Privacy you can audit,
not just believe.
You've read "we don't sell your data" on a dozen finance apps. Here's why ours is different: the guarantee is built into how the software works, and you can check it. This is the exact path a transaction takes, and the exact point where it stops.
Where your data goes, and where it stops.
One coffee purchase, from the moment it leaves your device to the moment the insight comes back. Watch for step 4.
It leaves your device, encrypted
Your transaction is sent to TrackFin over an encrypted connection. Nobody in between, not your ISP and not us in transit, can read it.
It's loaded into memory
The AI service receives it and holds it in RAM for the length of a single request. It is never written to a disk or a database.
It's analyzed, then dropped
The transactions go to our inference provider for the length of that one request, under a no-retention arrangement, to find budgets, anomalies and trends. No data broker or ad network ever sees them.
The analysis is never written down.
Your ledger lives in your account, encrypted, because you need to see it. What does not exist is a second copy: in the analysis service there is no line of code that stores a transaction and none that logs one. The place where every other finance app keeps an analysis history, we left empty, on purpose. The negative space is the product.
The insight returns, the data is gone
You get your result in under a second. The moment the response is sent, the transaction it was computed from no longer exists on our servers.
The whole claim, in code you can read.
The AI service source is MIT licensed and shared with anyone who asks. This is the actual shape of the handler that processes your data. Notice what isn't there.
# your transactions exist here for exactly # one request, and no longer: @app.post("/api/analyze") async def analyze(req: AnalyzeRequest): prompt = f"{_tx_table(req.transactions)}\n{req.query}" response = await query_llm(prompt) # ✗ no db.insert(txns) # ✗ no logger.info(txns) # ✗ no training dataset built return {"response": response} # req.transactions is released when this returns
# once access is granted (Python 3.11) $ git clone <your-access-url>/TrackFin $ cd TrackFin/ai-service $ pip install -r requirements.txt # run it on your own machine $ uvicorn main:app --port 8000 INFO Provider config: no API key set INFO Uvicorn running on 127.0.0.1:8000 # with no API key set it never calls out at all: # analysis falls back to on-device rules. # point the app at it with VITE_AI_API_URL.
Six commitments, each one checkable.
In-memory processing
Your transactions are held in RAM for the length of one request and never written to disk.
No training on your data
Your spending never becomes training material, and never reaches a data broker or an ad network.
Zero-log processing
The service emits metrics only, never log lines containing your transaction payloads.
Encrypted end to end
TLS 1.3 in transit with forward secrecy; data at rest is encrypted. Keys are never sellable.
Export anytime
Download everything you've ever added in one click from the Account page, with no support ticket and no waiting period.
Delete permanently
Ask us to close your account and every associated record is destroyed for good, not "flagged as deleted."
A promise vs. a property.
"We promise not to."
A policy is a sentence in a document. It can be reworded in an update, reinterpreted after an acquisition, or quietly ignored. You have no way to check whether it's true today, so you're trusting an intention, and intentions change with incentives.
"Here, check for yourself."
An architecture is a fact about how the software behaves. There is no storage step to disable and no logging line to comment back in. We share the code with anyone who asks, so the claim is auditable rather than trusted, and if you'd rather trust no one, you can run the whole service yourself.