fonts. To load it, your browser makes no request to anyone else’s domain, so opening the app discloses your IP address to no third party. It was served from fonts.googleapis.com until recently; we moved it in-house precisely so that no IP would leave for Google before the first paint — a moment at which you could not have consented anyway.

The server, for its part, downloads reference exchange rates once a day from the European Central Bank and, where the operator has configured it, historical rates from an external provider. Those requests contain nothing about you or about your records.

You can take your data

Settings → Account → “Download my data” hands you, in a single JSON file, everything the account holds: workspaces, records, categories, goals and settings. Amounts are exact, written as text so a cent cannot be lost to rounding. The file contains no password hash and no other value that authenticates you. Exporting deletes nothing.

You can close your account

Settings → Account → “Close account”, confirmed with your password. The account stops working at once and every session is invalidated immediately, on every device. The data is kept for a grace period so that a mistaken press can be undone by a human; the exact number of days is set by the server and is shown to you before you confirm. Once it has passed, your database schema is destroyed entirely, along with the rows that let you sign in, and none of it can be recovered. A deletion that never deletes is not a deletion.

What does not go with the account

The platform’s audit log keeps a trace of sensitive actions — a password reset, a share, an administrator intervening: which action it was, when it happened, under which username and from which IP address. The username is written there separately, precisely so the entry stays readable after the account is gone, and these rows are not removed by deletion. They contain none of your amounts, categories or descriptions.

Backups already taken are not rewritten the moment you close your account: they are kept for 60 days and then expire on their own schedule.

Your rights

If you are in the European Union, the General Data Protection Regulation gives you the right to access your data, to have it corrected, to have it erased, to restrict how it is processed, to object, and to portability. Two of those are already buttons in the app: portability is the JSON export, and erasure is closing the account. For the others, write to [email protected].

You also have the right to complain to the supervisory authority in the country where you live. The authority competent for the operator of this service is the National Supervisory Authority for Personal Data Processing (ANSPDCP), Bucharest, Romania.

The basis for processing

Your account data and your records are processed to perform the contract between you and us — that is, to provide the service you asked for. The audit log of sensitive actions and the rate limiting of sign-in attempts rest on the legitimate interest of keeping the service secure.

Security, said honestly

There has been no external security audit. The product is in alpha. We apply the measures described above — separate schemas, passwords only ever as hashes, Secure cookies with cross-site request forgery protection, rate-limited sign-in, encrypted stored secrets — but nobody outside has checked them, and we will not claim otherwise. If you have found a security problem, write to [email protected].

Minors

The service is not intended for people under 16, and we do not knowingly collect data from them.

Changes to this policy

When the text above changes, the date at the top of the page changes with it. The app has no mechanism yet for telling you about a change automatically; if we add one, we will say so here.

Contact

For any question about your data: [email protected]. Email is the only support channel that reaches anyone, and while the product is in alpha we cannot promise a response time.