Privacy Policy

Last updated: 3 October 2026

Personal Finance Manager (“the app”, “we”), available at https://pfm.arnavg.me, is a private, invite-only tool for tracking personal spending, budgets, loans and EMIs. This policy explains what information the app collects, why, and the choices you have.

1. Information we collect

From your Google account

When you sign in with Google, the app requests only the openid, email andprofile scopes. From these it stores:

• your Google account identifier,
• your email address (and whether Google has verified it),
• your name and profile picture URL.

The app does not receive your Google password and does not access your Gmail, Drive, Contacts, Calendar or any other Google data.

Financial information you enter

Transactions (date, amount, description, category, bank, last four digits of the account or card, remarks), categories and rules, budgets, people you lend to or borrow from, loans, repayments and EMIs.

Bank statements are processed on your device. When you import a statement, the file is read inside your browser. The file itself is never uploaded or stored. Only the transactions you review and confirm are saved.

Security and activity logs

To keep the app secure, every action on your account is recorded in an audit log: the time, the type of action (for example “signed in” or “imported a statement”), whether it succeeded, the ID of the record affected, your IP address, approximate country and browser type. Audit entries never contain transaction amounts, descriptions or search terms.

Cookies

The app uses only strictly necessary cookies: one to keep you signed in (valid for up to 14 days) and one that protects the sign-in process (valid for 10 minutes). There are no advertising, analytics or tracking cookies.

2. How we use information

• To sign you in and confirm you have been invited.
• To store and display your own financial records back to you.
• To protect the app and its users: detecting misuse, investigating problems and keeping an audit trail.

We do not sell, rent or share your information for advertising or marketing. We do not use your data to train AI or machine-learning models, and we do not build profiles of you.

3. Google user data

The app’s use and transfer of information received from Google APIs adheres to theGoogle API Services User Data Policy, including the Limited Use requirements. Google account information is used only to provide sign-in and to show your name and picture inside the app. It is not transferred to anyone else except as described in section 5, and no human reads it except as needed for security, to comply with law, or with your consent.

4. Who can see your information

• You. Your financial records are visible only to you.
• App owners (administrators) can see the list of invited people and the audit log described above (who did what and when, from which IP address). They cannot see your transactions, amounts, descriptions, budgets, loans or EMIs.
• No other users can see any of your information.

5. Service providers

The app relies on two providers to operate:

• Google, for sign-in (Google Privacy Policy).
• Cloudflare, which hosts the app and its database (Cloudflare Privacy Policy). Cloudflare may process data in data centres outside your country.

We may disclose information if required by law or to protect the rights and safety of users.

6. Security

• All traffic is encrypted with HTTPS.
• Sign-in uses Google OAuth. Session tokens are random, stored only as a one-way hash, and kept in cookies that page scripts cannot read.
• Every request checks that you are signed in, still have access, and can only reach your own records.
• The audit log is append-only, so entries cannot be edited or deleted.

No system is perfectly secure, but we work to protect your information and will act promptly on any issue.

7. Retention and deletion

• Your account and financial records are kept until you delete them.
• You can download all your data at any time from Settings → Export your data, and permanently delete your account and all financial records from Settings → Delete account. Deletion is immediate.
• If an owner removes your access, you are signed out and your records are kept so access can be restored, unless you or the owner delete the account.
• Audit log entries are kept after account deletion as a security record. They contain no financial data. You can ask for entries linked to you to be removed by contacting us.
• You can also revoke the app’s access to your Google account at any time at myaccount.google.com/permissions.

8. Your rights

You can access, correct, export and delete your information inside the app. For anything else, including requests under data protection laws that apply to you (such as India’s Digital Personal Data Protection Act, 2023 or the GDPR), contact us at the address below and we will respond within 30 days.

9. Children

The app is not intended for anyone under 18, and we do not knowingly collect information from children.

10. Changes to this policy

If this policy changes, the “Last updated” date above will change. Significant changes will be announced in the app before they take effect.

11. Contact

Questions or requests about privacy: clusterwithgigs@gmail.com