Privacy policy

1. Who is responsible

The controller responsible for your personal data is Tran Minh Quan, Via Zurigo 9, 6900 Lugano, Schweiz, tranminhquan29052008@gmail.com.

This policy applies to users everywhere and is written to meet the Swiss Federal Act on Data Protection (FADP), the EU General Data Protection Regulation (GDPR) and Vietnamese personal data protection law.

2. The data we process

Account details: display name, email, a profile picture if you upload one, and your password in hashed form (no one can read the original, us included).

What you enter: income, spending, fixed costs, categories and budgets, savings goals, assets, shared houses, saved filters, the problem reports you send (with any screenshot and device details you attach), and your conversation with the AI assistant, bank-transfer recipients you keep (bank, account number, name) and transfers waiting for your confirmation.

Technical data: sign-in sessions (with the device, browser and last activity, so you can recognise and sign out a device), in-app notifications, display choices (language, theme, time zone, number and date format), and the hosting provider's server logs (IP address, time and page requested).

Diamond purchases: for App Store purchases, what Apple signs for each transaction (the product, purchase and expiry dates, whether it came through the free week or Family Sharing, whether it was refunded), linked to your account — never your card or Apple ID details; for earlier bank-transfer purchases, name, email, plan, amount, transfer code, status and dates.

Fundi shows no ads, uses no tracking or behavioural analytics, does not sell your data, and makes no decision about you based solely on automated processing that has legal or similarly significant effects on you.

In the iPhone and iPad app: your sign-in is kept in the device's secure keychain; a copy of your latest figures, and anything you record while offline, stays on the device until it has been sent; widgets keep a short summary (what's left to spend, your categories) in storage the app shares with them on your device; reminders are scheduled on the device itself. Face ID or Touch ID is checked by the device — Fundi never receives biometric data. If you turn on notices on the lock screen, the device's push token is kept so they can reach it, and Apple's push service delivers each one (its title and text); the token is deleted when you turn them off or sign out.

3. Purposes and legal bases

Providing the service and your account — to perform our agreement with you (GDPR Art. 6(1)(b)).

Diamond payments and bookkeeping — to perform the agreement and to comply with legal obligations (Art. 6(1)(b) and (c)).

The AI assistant — only with your consent (Art. 6(1)(a)), which you can withdraw at any time on the Ask Fundi page.

Security, abuse prevention and server logs — our legitimate interest in keeping the service and your data safe (Art. 6(1)(f)).

Answering problem reports and support requests — to perform the agreement, and our legitimate interest in fixing faults and improving the service.

Under Vietnamese law, processing is based on the consent you give when you sign up for the purposes above, and on your separate consent when you turn on the AI assistant.

4. Who receives data

Hosting and database providers: data is stored in Frankfurt (Germany, EU); these providers are US companies.

The email delivery service (United States): only your email address and the message, when the app emails you (a password reset, say).

Bank-app link service (Vietnam): when you start a bank transfer, the link that opens your chosen bank app goes through a public service. Only for apps that can fill a transfer in does the link carry the account number, amount, note and recipient's name; for any other app no transfer details are sent. Bank logos are fetched through Fundi's own server.

The AI assistant's provider (United States): only once you have consented and ask a question or request tips — your question, the last few messages of the conversation and a snapshot covering this month, totals for the last six months, spending by category, your savings goals, your asset and debt totals, unpaid fixed costs, and your expenses from the last 60 days with their descriptions and tags. Your name, email and password are not included.

When you scan a receipt, its text is read on your own device. Only when the device can't pick a category itself, and you have Diamond with the AI assistant on, are the shop name, the item lines (long numbers removed) and your category names sent to the AI assistant provider to pick one; the picture is never sent or kept.

The other members of your shared houses: what you record in that house.

Apple (App Store): sells Diamond in the app and takes the payment under its own privacy policy. It tells us about each purchase (as above); we give it nothing but the random code a purchase carries, which matches it to your account.

Public authorities: where the law requires it.

Service providers process data only on our instructions, under data processing agreements. Exchange rates are fetched from a public source; none of your data is sent.

5. Transfers abroad

Your data is processed in Germany (EU), may be accessed or processed in the United States and — if you use the AI assistant — in United States.

The EU is recognised by Switzerland as providing adequate protection. For the United States and other countries without such recognition, transfers rely on the provider's certification under the EU–U.S. and Swiss–U.S. Data Privacy Framework, or on the European Commission's standard contractual clauses (recognised by Switzerland).

For users in Vietnam, data is transferred abroad to the countries above in accordance with Vietnamese law on the cross-border transfer of personal data.

6. How long it is kept

Account data and what you enter: while your account exists.

Your conversation with the AI assistant: the last 30 exchanges at most; deleted when you start a new conversation, withdraw consent or delete your account.

Problem reports: while your account exists; screenshots in them are deleted 30 days after the report is closed.

Server logs: for a short time, under the hosting provider's policy.

Diamond payment records: 10 years, as bookkeeping law requires — also after you delete your account.

When you delete your account, your data is deleted at once, except the payment records above and the shared-house bills and payments you took part in, which stay with the other members under your name. A house you own passes to its longest-standing member. Technical backups may hold a copy for a short time before they are overwritten.

7. Your rights

You have the right to be informed about and access your data; to correct it; to have it erased; to restrict processing; to receive it in a machine-readable format and take it elsewhere; to object to processing based on legitimate interests; and to withdraw consent at any time (which does not affect processing before the withdrawal).

You can do most of this yourself in the app: edit any entry; export your data in Settings → Your data (Excel by month on Diamond, or all your records as JSON, pictures aside); delete your account in Settings → Danger zone; withdraw AI consent on the Ask Fundi page. For anything else, write to us by email at the top of this page or through Settings → Report a problem; we reply within 30 days.

You may complain to a data protection authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC); in the EU the supervisory authority where you live or work; in Vietnam the Ministry of Public Security.

8. Cookies and browser storage

Fundi uses only the cookies the service needs to work: to keep you signed in, to remember your colour theme, and to hold a house invitation or something you shared to the app for a moment. Browser storage keeps a few display choices and an offline page. There are no advertising or tracking cookies, so no cookie consent is asked for.

The iPhone and iPad app uses no cookies; what it keeps on your device is listed in section 2.

9. Security and incidents

Passwords are hashed, sessions can be revoked, every connection is encrypted and every request is checked for access. No system is perfectly secure; if an incident affects your data, we will inform the competent authorities and you as the law requires.

10. Children

Fundi is for people aged 16 and over. Anyone younger needs a parent's or guardian's consent.

11. Changes to this policy

This policy may be updated; the new version is posted on this page with its date. Important changes are announced in the app at least 30 days before they take effect, and where needed you will be asked to consent again.