1. Who we are and what this policy covers
Finch is developed and operated by CHAORAN KANG, an independent developer. This policy covers the Finch mobile application for iOS and Android, this website, and support communications. For privacy questions, contact kcr0976@gmail.com.
2. Your local financial data
Finch is local-first. Books, accounts, transactions, balances, budgets, reports, stocks, subscriptions, savings goals, debts, loans, installments, items, notes, attachments (such as receipt photos and vouchers) and the icons you pick are stored in an encrypted SQLCipher database and app storage on your device. Using Finch does not upload that database to the developer, and Finch has no user accounts.
- You can edit, delete and export your records in the app.
- When you upgrade from Finch 1.x, the debts, installments, stocks and savings records that 2.0 does not import are kept on your device as spreadsheets you can view and share.
- Clearing app data or uninstalling generally removes local Finch data, subject to operating-system or device backups.
- You are responsible for keeping any export or backup you need before deletion or device replacement.
3. Data processed when you choose connected features
- AI bookkeeping: when you use AI bookkeeping from text, voice or a picture — in the app, through the iOS Shortcut or with content you share to Finch — Finch sends over HTTPS to Finch’s AI service at ai.finch0732.top, which the developer operates on Cloudflare, only what that request needs: your text or the transcript, the recording when you use recording mode, the original picture you choose with any note you add, the book’s name and currency, the names, IDs and keywords of your selectable accounts, categories, members, tags and merchants, and up to 30 frequently used notes with their usual category and account. The AI service adds its processing instructions and forwards the request to the AI model provider chosen by the developer, currently a third-party OpenAI-compatible API service that may rely on upstream model providers such as OpenAI. The developer may change this provider, including to OpenAI directly. Results are suggestions you review before anything is saved; avoid including unnecessary sensitive information.
- Your own API key (optional, Pro): if you add a key from an AI provider you choose — such as OpenAI, Google Gemini, DeepSeek, Alibaba Qwen, OpenRouter or another OpenAI-compatible address — the key is stored only in your device’s secure storage (the iOS Keychain or Android Keystore), never in Finch’s database, backups, logs or analytics. Requests that use it are relayed with the key through Finch’s AI service to that provider; the AI service does not store the key or the content. The provider then processes the request under its own terms and charges your account with it.
- AI usage limits: each AI request includes a random installation ID that Finch creates on first launch and a request ID. The installation ID is not linked to your name, an account or device hardware. The AI service uses it, together with your IP address only transiently, to enforce per-minute and daily request limits. It stores only a one-way hash of the installation ID with daily request counts, and its logs exclude the raw installation ID, IP addresses, images, audio and full request content. The AI service is designed not to retain your AI content after responding; the model provider’s handling is governed by its own terms.
- Camera, photos, microphone and speech: Finch accesses only the content you choose or capture for the requested feature. Quick voice input uses your device’s speech recognition, which Apple or Google may process under their own terms; recordings made in recording mode (up to 20 seconds) are sent to the AI service for transcription. Biometric authentication is performed by the operating system; Finch does not receive your fingerprint or face template.
- iCloud, Google Drive or WebDAV backup: when you back up — manually, or automatically to the one location you choose — Finch uploads a snapshot of your encrypted database together with your attachments, icons and 1.x archive to your own iCloud storage, Google Drive or WebDAV server; later backups upload only what changed. iCloud uses the Apple account signed in on your device; Finch does not receive your Apple account password. Google Drive uses Google Sign-In with access limited to files Finch creates. WebDAV requires HTTPS, and its address and credentials are kept in your device’s secure storage. You can also export a backup file and keep it wherever you choose.
- Stocks and exchange rates: the stock symbols and market codes you search for or hold are sent to Finch’s service, which obtains search results and end-of-day quotes from Tsanghi; your device does not contact Tsanghi directly. Currency codes are sent to the public Currency API, delivered through jsDelivr or Cloudflare Pages, for exchange rates. No financial records are sent with these requests.
- Icons, app content and fonts: Finch downloads public icon catalogs and images from assets.finch0732.top, which the developer hosts on Cloudflare R2, and in-app messages, the version history and the Shortcut link from Finch’s service. These requests carry the app version, platform and language, not your records. When you create a PDF report, the font for your language is downloaded from Google Fonts, or through Finch’s service if Google Fonts cannot be reached.
- Purchases: Apple, Google and RevenueCat process purchase history, receipts or purchase tokens, an anonymous app-user identifier, device/app information and entitlement status.
- Analytics: Firebase Analytics automatically collects app-usage events, an app-instance identifier, device and app information and IP-derived approximate location, which we use to understand aggregate use. Advertising-identifier collection is turned off, and no financial records are sent to Firebase.
- Database diagnostics: a diagnostic report you create in Finch contains the database structure, counts and error messages — never your records or passwords — and leaves your device only if you choose to share it, for example by email to support.
4. Why we process information
- To provide features you request and perform our agreement with you.
- To protect the app, validate purchases, prevent abuse, enforce AI usage limits and maintain reliable operation.
- To understand aggregate product use and improve Finch where permitted.
- To answer support requests and comply with legal obligations.
- Where consent is required, to process permission-gated content or optional features after you choose them. You can withdraw permission in system settings, though the related feature may stop working.
5. Service providers and disclosure
Finch does not sell personal information and does not use your financial records for cross-context behavioral advertising. Information is disclosed only as needed to the service you choose, to infrastructure and purchase providers, when you ask us to, or when legally required. Providers process data under their own terms and may operate in other countries.
- Google / Firebase: Firebase Analytics, Google Sign-In, Google Drive and Google Fonts (report fonts).
- Apple: iCloud backup, App Store purchases and system speech recognition.
- RevenueCat, Apple and Google Play: purchases, subscription status and entitlement delivery.
- Cloudflare: hosting of Finch’s service (AI requests, the own-key relay, usage counters and rate limiting, stock quotes, in-app messages, the version history and report fonts) and the public icon files.
- AI model providers: the third-party OpenAI-compatible API service currently chosen by the developer, and OpenAI where used; or the provider you choose when you use your own API key.
- Your chosen WebDAV host: optional backup storage.
- Tsanghi (through Finch’s service), Currency API, jsDelivr and Cloudflare Pages: stock and exchange-rate data.
- Vercel: website hosting, security and request logs.
6. Retention, deletion and choices
Finch does not host your financial database or cloud backups and never deletes your backups on its own. Local data remains until you delete it, clear app storage or uninstall. User-controlled cloud backups remain until you remove them from your iCloud, Google Drive or WebDAV. Finch’s AI service keeps only hashed installation IDs with daily request counts for usage limits. Support emails are kept only as reasonably needed to resolve the request. Provider-side identifiers, purchase records, analytics and AI content follow the provider’s settings, retention rules and legal obligations.
- Delete local records in Finch, clear app storage or uninstall the app.
- Delete the Finch folder from your iCloud storage, Google Drive or WebDAV server, and turn off automatic backup in Finch.
- Sign out of Google Drive in Finch and, if you wish, revoke Finch’s access in your Google account.
- Remove your own API key in Finch’s AI settings at any time.
- Revoke camera, photo, microphone, speech or biometric permissions in device settings.
- Contact the relevant provider to exercise rights over provider-controlled identifiers, purchase records or AI content.
7. Security
Finch uses an encrypted local database, HTTPS for its online services, the system’s secure storage for your own API key and WebDAV credentials, HTTPS-only WebDAV, platform permission controls, request limits on its AI service, and an optional app lock with a privacy cover. No system is completely secure. Protect your device, backup credentials and exported files, and do not send secrets in support messages.
8. International transfers and your rights
Service providers may process information outside your country, including in the United States and other locations where they operate. Depending on your location, you may have rights to access, correct, delete, restrict or object to processing, obtain a portable copy, withdraw consent, and complain to a data protection authority. California residents may request applicable access, correction and deletion rights; Finch does not sell or share personal information for cross-context behavioral advertising. Contact us to exercise a right. We may need limited information to verify the request.
9. Children
Finch is a general-audience personal finance tool and does not set a fixed minimum age beyond applicable law and the requirements of the app store or optional connected service you use. Core financial records stay on the device and are not collected by the developer merely because someone uses the app. A parent or guardian should supervise a minor's use of optional connected features and may contact us if they believe a child provided personal information through such a feature or a support request.
10. Website, contact and changes
This website does not run advertising trackers or product analytics and does not intentionally set marketing cookies. Vercel may process IP addresses, request metadata and security logs to deliver and protect the site. If you email us, we process your address, message and attachments to reply. We may update this policy as Finch changes; the effective date above identifies the current version.