Privacy Policy

Last updated: 23 September 2026

FinanceX ("we", "us") provides free financial tools for people in India. This policy explains what we collect, what we deliberately never keep, who helps us process data, and how you stay in control. It is written for India's Digital Personal Data Protection Act, 2023 (DPDP Act).

The short version

• The tools work without an account. Documents you upload are read in memory and never stored.
• If you create an account, we keep only what you choose to save, and you can download or delete all of it from Settings at any time.
• We don't sell your data, show ads, or use tracking cookies.

What we collect

• Account details: your email address; a password stored only as a salted scrypt hash, or your Google account ID if you sign in with Google; whether your email is verified; your reminder preference; and when you signed up and last logged in.
• Tax years you save: the figures from a Form 16 analysis (income, deductions, tax and results), only when you choose "Save to my dashboard".
• Transactions you import: date, description, amount and category for each row of a bank statement you import, plus any category rules you create.
• Goals and investments: what you enter, or what you import from a CAS statement: each holding's name, type, amount invested and current value.
• Reminder history: which reminder emails we've sent you, so none is sent twice.
• Anonymous usage counts: which tools are used and how many times pages are viewed. These carry no personal or financial detail (see "Cookies and page counting").

What we never store

• Your Form 16, salary slip, bank statement or CAS files. Each is read in memory and discarded.
• Your CAS password. It's used once to open the file and then discarded.
• Your PAN, folio numbers, demat account numbers, or the address printed on your statements.
• Anything from SplitQR. QR codes are read and generated entirely in your browser.

Who processes data for us

• OpenAI reads the figures from Form 16s and salary slips you upload. Before any text is sent, we remove PAN and TAN numbers. Under OpenAI's API terms, this data isn't used to train their models by default, and OpenAI may keep it for a limited period for abuse monitoring. CAS statements are never sent to OpenAI; they're read on our own server.
• Google, only if you choose "Continue with Google". We receive your email address and Google account ID, nothing else.
• Our email provider delivers verification, password-reset and (if you opt in) reminder emails to your address.
• Hostinger hosts our servers and database. Cloudflare provides our domain name service.
• Error monitoring: if something breaks, technical details of the error (the page address and where in our code it failed) may be sent to our error-monitoring service. We configure it never to send form contents, documents, figures, cookies or IP addresses.
• IFSC lookup: the IFSC Finder sends only the IFSC code you type to a public bank-branch dataset.

We don't sell or rent personal data, and we don't share it for advertising.

Cookies and page counting

We use one essential cookie: a signed session cookie that keeps you logged in and protects forms against forgery. We don't use analytics, advertising or tracking cookies. To understand which pages are useful, we count page views by page and day, and note the website a visit came from (for example "google.com"). We don't store your IP address, a cookie, or anything that identifies you with these counts.

Emails

We send account emails you need (verification and password reset). Tax-deadline and goal reminders are sent only if you opt in, only to a verified address, and every reminder has a one-click unsubscribe link. You can also switch them off in Settings.

Your rights

• Access: download everything we hold about you from Settings → Download my data.
• Correction: edit or remove goals, investments and transaction categories in your dashboard, or email us to correct anything else.
• Erasure: delete your account from Settings → Delete account. Your data is erased immediately. Server backups, which only we can access, are kept for up to 14 days and then deleted.
• Withdraw consent: turn off reminders, remove saved data, or delete your account at any time.
• Nominate: you can nominate someone to exercise these rights for you in case of death or incapacity. Email us to set this up.
• Grievances: contact our Grievance Officer (below). If you're not satisfied with our response, you may complain to the Data Protection Board of India.

How long we keep data

We keep your account data until you delete it or your account. Database backups are kept for 14 days. Anonymous usage counts are kept in aggregate and can't be linked to you.

Security

All traffic uses HTTPS. Passwords are hashed with scrypt, forms are protected against cross-site request forgery, and logins are rate-limited. Staff access is limited: our admin tools show how much data an account holds, not the transactions, salaries or investments themselves, and every admin action is logged.

Children

FinanceX is for adults. It isn't intended for anyone under 18, and we don't knowingly collect their data.

Changes to this policy

If we change this policy, we'll update the date above. For significant changes that affect data you've given us, we'll email account holders before the change takes effect.

Contact and Grievance Officer

For privacy questions, data requests or grievances, email hello@financex.in with "Privacy" in the subject. We acknowledge requests within 2 working days and aim to resolve them within 30 days.

FinanceX provides estimates and information, not tax, legal or investment advice.