Privacy Policy
Effective Date: June 2026 · Last Updated: June 2026
Overview
Finlighten ("we", "us", or "our") is committed to protecting your financial and personal information. This Privacy Policy explains how we collect, use, store, and protect your data when you use the Finlighten application.
Information We Collect
We collect the following categories of information:
- Account information: Name, email address, and date of birth provided during registration
- Financial data: Bank transaction history, account balances, and credit card details obtained through Plaid with your explicit consent
- Authentication data: Login credentials managed securely by Firebase Authentication — we never see your passwords
- Bank credentials: We never store your bank login credentials. Plaid handles all bank authentication using tokenized connections
How We Use Your Information
Your information is used exclusively to:
- Display your transaction history, account balances, and spending insights
- Calculate financial health metrics and literacy insights
- Detect recurring subscriptions and spending patterns
- Show credit card APR, interest charges, and debt information
- Provide personalized financial education content
We do not use your data for advertising, profiling for third parties, or any purpose other than providing you financial insights.
How We Protect Your Data
- Encryption in transit: All data is transmitted using TLS 1.2 or higher
- Encryption at rest: All data stored in Google BigQuery is encrypted using AES-256 encryption
- Access controls: Production systems are protected by Google Cloud IAM with Multi-Factor Authentication
- Secret management: API credentials are stored in GCP Secret Manager, never in code
- Plaid tokenization: Bank connections use Plaid's secure token system — your bank credentials never touch our servers
Third-Party Services
Finlighten uses the following trusted third-party services:
- Plaid: Secure bank account connectivity. Plaid Privacy Policy →
- Google Firebase: Authentication services. Firebase Privacy Policy →
- Google Cloud Platform: Data storage and processing. GCP Privacy Policy →
We do not share your data with any other third parties.
Data Retention
- Your data is retained for as long as your account is active
- Upon account deletion, all personal data is permanently deleted within 30 days
- Plaid access tokens are revoked immediately upon account deletion
- You may request data deletion at any time by contacting us
Your Rights
You have the right to:
- Access: Request a copy of all data we hold about you
- Correction: Request correction of inaccurate personal information
- Deletion: Request complete deletion of your account and all associated data
- Portability: Request your transaction data in a portable format
- Withdrawal of consent: Disconnect any bank account at any time through the app
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
Children's Privacy
Finlighten is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately.
Changes to This Policy
We may update this Privacy Policy periodically. We will notify you of significant changes via email or in-app notification. Continued use of Finlighten after changes constitutes acceptance of the updated policy.
Contact Us
For privacy-related questions, requests, or concerns:
- Email: [email protected]
- Response time: Within 30 days