Privacy Policy

1. Who We Are

FinExpense is an open-source AI-powered expense and invoice management platform developed by Nikolay Sarmadzhiev and Narayan S. The application is self-hosted: you run it on your own infrastructure. This Privacy Policy describes how data flows within the application.

Contact: nikolayds@gmail.com

2. Data We Collect

When you use FinExpense, the following data is stored in a local SQLite database on the server you control:

• Expense records (merchant, amount, date, category, tags)
• Receipt metadata (file name, extracted line items, tax info)
• Invoice records (vendor, amounts, status, due dates)
• Bank statement transactions you have imported and confirmed
• Conversation history (AI chat messages and tool call logs)
• User settings and tag rules

Receipt images and statement files you upload are stored temporarily in memory during processing and are not written to permanent storage after extraction is complete, unless you explicitly save them.

3. Data We Do Not Collect

• We do not collect analytics, telemetry, or usage statistics
• We do not store full credit or debit card numbers (they are stripped at parse time)
• We do not have access to any database you run — all data is on your infrastructure
• We do not sell, rent, or share your data with any third party for marketing purposes

4. Third-Party Services

AI Providers (Anthropic / OpenAI). When you send a message or upload a receipt, the text and image content is sent to your configured AI provider (Anthropic Claude or OpenAI GPT-4o) to generate a response. This transmission is governed by those providers’ privacy policies. Expense amounts, merchant names, and dates may be included in prompts. We recommend reviewing Anthropic’s Privacy Policy and OpenAI’s Privacy Policy.

Auth0. FinExpense uses Auth0 for user authentication. Auth0 stores your email address and account credentials. Auth0’s privacy practices are described at auth0.com/privacy.

Salesforce. If you connect a Salesforce org, FinExpense will read and write Salesforce records on your behalf using your access credentials. No Salesforce data is persisted in the FinExpense database.

5. Data Storage and Security

All application data is stored in a SQLite database file on the server you deploy FinExpense to. Security of that server is your responsibility. We recommend:

• Running FinExpense behind an HTTPS reverse proxy (nginx with Let’s Encrypt)
• Restricting database file access to the application process user
• Taking regular backups of the SQLite database
• Keeping API keys in environment variables, not committed to source control

6. Cookies and Local Storage

The FinExpense web client uses browser local storage to remember your session token, UI preferences (selected theme, LLM mode), and the current conversation ID. No third-party tracking cookies are used.

7. Your Rights

Because your data lives on your own server, you have full control over it at all times. You may:

• Export all data by copying the SQLite database file
• Delete any expense, invoice, or conversation record from within the application
• Delete your Auth0 account to remove your identity credentials
• Revoke Salesforce access tokens at any time from Salesforce’s connected apps page

8. Children’s Privacy

FinExpense is not directed at children under the age of 13 and we do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected in the “Last updated” date at the top of this page. Continued use of FinExpense after changes constitutes acceptance of the updated policy.

10. Contact

For privacy questions or requests, email us at nikolayds@gmail.com or open an issue on the GitHub repository.