Privacy Policy
EFFECTIVE: AUGUST 2026 · LAST UPDATED: OCTOBER 2026Finights is a personal finance application operated by Nikklab Inc., an Ontario, Canada corporation ("we", "us"). This policy describes what we collect when you use Finights, why, how long we keep it, and the choices you have. It is written to be read, not skimmed past.
Contact: support@finights.com
We collect your financial account data through Plaid (and, for brokerage accounts, SnapTrade) or, if you choose, by your signing in to your bank inside the app, with your explicit consent, to show you your money in one place and forecast your cash flow.
We never see or store your bank username or password. You sign in to your bank directly through our data provider.
We keep your transaction history for as long as you keep your account — including beyond the window your bank or Plaid provides — because your long-term history is the product. You can export or delete it at any time.
We do not sell your data, and we do not show ads. Finights is paid for by subscriptions, not by you being the product.
What we collect
Account information. When you sign in with Apple or Google, we receive your email address, your name if you choose to share it, and an identifier from the provider. We never receive or store a password. If you use Apple's Hide My Email, we receive the relay address Apple generates. If you sign in with a code sent by email, we receive the address you type; the code itself is stored only in a scrambled (hashed) form, works once, and expires after ten minutes. If you sign in with Apple, we also keep a token Apple issues for your account, encrypted, for one purpose only: to revoke Sign in with Apple for Finights when you delete your account, as Apple requires.
Financial data, via Plaid. When you connect a financial account, you authenticate directly with your institution through Plaid Link. Your banking credentials go to your institution and to Plaid — never to us. With your consent, Plaid then provides us: account details (institution, account type, masked account number, balances), transactions (date, amount, merchant, category), and, for credit cards and loans, liabilities (balances, APRs, minimum payments and due dates). We find recurring payments ourselves, from your transactions. Plaid's own handling of your data is described in Plaid's End User Privacy Policy.
Brokerage data, via SnapTrade. If you connect an investment or brokerage account, you sign in with your brokerage through SnapTrade, and your brokerage credentials never reach us. With your consent, SnapTrade provides us read-only account details (brokerage, account type such as RRSP or TFSA, masked account number, balances), holdings, and account activity such as contributions, withdrawals, dividends and trades. We can't place trades or move money.
Statements you upload. For a card we can't connect to, such as Rogers Bank or Triangle, you can upload a PDF statement. We read the account's last four digits, statement dates, balances, payment due and the transactions from it. The PDF itself is processed in memory and is not stored.
Accounts read through your own sign-in. For Rogers Bank and for Sun Life workplace plans, you can instead sign in to their own website inside the app. Your username and password go only to Rogers Bank or Sun Life — never to us. We keep what the page shows you: for a card, its balance, statement and transactions; for a plan, its accounts, balances and contributions.
Signing in to your bank when Plaid stops working. If Plaid's connection to one of your banks stops working, Finights may offer you another way to keep that bank up to date: signing in to your bank's own website inside the app. This is optional, and it is only offered when Plaid's connection to that bank is stuck. If you choose it, you sign in on your bank's own website, and your username, password and verification codes go directly to your bank — Finights never sees them and never stores them. While you are signed in, the app reads your accounts, balances, transactions and payment details from your bank's website (the same kind of information Plaid provides) and sends them to us to update your accounts. We then end our Plaid connection to that bank, so from then on it is updated only when you sign in to it again from the app; nothing is read in the background.
Your bank's sign-in session. For any bank you sign in to inside the app, the bank's sign-in session is kept only on your device, so you are not asked for a verification code every time. It is never sent to us, and it is deleted when you remove the bank or sign out of Finights. If you let your iPhone remember your bank password, it is saved in your own iCloud Keychain by Apple, not by Finights. You can remove any bank at any time in Settings › Connections, which deletes its data from Finights and its sign-in session from your device.
Automatic categorisation. Charges read from statements or from a bank's own website (such as Rogers Bank, Triangle, or a bank you sign in to when Plaid stops working) don't arrive with categories. To file them, we send each charge's merchant name, description, the card's own category label, the amount and whether money went in or out to OpenRouter, which passes it to an OpenAI language model and returns a category. We don't send your name, account numbers, balances or anything else about you.
Data you create. Budgets, goals, manually added assets (such as cash, property, vehicles, or precious metals), categorisation rules, notes, and your retirement planning answers — such as your birth year, province, when you plan to stop working and what you expect to spend.
About a spouse or partner. To plan retirement as a household you can tell us about a spouse or common-law partner: their birth year, when they came to Canada and started working, their expected pensions, their savings and contributions, and their contribution room. That is information about another person, so please only enter it with their knowledge. It is used only for your own projection, is never shared with them or anyone else, and is deleted when you remove them or delete your account.
Operational data. Standard technical logs (with sensitive values redacted), your time zone (so "this week" means your week), device push tokens if you enable notifications, a random identifier the app creates for each installation and your device's model (so we can tell you when your account is used on a device it hasn't been used on before, and label your sessions), the IP address and app version each session signs in from, subscription status from Apple (through RevenueCat), and error reports that help us fix problems. We do not use advertising trackers or analytics that profile you across other apps or sites.
Emails we send. Sign-in codes, a welcome when you create an account, a notice when your account is used on a new device, and notices about your subscription (a trial starting, a payment that failed, a plan cancelled or ended). We don't send marketing email. We keep a record of which of these we sent, so none is sent twice.
On your device. So the app works without a connection, a copy of what you last viewed is stored on your phone, protected by iOS data protection and removed when you sign out. The home screen widget keeps only your latest runway figures.
How we use it
To provide the service: displaying your accounts and transactions, detecting recurring payments, forecasting your cash flow, tracking budgets and goals, computing net worth, and sending the notifications you've enabled. To operate the business: processing subscriptions, providing support, keeping the service secure, and meeting legal obligations.
We do not sell personal information, and we do not share it with third parties for their marketing.
How long we keep it
Transaction history: for the life of your account, by design. Financial institutions and Plaid provide a limited window of history. Finights retains what it has synced so your record grows over time rather than rolling away — this is deliberate, and it is the reason the app can show you multi-year trends. If you delete your account, it is deleted.
Connections to your institutions remain active while your subscription is active. If your subscription lapses, we sever your connections at our data providers about 30 days later; your already-synced history remains in your account. Technical logs and processing records are purged after 90 days. Billing records are kept as long as tax law requires.
Who processes your data
We use a small number of service providers to operate Finights: Amazon Web Services (Canada region — hosting and storage, and Amazon Simple Email Service for the emails above), Plaid and SnapTrade (financial data connectivity), Apple and Google (sign-in), Apple (subscription billing and push notifications), RevenueCat (subscription management), OpenRouter and OpenAI (categorising card charges, as described above), and Sentry (error monitoring). Each receives only what its function requires. We also fetch market prices and exchange rates from public sources; no personal information is sent to them.
Some of these providers are based in, or process data in, the United States and other countries. When your information is processed outside Canada, it may be accessible to the courts, law enforcement and national security authorities of those countries.
Where our figures come from
Finights projects retirement using published figures rather than guesses, and the sources are worth naming. Tax brackets, credits and registered-plan limits come from the Canada Revenue Agency and each province’s or territory’s own published tables. Old Age Security, the Guaranteed Income Supplement and the Canada Pension Plan come from Employment and Social Development Canada and Service Canada; the Quebec Pension Plan and Quebec’s own measures come from Retraite Québec and the Ministère des Finances du Québec.
Exchange rates come from the European Central Bank via Frankfurter, and metal prices from a public spot-price feed. None of the organisations named here endorses Finights or has reviewed what we do with their figures.
Every projection in the app is an estimate built on assumptions we state in the app itself, and not financial, tax or investment advice.
How we protect it
All data is encrypted in transit (TLS 1.2+) and at rest. The tokens that authorise access to your financial data receive an additional layer of application-level encryption (AES-256-GCM), with keys held outside the database. Access to your data inside the app is governed by strict per-user isolation, enforced in code and verified by automated tests. Our systems never handle your banking credentials at any point.
No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities as required by law.
Your choices and rights
Access and export. You can view everything Finights holds about you in the app, and download a copy of your data (JSON and a CSV of transactions). We prepare it in the background and notify you in the app when it's ready; the download is available for 24 hours, after which the file is deleted from our systems. We never send it by email.
Disconnect. You can disconnect any financial account at any time, which severs our access at the data provider.
Delete. You can delete your account in the app. It happens immediately: we sever every bank and brokerage connection, then permanently delete your accounts, transactions, forecasts, budgets and goals. There is no waiting period and it cannot be undone, so download your data first if you want to keep a copy. Records we must keep for tax purposes (billing) are retained for the statutory period only. If you signed in with Apple, we also revoke Sign in with Apple for Finights at the same time.
Notifications. Every notification category can be turned off in settings.
Residents of Canada have rights under PIPEDA, and residents of certain U.S. states have rights under state privacy laws, including access, correction, deletion, and portability. Exercise any of these in the app or by emailing support@finights.com. We respond to verified requests within the time the applicable law requires, and we do not discriminate against you for exercising your rights.
Age
Finights is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.
Changes
If we materially change what we collect or how long we keep it, we will update this policy and notify you before the change takes effect. The retention of your financial history will never change without notice to you.
Contact
Nikklab Inc. · Mississauga, Ontario, Canada
support@finights.com