Skip to content
Nanyfin

Privacy Policy

Nanyfin is a private household finance workspace. This page summarizes the product data we handle, how MCP and AI access work, and how to request support or deletion.

Data we collect

  • Account and workspace data: email addresses, names, tenant names, tenant domains, billing metadata, plan status, and staff-entered support notes.
  • Finance workspace data: households, users, accounts, categories, transactions, transfers, credit-card bills, budgets, goals, subscriptions, investments, tags, dates, descriptions, balances, and reconciliation state.
  • MCP and API access data: MCP key metadata, hashed key material, token prefixes and last four characters, creation time, last-used time, revocation time, API request authentication outcomes, and temporary public-write preview, receipt, revision, and idempotency metadata.
  • Security and operational data: signup invitations, password reset tokens, SSO tokens, language preference, request IP address, user agent, throttling outcomes, and email delivery failures.

How we use data

  • To run the finance workspace, authenticate users, route users to the correct tenant, enforce access status, provide support, and protect accounts from abuse.
  • To provide finance features such as summaries, category breakdowns, budgets, subscriptions, credit-card faturas, goals, transfers, and transaction history.
  • For separately consented public ChatGPT writes, to prepare one exact ledger preview, wait for a distinct confirmation, record one user-specified income or expense, offer a separately confirmed eligible audited undo, and prevent stale or duplicate changes.
  • To diagnose security, signup, recovery, billing, and tenant-access issues without logging sensitive finance descriptions, balances, bearer tokens, or cookies.

AI and MCP access

  • Private MCP clients can use revocable workspace keys with a broader read/write tool surface. Keys are shown once and stored as hashes; keep them secret and revoke them when no longer needed.
  • The ChatGPT connection gives access to recorded summaries, transactions, accounts, budgets, and categories from the workspace you link. Linked workspace members share access to that workspace's financial records.
  • Recording entries through ChatGPT requires separate permission. You can preview and confirm an income or expense, cancel an unused preview, or separately confirm an eligible undo. These actions change only Nanyfin records; they do not connect to banks, move or pay money, transfer funds, trade, purchase, cancel subscriptions, or reverse external activity.
  • Changes through ChatGPT start with a preview valid for up to five minutes and require a separate explicit confirmation. Nanyfin checks your linked workspace, permissions, and selected records before saving, and prevents duplicate or outdated changes.
  • Nanyfin sends only the requested minimized response to the user's selected ChatGPT account. OpenAI handles conversations, Memory, feedback, abuse monitoring, and possible model improvement under the user's ChatGPT plan and settings; disconnecting Nanyfin does not delete prior ChatGPT chats or saved memories.
  • The ChatGPT connection uses Railway hosting and Stytch-by-Twilio authorization in the United States and may involve published provider locations including the United Kingdom.

Retention and deletion

  • Workspace finance data, including soft-deleted history, is retained while the workspace is active. A verified workspace deletion removes its primary Nanyfin data, keys, and identity links; Nanyfin keeps no separate post-deletion finance archive.
  • Public-write previews are valid for at most five minutes and their temporary rows are normally removed within 24 hours after expiry. Duplicate-safe receipt and idempotency metadata is normally kept for seven days. Cleanup removes that temporary metadata without changing the recorded or audited soft-deleted ledger history.
  • Railway Hobby application and HTTP logs expire after seven days. Stytch dashboard Event Logs have a 30-day window and Twilio security logs a separate 180-day window. Provider-controlled backups, support records, and logical or asynchronous deletion may continue beyond primary Nanyfin deletion, so immediate physical erasure is not promised.
  • Deleting or disconnecting Nanyfin does not delete prior ChatGPT records. Delete the relevant chats and saved memories in ChatGPT. Send export, correction, revocation, or deletion requests to support; we verify requester authority before acting.