Finances Logo

Finances

Privacy Policy

Last updated: 21 September 2026

Finances is a personal finance app for your desktop, made by Steve Harrison, an independent developer based in Australia ("we", "us"). This policy explains what data the Finances app and the thefinances.app website collect, why, and what happens to it.

Finances is built local-first. Your financial data — transactions, accounts, budgets, attachments — lives in a database on your own computer. You can make this encrypted or not. We can't access it.

The app: your data stays on your computer

Everything you put into Finances is stored in an SQLite database on your device. New databases are encrypted by default (you can turn this off); on macOS, the encryption key is stored in your Keychain and unlocking can be protected by Touch ID or your system password. There is no account to create, no cloud sync of your financial data, and no code path that uploads your transaction history to us.

Because your data lives only on your machine, you're also responsible for backing it up — see our Terms of Service.

What the app does send over the network

The app makes a small number of network requests to function. These are the hosts it talks to, and why:

In more detail:

License checks

When you activate or use a paid license, the app sends your license key — and nothing else — to our server (thefinances.app) so we can confirm the license is valid. This check runs at most once a day. Offline license keys are verified entirely on your device and send nothing. During the free trial, the app keeps a small file on your device recording when the trial started; nothing about the trial is sent to us.

Update checks

The app checks our server (thefinances.app) for new versions when it starts and when you choose "Check for Updates". This sends standard update-check information such as your current app version and platform. Updates are downloaded from the same server and installed only when you agree to restart.

Usage analytics and error reports

The app can send anonymous usage events (such as "app opened", "page viewed", or "feature used") to Aptabase, a privacy-focused analytics service, using its EU-hosted endpoint (eu.aptabase.com) so events stay in the EU. These events tell us which features are used so we know what to improve. They never include any financial data.

When something goes wrong in the app (for example an import or bank sync fails), the same channel sends an anonymous error report. An error report contains only the type of error (such as "TypeError"), its error code (such as "SQLITE_CONSTRAINT" or "ECONNREFUSED"), a short stack trace reduced to function names and file names from the app's own code, and a fixed label for the stage that failed. The error's message text is deliberately never sent, because messages can echo amounts, merchant names, or file contents. Reports are capped at 100 per session, and nothing about your transactions, merchants, accounts, file paths, or project name is ever included.

Every event also carries the app version, operating system name and version, and your system locale, plus a random session ID that exists only while the app is running and is never stored. There is no persistent device ID, user ID, license key, or email in any event. Aptabase uses the IP address of the request to work out your country, then discards it. Analytics and error reports share one switch: Settings → Privacy → "Send anonymous usage analytics and error reports". If your computer's region is in the EU, UK, or Switzerland, the app asks for your consent on first launch and sends nothing until you agree; elsewhere it is on by default and can be turned off at any time.

Merchant lookup

If you create or edit a merchant and use the autocomplete search field, that query is sent to a maps provider to find the business. Normally that's Apple Maps — the query goes from your device straight to Apple, and we can't see it. If Apple Maps isn't available, the lookup falls back to Google Maps: either directly from your device using a Google API key you supply, or through our server, which forwards the query to Google and uses your license key (or trial status) to meter lookups — in that case the query does pass through our server. Place photos are loaded by your device from Apple or Google. Merchant icons are bundled with the app; if you give a merchant an icon by pasting a web address, your device downloads that image once from that address and stores it locally so it isn't fetched again. Those sites see the request like any other visit (your IP address and browser details) but receive nothing about your transactions.

Reference data lookups

A few features fetch reference data that includes nothing about you or your finances: converting a foreign-currency transaction fetches that day's exchange rate from Frankfurter (only the date and currency are sent, never amounts), and the "What if" comparison fetches historical prices for a fixed set of market tickers from Yahoo Finance.

Bank connections (optional)

If you choose to connect a bank instead of importing files, the app talks to the provider you pick:

API keys are stored on your device, encrypted using the operating system's secure storage. Bank connections are entirely optional — you can use Finances purely with manual file imports.

The website

When you use thefinances.app, we collect:

Purchases

Payments are processed by Stripe. Your card details go directly to Stripe and never touch our servers. After a purchase we store your email address, your license key, your plan type, and Stripe reference IDs so we can deliver your license, manage your subscription, and provide support. Your license key is emailed to you via Resend, our email delivery provider.

"Keep updated" sign-up

If you enter your email to hear about updates, we store that email address and use it only to send you news about Finances. Ask us at any time and we'll remove it.

Support emails

If you email us at finances@steveharrison.dev, we keep your message and email address so we can reply and follow up on your request.

Analytics and cookies

The website uses two analytics services: Google Analytics, which sets cookies to distinguish visitors, and Plausible, which is cookieless. We use these to understand how people find and use the site. Google Analytics cookies are the only cookies the site sets — we don't use advertising or cross-site tracking cookies. If you prefer not to be counted, browser settings or content blockers that block analytics will not affect your use of the site.

Third-party services we rely on

These are the services that may process data on our behalf, and what they handle:

Each of these processes only what's described above. We don't sell or rent your personal information to anyone, and we don't share it with anyone else except where required by law.

How long we keep data

Security

If encryption is enabled (the default), your local database is encrypted at rest with a key held in your operating system's keychain. If the encryption feature is turned off, we recommend you keep your hard drive and user account secure. Any bank API keys and other credentials you enter are stored encrypted with the operating system's secure storage. The app's own diagnostic log on your device is also encrypted; it is never uploaded, though you can export a readable copy yourself if you choose to send it to us for support. On our side, payment details are handled entirely by Stripe, our server stores the minimum described above, and access to it is limited to us.

Your rights

You can ask us to access, correct, or delete the personal information we hold about you (your email, license record, or support correspondence), or object to how we use it. We handle personal information in accordance with the Australian Privacy Act 1988 and the Australian Privacy Principles; if you're in the UK or EU, you have equivalent rights under the GDPR. Email us at finances@steveharrison.dev and we'll respond promptly. If you're unsatisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) or your local data protection authority.

Changes to this policy

If we change this policy, we'll update this page and the date at the top. If a change meaningfully affects how we handle your data — for example, a new service that processes personal information — we'll say so prominently.

Contact

Questions about privacy? Email us at finances@steveharrison.dev and we'll get back to you.