Privacy Policy

1. Who we are

FinTracker is a personal finance tracker for people in Uganda. It is operated by Luminous Technologies(“we”, “us”). We are responsible for the personal information you give us through the FinTracker website and app.

If you have any question about this policy or your information, contact us at info@luminouscrm.com.

2. What we collect

Account information

When you register we collect your first and last name, email address and password, and the currency you choose for your account. Your password is handled by our authentication provider and stored only in hashed form; we cannot see it.

Financial records you enter

FinTracker only knows what you type in. This includes your accounts and their balances, income and expense transactions and their categories, income streams and yearly targets, savings goals and entries, debts and repayments, and assets and liabilities you add to your net worth.

FinTracker does not connect to your bank or mobile money accounts, does not read your SMS messages and cannot move money on your behalf.

Subscription and payment records

When you subscribe we keep a record of your plan, subscription status and billing period, and of each payment attempt: the amount, currency, status (pending, successful or failed), the date and the transaction reference from our payment provider.

To request a payment, the mobile money phone number you enter is sent to our payment provider, ioTec Pay, which sends the payment prompt to your phone. We do not store that phone number in the FinTracker database. We never see or store your mobile money PIN.

Technical information

Like most websites, our hosting and database providers keep standard technical logs, such as IP address, browser type and the time of each request, to run and secure the service.

3. How we use your information

• To provide FinTracker: show your dashboard, reports and exports, and keep you signed in.
• To run your trial and subscription, process payments and keep billing records.
• To send you service emails, such as a welcome email, email verification and password reset messages, and a reminder shortly before your paid period ends.
• To provide support when you contact us.
• To keep the service secure, prevent abuse and fix problems.
• To meet our legal obligations.

We do not sell your personal information, we do not use your financial records for advertising, and we do not share them with anyone except the service providers listed below, who help us run FinTracker.

4. Service providers and where your data is stored

We use a small number of providers to run FinTracker:

• Supabaseprovides our database and user authentication (sign-in, email verification and password reset). Your account and financial records are stored in Supabase's data centre in the European Union, in Ireland.
• Vercelhosts the FinTracker website and app. Our application servers run in Vercel's Dublin, Ireland region.
• Resend delivers our own emails, such as the welcome email and subscription reminders. It receives your email address, your first name and the content of the email.
• ioTec Pay processes mobile money payments. It receives your phone number, the payment amount and a reference that links the payment to your FinTracker account.

Because these providers are based or store data outside Uganda, your information is transferred to and stored in other countries. We choose providers that protect data with industry-standard security, and we only share what each one needs to do its job.

5. Cookies and local storage

FinTracker uses only what it needs to work:

• Sign-in cookies set by Supabase keep you signed in and secure your session.
• Preference storageremembers your appearance (light, dark or system theme) and whether the app sidebar is open, using a cookie and your browser's local storage.

We do not use third-party analytics, advertising or tracking cookies. If you block cookies in your browser, you will not be able to sign in.

6. How long we keep your information, and deletion

We keep your account and financial records for as long as your account exists, so they are there when you come back, including after a trial or subscription ends.

You can delete your account at any time from Settings → Profile. After you confirm with your password, we permanently delete your account and everything linked to it: your profile, accounts, transactions, categories, income streams, savings goals, debts, assets and liabilities, and your subscription and payment records. This cannot be undone, so export anything you want to keep first.

Deleted data may remain for a limited time in our providers' backups and logs before it is overwritten. Records kept by ioTec Pay about your payments are held under its own policies.

7. Your rights

Uganda's Data Protection and Privacy Act, 2019 gives you rights over your personal information. In particular, you can:

• Access your information. Everything you enter is visible in the app, and you can download your transactions, income streams and net worth as Excel files.
• Correct it. You can edit your profile and records at any time, or ask us to correct anything you cannot change yourself.
• Delete it, by deleting your account in Settings or by asking us.
• Object to how we use your information, or ask us questions about it.

To make a request, email info@luminouscrm.com. We may need to confirm your identity before acting on it. If you are not satisfied with our response, you can complain to Uganda's Personal Data Protection Office.

8. Security

Data is encrypted in transit between your browser and our servers. Our database uses row-level security, so each user's records can only be read and changed by that user's signed-in account. Our internal admin tools show account and billing information for support purposes, not your financial records.

No online service can be perfectly secure. Use a strong, unique password and keep it to yourself. If you think your account has been accessed without your permission, change your password and contact us.

9. Children

FinTracker is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has created an account, contact us and we will delete it.

10. Changes to this policy

We may update this policy as FinTracker changes. We will change the “Last updated” date above and, for significant changes, tell you by email or in the app before they take effect.

11. Contact us

For privacy questions or requests, email info@luminouscrm.com. You can also read our Terms of Service.