Privacy Policy

cinder.fi is built around a simple principle: your financial data is yours.

How cinder.fi Works

You can use cinder.fi without an account. When used anonymously, all data stays in your browser — nothing is sent to our servers. If you create an account, your plan data is synced to a secure database so you can access it across devices.

What We Collect

Anonymous users: No personal data. All financial inputs are stored locally in your browser using localStorage and IndexedDB. On cinder.fi, the answers you change in the homepage planner (age, where you live, income, savings, spending, retirement age) are also kept in this browser tab's sessionStorage, so our guides and the AI page can use your numbers; they stay in that tab, are never sent to us unless you choose to save a plan, and are cleared when you save or close the tab.

Signed-in users: We store your email address, plan inputs (income, balances, assumptions), budget data, transaction history, scenarios, and score history. This data is stored in a secure, encrypted database hosted in Canada (ca-central-1). Some of the services listed under Third-Party Services process limited data outside Canada; see Where Your Data Is Processed.

We never collect: social insurance or social security numbers, bank login credentials, full account or routing numbers, or government-issued identification.

Account Connections (Plaid)

You can connect accounts through Plaid to automatically import balances and transactions. When you use this feature:

• Your bank credentials are entered directly into Plaid's secure widget — cinder.fi never sees or stores your bank login
• Plaid provides us with account names, balances, and transaction history
• Connection tokens are encrypted with AES-256-GCM before storage and are only accessible by our server-side functions
• You can disconnect any institution at any time, which immediately revokes access and deletes the encrypted token

Plaid's privacy practices are described in their End User Privacy Policy.

Encryption & Security

• All data in transit is encrypted via TLS (HTTPS)
• Database storage is encrypted at rest
• Plaid access tokens are additionally encrypted at the application level using AES-256-GCM with a dedicated encryption key
• Row Level Security (RLS) ensures users can only access their own data
• Sensitive operations (token exchange, balance fetching) run in server-side edge functions — never in the browser

Analytics & Advertising

We use the following tools to measure how people find and use cinder.fi so we can improve the product and reach new users. None of these tools ever receive your financial inputs, plan numbers, account balances, or transactions — only anonymized interaction data (page views, button clicks, signups, purchases).

Google Analytics 4 — measures site and app usage (page views, signups, feature engagement, purchases). Uses first-party cookies to distinguish visitors. If you're signed in, we associate a hashed user ID so cross-device usage can be stitched together. Google Analytics 4 provides data controls including opt-out, and we do not enable Google Signals or advertising features inside GA4 itself.

Google Tag Manager + Server-side Tag Manager — we operate our own tagging server at metrics.cinder.fi (hosted on Railway) which receives measurement events first-party and forwards them to our analytics and ad-measurement providers. This keeps your browsing data inside our own domain rather than third-party domains, and lets us strip or redact fields before forwarding.

Reddit Conversions API — for signups and purchases that originate from Reddit Ads, we send the conversion event server-to-server from our tagging server or from Stripe's webhook (not from your browser). We send a SHA-256 hash of your email and the event type ("SignUp", "Purchase", etc.) so Reddit can attribute the conversion. The raw email is never sent, and no financial details are ever included.

Google Ads measurement — for visitors who arrive from a Google Ads click, we send the conversion event (signup, purchase) so Google Ads can measure campaign effectiveness. Same principle: hashed identifiers, no financial data.

Opting out of advertising cookies. If you don't want Google or Reddit to receive advertising-measurement data from your visit:

• Install any tracker-blocker (uBlock Origin, Privacy Badger) — our tagging server respects blocked requests
• Use a privacy-focused browser (Brave, Safari with ITP, Firefox with Enhanced Tracking Protection)
• Disable advertising cookies via Google Ad Settings and Reddit privacy settings

Our own small cookies. cinder_si remembers that you're signed in, so the homepage can skip what's meant for new visitors; it holds no identity and lasts 30 days. On the homepage, cf_id is a random ID that keeps you on the same version of the page while we test changes to it; it lasts a year and is only set once analytics may run for your visit.

AI Features

Ask cinder and the AI import tools (categorizing transactions, reading a statement or spreadsheet you upload, suggesting bills) use third-party language models. Requests are sent from our servers through the Vercel AI Gateway, which routes them to a model provider. Today the providers are OpenAI and Anthropic. Ask cinder chat and explanations use OpenAI; structured tasks such as categorization and imports use Anthropic's model, with OpenAI as the fallback.

• Ask cinder: your question plus the plan and budget context needed to answer it. Emails, phone numbers, account numbers and similar identifiers are stripped before anything is sent.
• Categorization and bill suggestions: transaction descriptions with identifiers stripped.
• Imports: the statement, spreadsheet or text you choose to import, so the model can read it.

Bank login credentials are never sent to an AI provider.

Third-Party Services

These companies process data on our behalf. Each is listed with its purpose, the data it receives and where it processes it. Providers marked "United States" may also process data in other countries under their own terms.

• Supabase — authentication, database and server-side functions. Receives everything you store in an account: your email, plan, budget and transactions. Canada (ca-central-1); data is encrypted at rest. See their privacy policy.
• Vercel — hosts the app and this site, and runs the Vercel AI Gateway that routes AI requests (see AI Features). Receives standard server logs (IP address, user agent), page-view and performance measurements, and the AI request content described above. United States. See their privacy policy.
• Railway — hosts our MCP server, background worker and the analytics tagging server at metrics.cinder.fi. Receives the requests those services handle, including MCP requests you authorize from an AI assistant. United States. See their privacy policy.
• OpenAI — language-model provider for Ask cinder chat and explanations, and the fallback for structured AI tasks. Receives the AI request content described above. United States. See their privacy policy.
• Anthropic — language-model provider for structured AI tasks such as categorization and imports. Receives the AI request content described above. United States. See their privacy policy.
• Plaid — connects accounts for balance and transaction import. Receives the bank you choose and your login in Plaid's own widget; returns account names, balances and transactions. United States. See their privacy policy.
• Stripe — processes web subscription payments. Receives your email and payment details; we do not store your payment card details. United States. See their privacy policy.
• RevenueCat — manages subscriptions bought in the iOS app. Receives your user ID and purchase history from the Apple App Store. United States. See their privacy policy.
• Apple — App Store purchases, push notifications and Sign in with Apple. Receives your purchase, your device push token and the text of push notifications (which can include bill names and amounts unless you turn on "Hide amounts in notifications"), and, if you use it, your Apple sign-in. United States. See their privacy policy.
• PostHog — product analytics: page views, clicks and feature use, plus masked session replays. Receives your user ID and email once you sign in, and interaction events. Amounts are grouped into ranges and never sent exactly. United States. See their privacy policy.
• Sentry — error tracking. Receives technical error reports (device, browser and app version, the error and what led to it) tagged with your user ID; on-screen digits are masked and IP addresses are not collected. United States. See their privacy policy.
• Loops — sends our transactional and lifecycle emails (sign-in codes, receipts, reminders and tips). Receives your email, name if you gave one, country, plan and sign-up date. United States. See their privacy policy.
• Google (Analytics, Tag Manager, Ads, Sign-In, Firebase) — conversion measurement and ad attribution (see above), Sign in with Google, and Firebase Analytics in the iOS app, which does not use the advertising identifier (IDFA) and forwards only the sign-up event. Google's Firebase Cloud Messaging also delivers push notifications to Android devices, with the same content rules as above. United States. See Google's privacy policy.
• Reddit (Pixel, Conversions API) — ad attribution for Reddit campaigns. Receives a hashed email and the event type for web signups and purchases that came from Reddit Ads. It receives no data about App Store purchases. United States. See Reddit's privacy policy.

If you choose to import from YNAB, your browser sends the YNAB access token you provide directly to YNAB to fetch your budget. The token stays in your browser.

Where Your Data Is Processed

Your account database is hosted in Canada. The other services above, including AI processing, hosting of our servers, analytics, error tracking, email and payments, process data in the United States or other countries, so some of your data leaves Canada. Where a service receives personal information, we share only what it needs for its purpose and rely on contractual commitments from the provider to protect it and to use it only to provide the service. Your information may be accessible to courts and authorities in the countries where it is processed. To ask how your data is handled, contact info@cinder.fi.

Data Deletion

Anonymous users: Clear your browser's site data for cinder.fi (and cinderfi.com if you used the previous domain), or use the "Clear browsing data" feature.

Signed-in users: You can delete your account and all associated data at any time from Settings. This immediately and permanently removes:

• Your plan, scenarios, budget, transactions, and score history
• All Plaid connections (tokens are revoked and deleted)
• Your authentication record and profile

You can also disconnect individual bank connections or clear transaction history without deleting your account.

To request deletion by email, contact info@cinder.fi. Requests are processed within 30 days.

Data Retention

We retain your data only for as long as your account is active. When you delete your account, all data is permanently removed. We do not retain backups of individual user data beyond standard database backup windows (up to 7 days), after which deleted data is irrecoverable.

Changes

If this policy changes materially, we'll notify signed-in users by email and update the date at the top. The current policy is always available at this URL.

Contact

Questions about this policy or your data? Reach us at info@cinder.fi.