Privacy

Your account

You need an account to connect a bank. Sign-in runs on Firebase Authentication, a Google service. Firebase stores:

• your email address;
• how you sign in: with a password, of which Firebase keeps only a scrambled hash, or with your Google account;
• when the account was created and when you last signed in.

That's all that goes to Firebase. It never receives your transactions, balances, account names or anything from SimpleFIN. Google may keep technical logs, such as your IP address, when your browser talks to Firebase, and Firebase's code in the app sends Google its own version details. Google's privacy policy covers those.

What stays in your browser

Your bank data lives in your browser's storage on your device, filed under your account: the SimpleFIN connection, locked with a key the browser won't hand out, the transactions and balances it syncs, and the changes you make. None of it is sent to our servers or to Firebase. When two people share a browser, each account sees only its own data.

Because we never hold a copy, we can't restore it. Clearing your browser's data for this site deletes it, and every other browser or device starts empty.

Your bank connection

Spent So Far gets transactions through SimpleFIN Bridge, a separate service you sign up for and pay. You connect your banks on SimpleFIN's site, so we never see your bank password, and your browser talks to SimpleFIN directly. SimpleFIN's own privacy policy covers what it keeps.

The waitlist and page visits

If you join the waitlist, we store your email, your answers to the two optional questions, the page you signed up on, your country as Cloudflare reports it, and your browser's user agent. If another site linked you here, we also keep that site and page (never its query string) and any utm tags in the link.

The site also records a few events, such as a page view or someone opening the sample. Each one holds the event name, the page, the referring site, utm tags and a country. There's no email, no IP address and nothing that ties one event to another person. Cloudflare Web Analytics counts visits as well, without cookies.

We use this to decide whether Spent So Far is worth building and to run it. We don't sell it, rent it or share it for advertising, and we keep it only as long as we need it for those purposes.

Who else handles data

• Google runs sign-in, through Firebase Authentication.
• Cloudflare hosts the site and our small database, and handles every request, so it sees your IP address.
• SimpleFIN holds your bank connection, in an account that belongs to you.

Where data is stored

Google and Cloudflare may store and process the data described on this page outside Canada, including in the United States. While it's there, it's subject to the laws of that country, which may let its authorities access it.

Security

We keep what we hold to a minimum and protect the rest: the site only runs over HTTPS, the app loads no third-party scripts, and your SimpleFIN connection is encrypted in your browser. No system is perfectly secure. If a breach of our systems creates a real risk of significant harm to you, we'll tell you and report it to the Office of the Privacy Commissioner of Canada, as the law requires.

Age

Spent So Far is for people 18 and over. We don't knowingly collect data from anyone younger; if you think we have, write to us and we'll delete it.

Deleting your data

• To delete your account, open Settings in the app and choose Delete my account. That removes your Firebase account and this account's data in the browser you're using.
• To clear one browser, sign out with Also delete my data from this browser ticked, or use Delete everything from this browser in Settings. Repeat it on each browser or device you used.
• To stop SimpleFIN's access, turn off the connection in SimpleFIN, under Apps.
• To remove your waitlist entry, email [email protected].

Contact

Spent So Far's privacy lead is responsible for how personal information is handled here. Write to [email protected] to ask what we hold about you, to have it corrected or deleted, or to withdraw your consent. Spent So Far is based in Toronto, Ontario, Canada.

If you're not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

If this page changes, so does the date at the top. If a change affects your account, the app will say so.