The Finances
Get the app

Privacy Policy

Last updated: October 27, 2026

This Privacy Policy describes how Jholdy Tecnologia Ltda - ME (CNPJ 27.694.217/0001-03), the controller of the data processed through the The Finances app and website, collects, uses, stores, and protects personal data, in accordance with Brazil's General Data Protection Law (Lei nº 13.709/2018 — LGPD).

1. Who processes your data

Controller: Jholdy Tecnologia Ltda - ME, CNPJ 27.694.217/0001-03. Contact channel for any matter related to personal data, including exercising your rights as a data subject: admin@thefinances.com.br.

2. What data we process, and why

2.1 Financial data you record in the app

The Finances is local-first: transactions, accounts, categories, budgets, and other financial data you register are stored in your own device's local storage (SQLite). This data does not travel to our servers, except in the situation described in item 2.3.

Legal basis: performance of the service you requested (art. 7, V, LGPD) — local processing is what makes the app work.

2.2 Account and login data

If you choose to create an account (login is not required to use the app), we collect your email and name, obtained via Google, through our authentication provider (Amazon Cognito). We do not have access to your Google password.

Legal basis: performance of a contract / preliminary procedures (art. 7, V, LGPD).

2.3 Cross-device sync and shared space (premium feature)

If and only if you enable cross-device synchronization or the shared financial space (premium features), the financial data necessary to keep devices/participants in sync starts traveling to and being stored on our servers (Amazon DynamoDB, us-east-1 region), protected by TLS in transit and encryption at rest managed by AWS. In a shared space, the other participants you invite have access to that space's data.

Legal basis: performance of a contract (art. 7, V, LGPD), strictly for users who enable the feature.

2.4 Subscription/payment data (premium feature)

Premium subscriptions are processed by the App Store or Google Play through RevenueCat. We do not have access to full credit card data — we only receive confirmation of the subscription status (active, canceled, etc.), necessary to unlock the premium features of your account.

Legal basis: performance of a contract (art. 7, V, LGPD).

2.5 Waitlist (website)

If you sign up for the waitlist on the website, we collect the email address you provide (and name, if you choose to provide it), for the sole purpose of notifying you about the app's availability. This processing depends on your explicit consent, given on the form itself.

Legal basis: consent (art. 7, I, LGPD).

2.6 Voice input and artificial intelligence analysis

The app lets you log entries by speaking. Converting your voice into text is done by the speech recognition service of the device's own operating system (Apple on iOS, Google on Android) — we do not receive the audio, and its processing follows the operating system vendor's privacy policy.

When you use the automatic analysis of the dictated text, only the transcribed text (never the audio) is sent to our servers and processed by Amazon Bedrock, in the us-east-1 region, to identify amounts, dates, and categories and propose the entries on screen. You review and confirm before anything is recorded. That text is used only to answer that one call: it is not used to train artificial intelligence models, and we neither store nor log it after the response.

Legal basis: performance of the service you requested (art. 7, V, LGPD).

2.7 App usage analytics (anonymous)

To understand how the app is used and to improve it, the mobile app sends anonymous product-usage events — for example, screens viewed, onboarding steps, which features are used, and purchase-flow steps — to PostHog, hosted in the European Union (PostHog Cloud EU).

We never send: amounts, balances, descriptions, category or account names, voice text, email, or any financial data. IP geolocation is disabled, there is no session recording, no advertising tracking, and no cross-app tracking (we do not use ATT/IDFA).

Events are not linked to your account, even if you sign in: we do not send any account identifier (nor your email or Apple ID).

PostHog acts as a processor, and this processing involves an international transfer of data to the European Union.

Legal basis: legitimate interest (art. 7, IX, LGPD) in improving the product. You can opt out at any time by turning off the option at Settings → Account → "Share anonymous usage data".

3. Who we share data with

We do not sell personal data. We only share data with the processors strictly necessary to operate the service:

  • Amazon Web Services (AWS) — hosting, database, authentication, and AI text analysis infrastructure (Cognito, DynamoDB, Bedrock).
  • Apple and Google — the device operating system's speech recognition, when you use voice input.
  • RevenueCat — processing and validation of premium subscriptions.
  • PostHog — anonymous usage analytics for the mobile app (PostHog Cloud EU, European Union).
  • Google — login provider, when you choose to sign in with your Google account.

4. How long we keep the data

  • Local financial data: stays on your device until you delete it or uninstall the app.
  • Sync data (premium): kept while the subscription is active and for a reasonable additional period after cancellation, to allow reactivation without data loss; it may be deleted earlier upon request.
  • Waitlist email: kept until the app launches or until you request its deletion, whichever comes first.
  • Anonymous usage events (analytics): kept for the period necessary for the purposes described, according to the provider's policy.

5. Your rights as a data subject

Under articles 17 to 22 of the LGPD, you have the right to:

  • confirmation that processing exists;
  • access to the data;
  • correction of incomplete, inaccurate, or outdated data;
  • anonymization, blocking, or deletion of unnecessary data or data processed in violation of the LGPD;
  • portability of the data to another provider;
  • deletion of data processed based on your consent;
  • withdrawal of consent, at any time;
  • information about who we share your data with.

To exercise any of these rights, contact us at admin@thefinances.com.br. We will respond within the timeframe required by law.

6. Security

Local financial data on your device is protected by the native security of the operating system (iOS/Android). Data that travels to our servers (premium features) uses TLS in transit and encryption at rest managed by AWS. No system is 100% immune to incidents; in the event of a relevant security incident, we will notify affected data subjects and Brazil's National Data Protection Authority (Autoridade Nacional de Proteção de Dados — ANPD) as required by the LGPD.

7. Changes to this policy

We may update this Privacy Policy to reflect changes in the product or in the law. The "last updated" date at the top of this page always reflects the current version.