Privacy Policy

Effective September 12, 2026

This policy explains what Finn collects, why, where it goes and how you control it. Finn is a product of Raliworks LLC ("we", "us"). It applies to the Finn iOS app and to this website.

1. Information we collect

Account information

When you sign in with email, Apple or Google we receive a stable user identifier and, if you allow it, your email address and name. We use these to create and identify your Finn account. If you use Apple's "Hide My Email", we receive the relay address instead. We do not keep a separate profile of you beyond that: what Finn knows about your situation, it knows from the accounts you link, the bills you track and the notes you write.

Linked financial data

When you link an institution through Plaid we receive and store the data needed to show your accounts: institution name, account names, types and masked account numbers, balances, investment holdings and securities, and transactions with their dates, amounts, merchants and categories. Your institution username and password are entered directly with Plaid and are never seen or stored by us. Plaid provides us an access token, which is stored only on our servers, never on your device, and which allows read-only retrieval.

Data you enter by hand

Manual institutions, accounts, balances, holdings, transactions and properties; your monthly bills; and your notes.

Email and calendar

Connecting Gmail or Outlook gives Finn read access to that mailbox: it can search it and open the full text of a message when answering you, or when Finn Intelligence is looking across your week. It reads when there is a reason to — a question you asked, or a subject line that doesn't say enough on its own — not continuously. Finn cannot send, reply to, delete or otherwise change anything in your mailbox, and that is a property of the access we request, not a promise about our code.

Searching and reading both happen on your device, against your own connection; the message text is sent to our assistant service only as part of answering, and we keep none of it. We store the connection's OAuth token so the connection persists, and we store only what you choose to keep as a note. We do not copy your mailbox. Calendar events are read on your device through iOS and are sent to Finn only as part of a request you make. Both connections can be removed in the app at any time — Settings → Email & Calendar, which also shows when each mailbox last synced.

Messages to Finn

The questions you type or dictate, and the answers generated, are stored on your device as chat history. Each request also sends the conversation and the context needed to answer it (a snapshot of your financial data and the relevant notes) to our assistant service.

On-device only

Voice dictation is transcribed on your device by iOS; audio is not sent to us. Face ID is handled by iOS and we never see biometric data.

Device and technical data

Our servers log ordinary request data (IP address, time, app version, request path) for security and debugging. If you enable notifications, we store a push token so we can deliver them.

What we do not collect

We do not collect your precise location, contacts or advertising identifiers, and we do not run third-party analytics or advertising SDKs in the app. Photos are used only when you attach one to a message for Finn.

2. How we use it

• To display your accounts, bills and notes, and keep them in sync.
• To generate Finn's answers, and to let Finn create or update your notes when you ask.
• To price holdings and pull the market data an answer needs.
• To keep the Service secure, diagnose problems, enforce usage limits and respond to your support requests.

We do not use your data to build advertising profiles, and we do not sell or rent it to anyone.

3. Where data lives and how it is protected

Your account data is stored in our database in the United States. Chat history and cached balances are stored on your device. Data moves over TLS and is encrypted at rest. Plaid access tokens are held only server-side and are never returned to the app; email connection tokens are held in your device's Keychain. Our staff access production data only when needed to run the Service or resolve a support request you raise.

4. Retention

• Linked institution data is kept until you unlink the institution, which deletes its accounts, holdings and transactions from our database.
• Email and calendar connections are kept until you remove them in the app.
• Notes and bills are kept until you delete them in the app.
• Chat history lives on your device; clear it from Settings at any time.
• Your account and everything attached to it is deleted when you delete it (see below).
• Server logs are kept for a short period for security and then discarded.

5. Your choices and rights

• Unlink an institution from Linked Accounts in the app. Its data is removed from Finn.
• Revoke Plaid's access to your institutions at any time through my.plaid.com.
• Remove an email or calendar connection from Settings → Email & Calendar, which is also where you can see when each mailbox last synced.
• Delete your account from Settings in the app. This removes your account and all data attached to it immediately. You can also email support@raliworks.com from the address you signed in with and we will do it within 30 days and confirm by email.
• Access, correct or export your data by contacting us at the same address.

Depending on where you live you may have additional rights, including under the California Consumer Privacy Act or the GDPR. We honor requests to access, correct, delete or export your data, and we do not sell personal information or share it for cross-context behavioral advertising.

6. Children

Finn is not directed at children under 18 and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

7. Changes

We will update this policy when our practices change and revise the effective date above. Material changes will be announced in the app.

8. Contact

Raliworks LLC · support@raliworks.com