Privacy Policy.

Account data. When you register, we collect your name, email address, and a bcrypt-hashed version of your password. We never see or store your password in plain text.

Financial planning data. Bills, incomes, expenses, savings goals, and habit reflections you enter are stored in your account and visible only to you. We do not connect to your bank accounts and never ask for bank credentials, SSN, or full card numbers.

Payment data. Subscription payments are processed by Square. Square collects and stores your full card details under PCI-DSS — we never see or store your full card number. We receive from Square only a customer ID, a card-on-file token, and a subscription status.

Usage data. We log minimal server-side information (IP address, user-agent, timestamp, endpoint) for abuse prevention (brute-force lockout on login) and error monitoring. These logs are retained for up to 90 days.

Cookies. We use one HttpOnly, Secure, SameSite=None session cookie to keep you signed in. We do not use third-party advertising cookies or cross-site tracking.

• To provide and secure the service (authenticate you, show your bills/savings).
• To process subscriptions via Square (if you subscribe).
• To send transactional email you opted into (weekly/monthly digests, margin warnings, password reset, email verification) — never marketing blasts.
• To prevent abuse (rate limiting, brute-force protection, test-user cleanup).
• With your explicit opt-in, to display your first name and milestone type (no amounts) in the anonymous public-wins ticker. You can turn this off anytime in Settings.

We use a small, curated set of sub-processors, each governed by a Data Processing Agreement:

• Square, Inc. — subscription billing and card storage. (Privacy Notice)
• Resend — transactional email delivery. (Privacy Policy)
• MongoDB Atlas — encrypted database hosting (AES-256 at rest, TLS in transit).

We do not use advertising networks, analytics that build profiles on you, or data brokers.

• Access & portability. From Settings, download a ZIP of all your data as CSV, plus monthly PDF snapshots — no request form, no waiting period.
• Correction. Every bill, expense, income, savings goal, and reflection is editable in-app.
• Deletion. Settings → Danger zone → "Close my account" permanently deletes your user record and cascades across all 10 per-user collections within seconds. Any active Square subscription is canceled.
• Opt-out of digests. Settings → Savings digest emails — toggle off.
• Opt-out of the public ticker. Settings → Public wins — toggle off.

California residents have additional rights under the CCPA/CPRA (right to know, delete, correct, opt out). EU/UK residents have rights under GDPR (access, rectification, erasure, portability, restriction, objection). To exercise these rights, use the in-app tools above or email us at privacy@financialhabitstosucceed.com.

Account and financial-planning data is retained for as long as your account is active. When you close your account, your personal and financial data is deleted within 30 days (usually immediately), except where we are legally required to retain transaction records (Square billing history, which is governed by Square's own retention policy).

Anonymized, aggregated statistics (e.g. total number of goals met) may be retained indefinitely for product analytics — these contain no information that identifies you.

We use industry-standard safeguards: TLS 1.2+ for all transport, bcrypt for password hashing, HttpOnly Secure cookies for sessions, rate limiting on authentication, HMAC-signed webhook verification for Square events, and least-privilege database roles. No system is 100% secure, but we are committed to acting promptly on any vulnerability.

Finhabits is not directed to children under 13 (or under 16 in the EU). We do not knowingly collect information from children. If you believe a child has submitted data, contact us and we will delete it.

Our service is operated in the United States. If you access Finhabits from outside the U.S., your information will be transferred to and processed in the U.S. By using the service, you consent to this transfer. Standard Contractual Clauses apply to transfers from the EEA/UK.

If we make material changes, we will notify you by email (if you have verified email on file) and post the updated policy at this URL with a new "Last updated" date. Continued use of the service after changes take effect constitutes acceptance.

Privacy questions, data-subject requests, or security reports:

privacy@financialhabitstosucceed.com

Or use the Contact form and mark your message "Privacy".