Privacy Policy
This policy explains how [Operator legal name] (“Fiyna”, “we”, “us”) handles personal information when you use the Fiyna mobile app, its API and this website. It is written to meet the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and the privacy requirements of Google Play, the Apple App Store and Google and Apple sign-in.
1. Who we are
[Operator legal name] is the personal information controller for Fiyna. Address: [Registered business address]. Privacy contact: [privacy email].
2. What we collect
Information you give us
- Account details: your name, email address and password. Passwords are stored only as a salted hash; we cannot read them.
- Preferences: preferred currency, timezone and notification settings.
- Financial records you enter: accounts, transactions, categories, budgets, bills, loans, savings goals, shared expenses, repayments and optional receipt images. This data belongs to you.
- Shared space details: space names, member roles and invitations (the invited email address).
- Messages to us: anything you send to support.
Information created when you use Fiyna
- Sign-in and verification: one-time codes sent to your email, session tokens, and the time of sign-in. Codes are stored hashed and expire within minutes.
- Audit records: sensitive actions such as membership changes, ownership transfers and financial edits are logged with who, what and when, to protect the people in a shared space.
- Basic technical data: device type, app version, IP address and error reports, used for security, rate limiting and fixing bugs.
- Subscription status: your plan and its validity if you subscribe. Card details are handled by the app store, never by us.
Information we do not collect
- Bank credentials or account access. Fiyna does not connect to your bank and cannot move money.
- Biometric data. Face ID and fingerprint matching is done by your device. Fiyna only receives a yes or no result.
- Your App Lock PIN. It is stored only on your device as a salted, slow verifier, and is never sent to us.
- Contacts, precise location, advertising identifiers or health data.
3. How we use it
| Purpose | Information | Basis |
|---|---|---|
| Provide the app: accounts, spaces, budgets, shared expenses, reminders | Account details, financial records, space data | Contract; your consent |
| Verify your identity and keep accounts secure | Email, one-time codes, tokens, technical data | Contract; legitimate interest |
| Send service messages: verification codes, invitations, reminders | Email, notification settings | Contract |
| Prevent abuse and investigate incidents | Audit records, technical data | Legitimate interest; legal obligation |
| Improve Fiyna with privacy-conscious analytics | Feature usage events. Never transaction descriptions or amounts. | Legitimate interest |
| Comply with law and respond to valid legal requests | As required | Legal obligation |
We do not use your financial records to build advertising profiles, and we do not make automated decisions about credit, lending or eligibility.
4. Who we share it with
We do not sell your personal information. We share it only with:
- Other members of a shared space, limited to records you create in or share with that space. Your personal space is never shared.
- Service providers that process data for us under contract: cloud hosting, our managed PostgreSQL database provider, email delivery, push notification delivery, and error monitoring.
- App stores (Google Play, Apple App Store) for subscription purchases and restores.
- Authorities, when required by law, or to protect people’s safety or our legal rights.
- A successor, if Fiyna is part of a merger or acquisition, with notice to you and the same protections.
Notifications never include amounts or transaction descriptions.
5. Sign in with Google or Apple
When you choose to sign in or register with Google or Apple, we receive only the basic profile details you approve: your name, email address and a unique account identifier from that provider. We use them to create and secure your Fiyna account and for nothing else.
- We do not request access to your Google Drive, Gmail, Contacts, Calendar or any other Google or Apple data.
- Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
- We do not transfer that information to others except as needed to provide Fiyna, comply with law, or as part of a merger or sale with notice to you. We do not use it for advertising or sell it.
- If you use Apple’s “Hide My Email”, we send mail to Apple’s relay address and will never try to identify your real address.
- You can revoke Fiyna’s access in your Google Account permissions or Apple ID settings at any time. Revoking access stops sign-in with that provider; delete your Fiyna account to remove your data from Fiyna (see Delete your account).
6. Shared spaces and other people’s data
- Records in a shared space are visible to its members according to their roles (owner, administrator, member, viewer).
- If you are removed from a shared space or leave it, your access ends immediately. Records you created there stay attributed to you so that balances and history remain correct for the others.
- If you invite someone, we send them one email containing a single-use link that expires after 7 days. We use their address only for that purpose.
- Do not enter another person’s sensitive information unless you have a right to.
7. Security
We protect your information with encryption in transit (TLS), hashed passwords, hashed one-time codes and invitation tokens, server-side authorization on every request, rate limiting on sign-in and invitations, and secure storage on your device (iOS Keychain and Android Keystore). See Security. No system is perfectly secure; if a breach affecting you occurs, we will notify you and, where required, the National Privacy Commission, within the time the law requires.
8. Retention and deletion
- We keep your data while your account is active. Your financial history is never deleted because a subscription ends.
- You can request account deletion in the app or at Delete your account. We process deletion requests within 30 days. Backups are overwritten on their normal cycle.
- Some information may be kept after deletion where the law requires, to resolve disputes or prevent fraud, and where needed so that other members of a shared space keep an accurate, balanced history. In that case your name is removed or replaced with “Former member” wherever practical.
- Verification codes and expired invitation tokens are removed automatically after they expire.
9. Your rights
Under the Data Privacy Act and similar laws you may: be informed about how your data is processed; access it; correct it; object to processing; erase or block it; receive a portable copy; withdraw consent; be indemnified for damages from unlawful processing; and complain to the National Privacy Commission (privacy.gov.ph). Where other laws apply to you (for example GDPR or CCPA), you also have the rights they give you. Export and edit your data in the app, or email [privacy email]; we reply within 30 days and may ask you to verify your identity.
10. Children
Fiyna is not directed to children under 18 and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.
11. International transfers
Our providers may process data in countries other than yours. Where we transfer personal information abroad, we use contracts and safeguards that give it protection comparable to this policy.
12. Changes to this policy
If we make material changes we will notify you in the app or by email before they take effect, and update the date above.
13. Contact
[Operator legal name], [Registered business address]
Privacy: [privacy email]
General support: [support email]