Privacy & Terms

The short version

Your financial records belong to you. We store what you log, import or sync (amounts, categories, merchants, dates, accounts) so the server can compute your summaries, and we do not sell or share it for advertising. The product has no third-party analytics; these marketing pages use Google Analytics only if you allow it (details below). Export your transactions as CSV or delete your whole account from the chat at any time.

What we store

• Your account: your email address and, if you sign in with Google, your Google account id. Used for sign-in. We also keep the name of the AI client you first signed in from (for example Claude or ChatGPT), to know where users come from. If you sign in by email, a one-time 8-digit code is sent to that address via Resend; the code lives only in the server's memory for 10 minutes and is never stored. When a new account is created, its email address and the name of the AI client used to sign up are sent once to the operator as a signup notice (by email via Resend and to a private Telegram chat).
• Financial records: transactions you log, import or sync (amount, currency, category, merchant or counterparty, note, date, optional receipt line items, the bank's transaction reference), your accounts, balance snapshots, budgets, the recurring payments you save (name, amount, how often, next date), the categories you chose for specific merchants, and settings (base currency, timezone). Recurring payments found in your records are computed when you ask and are not stored.
• Bank connections, only if you create one: through Enable Banking (a licensed EU open-banking provider) we store the encrypted session id, the consent expiry, your bank's name and the list of accounts your bank returns (names, account identifiers such as IBAN, currencies). While the consent is valid (at most 90 days) the server pulls booked transactions and balances about once a day, including counterparty names and payment descriptions. Through ZenMoney we store your API token, encrypted, and sync your accounts and transactions. A bank link binds only after you confirm, on our page, which MyFinance account receives the access. Disconnecting revokes the bank session and erases the token; imported transactions stay until you delete them.
• Sign-in tokens: access tokens (24 hours) and refresh tokens (replaced on every use; they lapse after 60 days without use and a year after you signed in) for the AI clients you connect, stored only as a one-way hash.
• Exchange rates: daily reference rates (ECB, the National Bank of Ukraine, and for other currencies the public fawazahmed0 currency snapshot), shared by everyone and not tied to you. Fetching them sends only a date, never anything about you.
• Usage events: which tool was called, how long it took, which arguments were present, coded values such as a category, currency or period, an error code, and the name of your AI client. They are keyed to your account id, never contain amounts, merchants or notes, and are kept for 90 days (import and deletion counters longer). All of them are deleted with your account. The operator reviews them on a private overview page, next to each account's email, sign-up date, sign-in method, base currency, timezone, connected bank services and their status, when it last stored a record, and its numbers of records, accounts and budgets; amounts, merchants and notes never appear there.
• Email summary, only if you turn it on: when you ask your AI to turn on the weekly or monthly email summary, we keep that choice and the last period sent. Each summary (your totals, top categories and budgets for the period, and the recurring payments coming up) is sent to your sign-in address through Resend. Every email has a one-click link to stop it, or say "turn off the email summary" in your AI chat.

What we never store

• Receipt photos. Your AI client parses images on its side; only structured numbers reach our server. There is no image storage at all.
• Bank credentials. Your bank authenticates you directly; we never see your bank login, PIN or card details.
• Amounts in logs. Server logs and usage events never contain money values, merchants or notes.
• Your conversations. What you say to Claude or ChatGPT stays between you and your AI provider; we only receive the structured tool calls the AI makes.

Where your data lives

Your data is stored in a PostgreSQL database run by Supabase in Frankfurt, Germany; the server runs at Hetzner in Falkenstein, Germany. The link between them is encrypted (TLS). Every query the server runs is limited to your account, and the database's own API is closed to everyone. Access tokens are issued via OAuth 2.1 with PKCE and stop working when you disconnect the server in your AI client or delete your account.

Who processes data for us

• Supabase (database hosting, EU) and Hetzner (server hosting, EU): all stored data.
• Enable Banking and ZenMoney: only if you connect them, the access you grant there.
• Google: sign-in, if you choose "Continue with Google"; Google Analytics on these marketing pages, only if you allow it.
• Resend: the sign-in codes we email you, if you sign in by email, and the email summaries you turned on; with Telegram, the one-time signup notice with your email address, sent to the operator.

Website analytics and cookies

These marketing pages can use Google Analytics to understand how many people visit and which pages they read (page views, referrer, approximate region). It runs only on this website: the MCP endpoint and your financial data never touch it, and it cannot see who you are inside the product.

Google Analytics is loaded only after you click "Allow" in the banner. Until then, and if you click "Decline", nothing is sent to Google at all and no analytics cookie is set. If you allow it, Google sets its cookies (_ga and _ga_SFT6JY9Q7W, kept for up to 2 years). Your choice itself is remembered in your browser's local storage, not in a cookie. You can change your mind at any time via "Cookie settings" in the footer of every page; declining removes the analytics cookies, including any set by these pages before October 1, 2026, when analytics ran without asking. If you block Google Analytics with a content blocker, everything here keeps working.

Your rights (GDPR)

• Portability: say "export my transactions" and you get them as CSV (account, transfer counterpart and receipt items included), in pages of 2,000 rows. Say "export my profile" for everything else (accounts with their balance history, budgets, saved recurring payments, your merchant category rules, bank links and settings) as one JSON file.
• Erasure: say "delete my account": your profile, every financial record, your bank and ZenMoney connections (the bank session is revoked first), your sign-in tokens and your usage events are removed. This is a built-in tool, not a support ticket.
• Access and correction: every record can be listed, searched and edited through the same conversation.
• You can also complain to your data protection authority.

Terms of use

• MyFinance MCP is provided free of charge while in beta, "as is", without warranty of any kind. It is a personal finance tracking tool, not financial, tax or accounting advice.
• The software is open source under the MIT license; you may self-host it with your own database, in which case this policy does not apply to your instance.
• We may update these terms; material changes will be noted on this page with a new date above.

Contact

Questions about privacy or your data: show email. Operated by Rteam FZE LLC.

Last updated: October 14, 2026.