Fingofy - Privacy Policy

Last Updated: October 06, 2026

Overview

Fingofy helps users manage payment plans, transactions, budgets, goals, debts/credits and accounts. This policy explains what data we collect, how we use it, who we share it with, and your rights.

Data controller: Umay Corporation — umaycorporation@gmail.com

Data We Collect

Account and Identity

• Email address (Firebase Authentication)
• Name/surname, language and currency preference
• If you use Google Sign-In: email, name and profile information from your Google account
• Profile picture, if you upload one (Firebase Storage)

App Data

• Payment plans, transactions, budgets, goals, debts/credits, accounts and vault holdings
• Settings (theme, currency, notification preferences)

Device and Usage

• Push notification token and platform information
• Crash reports: stack traces, device model and OS version
• Last activity time, app version, platform and time zone (to improve the service and send notifications at a suitable time)
• In-app event analytics (e.g. screen views, feature usage). Raw financial amounts are never sent to analytics; amounts are reported only as ranges (buckets).
• Device/app integrity signals (Firebase App Check and Google Play Integrity)
• Advertising identifier (Android Advertising ID) — only in free usage where ads are shown, see the "Advertising" section below

Data Sources and Storage

• Local storage: The app keeps only settings such as your session, language/theme preference and a subscription-status cache on the device. Your financial data is not stored on the device and the app does not work offline.
• Cloud storage: Account and app data are kept on Firebase (Google Cloud) — Authentication, Cloud Firestore, Cloud Storage and Cloud Functions.

Purposes of Processing

• Authentication and account management
• Syncing and backing up your data across your devices
• Payment reminders and status notifications (optional)
• Analytics, debugging and performance improvement
• Subscription and purchase verification
• Serving ads (free usage only)
• Security, abuse/fraud prevention and legal obligations

Legal Bases

• Performance of a contract (providing the service, subscriptions)
• Legitimate interest (security, debugging, performance)
• Consent (notifications and personalised advertising)

Advertising and Consent

The free version shows ads through Google AdMob. To serve ads, your device's advertising identifier (Android Advertising ID) and limited technical data may be shared with Google and its advertising partners.

• In the European Economic Area, the United Kingdom and Switzerland: the app shows Google's consent form (User Messaging Platform) on first launch. If you do not consent, no personalised ads are shown.
• If you are in a consent region, you can review or change your consent at any time from Profile > Privacy options.
• You can reset your advertising ID or turn off personalisation in your device settings.
• No ads are shown while a Premium subscription or the "Remove Ads" purchase is active.

Google's advertising data practices: policies.google.com/technologies/partner-sites

In-App Purchases and Subscriptions

Fingofy offers optional purchases through Google Play Billing: a one-time "Remove Ads" purchase and a monthly/yearly Premium subscription.

• Payments are processed by Google; your card details never reach our app and are not stored by us.
• An obfuscated account identifier is sent to Google so the purchase can be matched to your account.
• Purchases are verified by a Cloud Function on our server through the Google Play Developer API; a verification record (product id, purchase time, status) is stored against your account.
• Cancellation and plan changes are handled through Google Play and are subject to Google Play policies.

Third-Party Services

• Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, App Check (Google LLC) — account and app data infrastructure
• Firebase Cloud Messaging (Google LLC) — push notifications
• Google Analytics for Firebase (Google LLC) — usage analytics
• Google AdMob (Google LLC) — advertising
• Google Play Billing and Google Play Developer API (Google LLC) — purchases and verification
• Google Play Integrity API (Google LLC) — device/app integrity checks
• Google Sign-In (Google LLC) — optional sign-in method
• Sentry (Functional Software, Inc.) — crash and error reporting
• Exchange-rate providers (exchangerate.host, frankfurter.app, open.er-api.com) — used only to fetch current rates; no personal or financial data is sent in these requests, only currency codes

These parties process data on our behalf or for their own determined purposes and are subject to their own privacy policies.

International Data Transfers

The service providers listed above may process data on servers outside your country, including outside the European Economic Area (for example in the United States). Such transfers take place under appropriate safeguards such as the providers' standard contractual clauses.

Data Sharing

We do not sell your data and do not transfer it to third parties for marketing. Sharing is limited to the service providers listed above, to the extent required for the service to function, and to cases of legal obligation or security.

Security

• HTTPS/TLS encryption in transit
• Per-user access control through Firebase Security Rules (only you can access your data)
• Protection against forged clients and abuse via Firebase App Check and Play Integrity
• Subscription entitlements are written server-side only and cannot be modified by the client
• Screenshot/recording blocking on financial screens

Retention Periods

• Account data: until the account is deleted
• App data: when deleted by the user, when the account is closed, or when the purpose of storage ends
• Purchase verification records: for the duration of legal and accounting obligations

Your Rights

• Access, rectification and erasure
• Restriction of and objection to processing
• Data portability (in-app export feature)
• Withdrawal of consent (notification preferences and advertising consent)

You can permanently delete your account and all of your data from within the app using Profile > Delete My Account. For other requests you can contact us by email; we may need to verify your identity.

Children's Privacy

Our services are not directed to individuals under the age of 13 and we do not knowingly collect data from them. If we become aware of such data, it is deleted.

Changes

This policy may be updated. The "Last Updated" date appears above. We may announce significant changes with an in-app notification.