Privacy Policy
Last updated: October 23, 2026
This privacy policy explains what personal information we collect, why we collect it, and your rights regarding that information.
Who We Are
Finehance operates this website. For privacy inquiries, contact us at:
hello@finehance.com.
Information We Collect
Information You Provide
- Account information: You can create an account with your email address and a password, or sign in with GitHub.
- With an email address and password, we store your email address, a display name (the part of your email address before the @), and your password in a scrambled, one-way form that cannot be turned back into the password. We never store the password itself.
- With GitHub, we receive your email address, display name, and profile avatar from GitHub.
- Two-factor authentication: Accounts that use an email address and password must pass a second sign-in step: a six-digit code from an authenticator app on your phone. For this we store the secret key that your authenticator app shares with us, encrypted; when you set it up; ten single-use recovery codes, in the same one-way scrambled form as passwords, and when each one was used; a marker of the last code we accepted, so that a code cannot be used twice; and how many wrong codes were entered recently, with the end of a temporary block on entering codes (at most 30 minutes) after too many. The count of wrong codes is cleared when you sign in. GitHub accounts do not use this step; GitHub’s own sign-in protections apply.
- Remembered devices: Where this option is offered, you can ask us to remember a device so that it skips the code for a set number of days. We then store a cookie on that device and, on our side, a scrambled copy of that cookie’s value, when the device was added and last used, when it will be forgotten, and a short description of the browser and device as your browser reports it, so that you can recognise it on your Profile page. We remember at most ten devices per account.
- Access requests: When joining is by invitation only, you can ask for access with your email address. We store it with when you asked and whether your request is waiting or was declined and, if you ask again after being declined, how many times and when you last asked. We delete a declined request 30 days after declining it; if you ask after that, it is a new request. If we accept, the request is replaced by an invitation.
- Invitations: An invitation holds your email address, whether it is for signing in with an email address and password or with GitHub, and when it was made.
- Payment information: When you make a purchase, your payment details (card number, billing address) are collected and processed entirely by Stripe. We never receive or store your card details. We store transaction references (payment ID, amount, receipt link) to manage your subscription.
Information Collected Automatically
- Preference cookies: Language and theme settings stored as cookies on your device (see our Cookie Policy).
- Session data: A session identifier to keep you signed in, automatically deleted after 30 days of inactivity.
- Sign-in in progress: Between entering your password and entering your code, a short-lived record, and a cookie that points to it, tie your browser to that sign-in. They expire after 5 minutes, or 15 minutes while you set up two-factor authentication.
- Browser language: Your browser’s language setting, used once to set your initial language preference.
- Server logs: For each request, our servers record the time, the page or endpoint, the response status and duration, your IP address and, if you are signed in, your user ID. We use them to keep the service running, investigate errors and detect abuse. They are deleted after 30 days. When diagnostic tracing is on, the timing of each step of a request is recorded as well, linked to that request but without your IP address or user ID, and also deleted after 30 days.
- Security records: We record security and payment events on your account (sign-ins and failed sign-in attempts, sign-outs, two-factor changes, ended sessions, payment notifications, and changes an administrator makes to your account or access) with the time and your user ID, but not your IP address. They are deleted after 30 days.
Information We Do NOT Collect
- We do not use analytics or tracking tools.
- We do not serve advertisements.
- We do not sell, rent, or trade your personal information.
- We do not collect a device fingerprint or track your browsing behavior. A description of your browser is stored only for a device you ask us to remember.
- Your IP address is held in memory for a few minutes to limit repeated requests, and appears in our server logs, which are deleted after 30 days. We do not store it anywhere else. (Our hosting provider may also log IP addresses at the infrastructure level — see Third-Party Services below.)
How We Use Your Information
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Authenticate your identity | Email address and scrambled password, or GitHub profile (email, name, avatar) | Contract performance |
| Protect your account from takeover | Two-factor authentication details, recovery codes, remembered devices | Legitimate interest |
| Decide who can join while joining is by invitation only | Email addresses in access requests and invitations | Legitimate interest |
| Process payments | Email, name (shared with Stripe) | Contract performance |
| Manage your subscription | Payment references, plan status | Contract performance |
| Remember your preferences | Language, theme cookies | Legitimate interest |
| Protect against attacks | Sign-in and form-protection cookies | Legitimate interest |
| Keep the service secure and working | Server logs (IP address, user ID), security records | Legitimate interest |
Third-Party Services
We share data with the following services. Each service’s role under GDPR (independent controller or data processor) is noted below.
GitHub (Independent Controller)
- Purpose: Sign-in with GitHub, if you choose it
- Data shared: Your permission for us to read your GitHub profile; your profile data in return
- Role: GitHub acts as an independent data controller — it determines its own purposes and means of processing your data (account management, security, platform operation). Data sharing is governed by GitHub’s own privacy terms.
- Privacy policy: GitHub Privacy Statement
Stripe (Independent Controller)
- Purpose: Payment processing
- Data shared: Your email and name (to create a customer record); card and billing details are handled directly by Stripe and never touch our servers
- Role: Stripe acts as an independent data controller for payment processing, fraud prevention, and regulatory compliance under card network rules. Stripe determines its own purposes for processing payment data.
- Privacy policy: Stripe Privacy Policy
MongoDB Atlas (Data Processor)
- Purpose: Database hosting
- Data stored: Account information (including two-factor authentication details), session data, subscription records, security records
- Role: MongoDB Atlas acts as a data processor — it stores and processes data solely on our instructions. A Data Processing Agreement governs this relationship.
- Privacy policy: MongoDB Privacy Policy
- DPA: MongoDB Data Processing Agreement
Vercel (Data Processor)
- Purpose: Website hosting
- Data processed: Standard HTTP access logs (IP addresses, request URLs, timestamps) at the infrastructure level
- Role: Vercel acts as a data processor under Art. 28 GDPR — it hosts and processes requests on our behalf. A Data Processing Agreement governs this relationship.
- Privacy policy: Vercel Privacy Policy
- DPA: Vercel Data Processing Agreement
Data Retention
| Data | Retention Period |
|---|---|
| Account information | Retained until you delete your account |
| Archived account data | 30 days after deletion request, then permanently removed. Your two-factor secret key, recovery codes and remembered devices are deleted at once and are not archived |
| Two-factor authentication details | Until you delete your account, or we reset two-factor authentication at your request; setting up a new authenticator replaces the old secret key, and new recovery codes replace the old ones |
| Remembered devices | Until the set number of days runs out, or until you forget them, set up a new authenticator, sign in with a recovery code, or we reset two-factor authentication |
| Access requests | Until we decide, or until you delete your account; a declined request is deleted 30 days after it was declined |
| Invitations | Until we withdraw them, or until you delete your account |
| Sign-in in progress | 5 minutes (15 minutes while setting up two-factor authentication) |
| Session data | Automatically deleted after 30 days of inactivity |
| Server logs | 30 days |
| Security records | 30 days, also after you delete your account |
| Subscription records | Retained for the duration of your account; archived and deleted with the account |
| Preference cookies | 1 year (renewed on use) |
Your Rights
Under applicable data protection laws (including GDPR), you have the right to:
- Access your personal data — visit your Profile page to see your stored information.
- Rectify inaccurate data — if you sign in with GitHub, update your name, email, or avatar on GitHub and sign in again to sync changes. If you signed up with an email address, contact us to correct it.
- Delete your data — use the “Delete Account” button on your Profile page. Deleting cannot be undone: the account cannot be restored, so export your data first if you want a copy. A copy of your data is archived for 30 days, only to meet legal obligations, after which it is permanently and irreversibly removed from our systems. Server logs are not deleted with the account, and are removed 30 days after they were made; security records are removed 30 days after they were made. Your invitations and any access request under your email address are deleted with the account straight away; if joining is by invitation only, coming back takes a new invitation. Active subscriptions will be closed without refund upon deletion.
- Restrict processing — contact us to restrict how we use your data.
- Data portability — use the “Export Data” button on your Profile page to download your data as a file in a common machine-readable format (JSON).
- Object to processing based on legitimate interest.
- Withdraw consent at any time where processing is based on consent.
- Lodge a complaint with your local data protection authority.
To exercise any of these rights, contact us at hello@finehance.com.
International Data Transfers
Your data may be transferred to and processed in countries outside your own, including the United States, where our service providers (GitHub, Stripe, Vercel) operate. These transfers are protected by appropriate safeguards including Standard Contractual Clauses.
Children’s Privacy
Our service is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us.
Security
We protect your data through:
- Passwords and recovery codes stored only in a one-way scrambled form
- Two-factor authentication for accounts that use an email address and password, with the secret key stored encrypted
- Limits on wrong codes and on repeated requests
- Signed sign-in cookies that scripts on the page cannot read, sent only over secure connections
- Protection against forms being submitted from other websites
- Browser rules that stop scripts from other websites running on our pages
- PCI DSS compliance via Stripe (card data never touches our servers)
- Encryption of all data in transit
If You Lose Access to Your Account
If you forget your password, or lose both your authenticator app and your recovery codes, contact us at hello@finehance.com. We will check that the account is yours before we reset anything. To check such a request, our administrators can see when you set up two-factor authentication and how many recovery codes you have left, but never the codes or your secret key.
On your Profile page you can also switch to a new authenticator app (Use a new device), get a new set of recovery codes (New recovery codes) and forget every remembered device (Forget all devices).
Changes to This Policy
We may update this privacy policy from time to time. The “Last updated” date at the top indicates when the latest changes were made. We encourage you to review this page periodically.
Contact
For questions or requests regarding this privacy policy, contact:
Finehance Email: hello@finehance.com