Privacy Policy

1. Provider and privacy contact

Provider: Carlos Eduardo Leandro. Contact for privacy, access, correction, or deletion: cadunatal@gmail.com.

2. Data we process

Account: email address, account identifier, and, if you choose Google sign-in, basic profile data made available by Google, such as name and email. Supabase Auth manages passwords; VoxFin cannot read them.

Financial data you enter: income, expenses, amounts, dates, descriptions, categories, currency, accounts/cards and their last four digits if provided, installments, recurring items, limits, goals, and contributions. VoxFin does not request bank credentials or connect to banks.

Preferences and usage: language, currency, time zone, settings, tutorial status, session tokens, and technical information needed to run the app, prevent abuse, and diagnose errors. Your browser may store preferences and session data locally.

Microphone and voice: only when you start the voice feature does the browser request microphone access and the app capture audio for transcription. Audio is sent to the VoxFin server and forwarded to Groq (Whisper model) to produce text; the transcript is then used to prepare an entry for your review. The app does not maintain a library of recordings. For operational diagnostics, the server may log a transcript excerpt of up to 80 characters. Groq says inference data is not retained by default, but inputs/outputs may be retained for up to 30 days for reliability or abuse investigations under the provider’s own controls and policy.

Receipts: if you attach an image, it is uploaded to Supabase storage and linked to the entry. Do not upload documents containing unnecessary information. Treat receipt links as private.

Purchases and licenses: VoxFin records order details, license status, associated email, and payment/activation identifiers. Mercado Pago processes payment and card data; VoxFin does not receive the full card number or security code.

3. Purposes

We use data to create and authenticate your account, save and sync your records, calculate summaries and reports, process voice commands, provide requested features, manage licenses and payments, send activation codes or essential messages, secure the service, respond to requests, and meet legal obligations. We do not sell personal data or use financial records for behavioral advertising.

4. Providers and transfers

We share only what is needed with service providers: Supabase (authentication, database, and files), Google (if you choose Google sign-in), Groq (voice transcription), Mercado Pago (checkout and payment confirmation), Resend (operational emails), and ExchangeRate-API (currency rates). Providers may process data under their own terms and policies. Financial records are not authorized for advertising.

The server and providers may process data in countries other than yours. We apply safeguards required by applicable law and select providers with appropriate security controls.

5. Retention and deletion

We keep data while your account is active and as needed to provide the service. You can delete your account under Settings → Account and Security or start a request from the public deletion page. The account and associated data are deleted from active systems, except information that must be retained by law, to resolve disputes, prevent fraud, or complete payment obligations; access is restricted and the data is deleted when the obligation ends.

Technical backup copies and logs may persist for a limited period under provider retention cycles. Google Play also requires deletion requests to be available outside the app: use the “Delete account and data” page and contact us by email.

6. Security

We use reasonable technical and organizational measures, including authentication, restricted access, and encrypted communications where supported. No internet service can guarantee absolute security. Protect your device and do not share credentials or receipt links.

7. Your rights and choices

You can access, correct, or delete data through app features or by contacting us. Depending on applicable law, you may also request information, portability, object to processing, or ask for review of automated decisions. Microphone and notification access require device permissions and can be revoked in system settings.

8. Children

VoxFin is not directed to children and is not designed for people who cannot legally enter into a contract. If you believe a child provided personal data, contact us so we can review and remove it where appropriate.

Analytics and conversions

We use the same Google Analytics 4 on public pages and /app to measure visits, trial button clicks, account creation, checkout starts and approved purchases. Conversion events include only button location, plan, sign-up method, license price, currency and Mercado Pago transaction ID. We do not send names, email addresses, personal documents, phone numbers, audio, financial entries, categories, balances or amounts from your personal finances.

Google cookies identify the browser and session. Measurement URLs retain only campaign parameters gclid, gbraid, wbraid and utm_*; other parameters and fragments, including authentication codes, are excluded. Attribution is stored in the browser session and sign-up record; orders also store client_id and session_id to associate a server-confirmed purchase with the visit. These identifiers are pseudonymous, not anonymous. The integration does not enable Google Signals or ad personalization/remarketing. You can control cookies and storage in your browser settings.

9. Policy updates

We may update this Policy to reflect changes to the app, providers, or law. The update date appears at the top of this page; material changes may also be announced in the app.