No bank credentials
FinPlan never asks for a bank login. Balances come from what you or your assistant enter — there is no account-aggregator connection holding your credentials.
Trust · Where your data lives
Your money data stays yours.
Here is exactly what FinPlanTools stores, where it lives, and how to get rid of it — laid out per deployment mode, with no bank-level-security hand-waving. Every claim on this page maps to code you can read.
At a glanceSummary
- Bank credentials
- Never
- Social Security number
- Never
- Hosted state kept
- 60 min idle
- Analytics & tracking
- None
Two modes
Local, or hosted. You choose the blast radius.
Run FinPlan fully local and our servers never enter the picture. Or connect the hosted server for zero-install setup — and even then, what we hold is a short-lived scratch copy, not a record of you.
| Local (stdio) | Hosted server | |
|---|---|---|
| Where your state lives | Plain JSON files on your own disk. FinPlan reads and writes them where you tell it to; nothing is uploaded. | A plain JSON document held in the server's scratch directory under a random handle. It stops resolving after 60 minutes without use. Never written to a database or a persistent volume. |
| What leaves your machine | Nothing goes to our servers. The tools run against your local files over stdio. | Your state document is uploaded so the tools can run on it. It is referenced by an unguessable random handle, and each tool call is logged against your account. |
| What our servers can see | Nothing. There is no server in the loop. | The current state document, until it has gone 60 minutes unused. Tool calls are logged with your account ID and the names of the arguments passed, not their values. |
| How to delete it | Delete the file. It is yours; there is no copy anywhere else. | It ages out on its own: a document stops resolving after 60 minutes without use, a sweep deletes it within the next ten minutes, and each redeploy wipes the scratch directory entirely. |
One thing is true in both modes: your conversation runs through your AI provider — Anthropic, OpenAI, or Google. Local mode means our servers see nothing. It does not mean the model sees nothing. If you want the model kept out of the loop too, that is a question for your provider's privacy terms, not ours.
What we never touch
The most private data is the data we never collect.
No SSN, ever
There is no Social Security number field in the data model. FinPlan does not ask for one, and there is nowhere to put one.
No selling, no sharing
There is no analytics SDK and no ad tracking, and we never sell or share your financial data. The only outside services involved are the ones that run FinPlan: Railway hosts the server and its logs, which carry your account ID but never your email, and Supabase holds your account, including your email.
Hosted, in detail
If you use the hosted server, here is the whole picture.
1
Your financial state
When a tool needs your full profile, the document is uploaded and stashed under a random 128-bit handle in the server's temporary directory. It has a 60-minute sliding time-to-live: every tool call that uses it resets the clock, and once it has gone 60 minutes unused the server stops resolving it. A background sweep runs every ten minutes and deletes expired files. Files a tool generates for you to download — result bundles, an upgraded copy of your state — sit in the same directory on the same 60-minute clock, and are served to anyone holding their random link. The directory is ordinary container storage with no persistent volume attached, so every deploy starts it empty. There is no database of your finances.
2
Your account
The hosted server requires a free account; it exists to issue API keys. It lives in Supabase and holds your email plus your keys. We never store a raw API key — only its SHA-256 fingerprint, so the key is shown to you exactly once at creation and can never be read back, by us or anyone. Keys expire: those issued when an assistant connects over OAuth last 3 days and renew silently; keys you create by hand in the dashboard last 90 days. You can revoke any of them yourself, at any time, from the dashboard.
3
What the server logs
Each tool call is logged with the tool name, your account ID and key prefix, whether it succeeded, and the name and size of each argument it was given. Argument values are not logged, so figures an assistant passes inline stay out of that record. A failed call also logs the start of its error message, and an error can name the value it rejected. The logs note each download, but not its link, so no one reading them can use them to open your files. Logs are kept by our hosting provider, Railway. They hold your account ID but never your email address; only Supabase holds that.
4
Where it runs
The server runs on Railway; accounts and keys live in Supabase. Deleting an API key is self-serve and takes effect within a minute. Your uploaded state needs no delete button — it expires on its own an hour after you stop using it. Removing the account record itself (your email) is not yet self-serve; until it is, ask us and we will remove it.
The exits
Leaving is easy. That is deliberate.
Your data is plain JSON — the same format going in and coming out. Nothing is locked in a proprietary schema or a cloud you cannot reach.
1
Export anytime.
Your whole profile is one JSON document you can save on demand.
2
Readable and portable.
Open it in any editor. Back it up however you like.
3
Version it in git.
Track every change to your plan over time, on your terms.
A tool you cannot walk away from is a trap. FinPlan is built so you can leave with everything, in a format you already own.
Don't take our word for it. Read the source.
Every claim on this page is enforced by code, and the plugin that talks to your assistant is open for inspection.