Privacy Policy
EFFECTIVE: AUGUST 2026 · LAST UPDATED: AUGUST 2026Finights is a personal finance application operated by Nikklab Inc., an Ontario, Canada corporation ("we", "us"). This policy describes what we collect when you use Finights, why, how long we keep it, and the choices you have. It is written to be read, not skimmed past.
Contact: admin@nikklab.com
We collect your financial account data through Plaid, with your explicit consent, to show you your money in one place and forecast your cash flow.
We never see or store your bank username or password. You sign in to your bank directly through Plaid.
We keep your transaction history for as long as you keep your account — including beyond the window your bank or Plaid provides — because your long-term history is the product. You can export or delete it at any time.
We do not sell your data, and we do not show ads. Finights is paid for by subscriptions, not by you being the product.
What we collect
Account information. When you sign in with Apple or Google, we receive your email address, your name if you choose to share it, and an identifier from the provider. We never receive or store a password. If you use Apple's Hide My Email, we receive the relay address Apple generates.
Financial data, via Plaid. When you connect a financial account, you authenticate directly with your institution through Plaid Link. Your banking credentials go to your institution and to Plaid — never to us. With your consent, Plaid then provides us: account details (institution, account type, masked account number, balances), transactions (date, amount, merchant, category), and — depending on your subscription and account types — recurring payment patterns, liabilities (card balances, APRs, due dates), and investment holdings. Plaid's own handling of your data is described in Plaid's End User Privacy Policy.
Data you create. Budgets, goals, manually added assets (such as cash, property, vehicles, or precious metals), categorisation rules, notes, and household sharing choices.
Operational data. Standard technical logs (with sensitive values redacted), your time zone (so "this week" means your week), device push tokens if you enable notifications, and subscription status from Apple, Google, or Stripe depending on where you subscribed. We do not use advertising trackers or analytics that profile you across other apps or sites.
How we use it
To provide the service: displaying your accounts and transactions, detecting recurring payments, forecasting your cash flow, tracking budgets and goals, computing net worth, and sending the notifications you've enabled. To operate the business: processing subscriptions, providing support, keeping the service secure, and meeting legal obligations.
We do not sell personal information, and we do not share it with third parties for their marketing.
How long we keep it
Transaction history: for the life of your account, by design. Financial institutions and Plaid provide a limited window of history. Finights retains what it has synced so your record grows over time rather than rolling away — this is deliberate, and it is the reason the app can show you multi-year trends. If you delete your account, it is deleted.
Connections to your institutions remain active while your subscription is active. If your subscription lapses, we sever the connection at Plaid after notice to you; your already-synced history remains visible in the app. Technical logs and processing records are purged after 90 days. Billing records are kept as long as tax law requires.
Household sharing
If you invite someone to your household, you choose exactly what they can see, and sharing is one-directional — inviting someone shares nothing until you choose scopes. They can view what you share; they can never edit it. You can revoke sharing at any time, effective immediately. If a member is removed and later rejoins, sharing starts from nothing rather than resuming.
Who processes your data
We use a small number of service providers to operate Finights: Amazon Web Services (Canada region — hosting and storage), Plaid (financial data connectivity), Apple and Google (sign-in, and subscription billing on their platforms), RevenueCat (subscription management), Stripe (web subscriptions), and an email delivery provider for account and service email. Each receives only what its function requires.
How we protect it
All data is encrypted in transit (TLS 1.2+) and at rest. The tokens that authorise access to your financial data receive an additional layer of application-level encryption (AES-256-GCM), with keys held outside the database. Access to your data inside the app is governed by strict per-user isolation, enforced in code and verified by automated tests. Our systems never handle your banking credentials at any point.
No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities as required by law.
Your choices and rights
Access and export. You can view everything Finights holds about you in the app, and export your data in a portable format.
Disconnect. You can disconnect any financial account at any time, which severs our access at Plaid.
Delete. You can delete your account in the app. We sever every bank connection first, then permanently delete your data. Deletion is not reversible. Records we must keep for tax purposes (billing) are retained for the statutory period only.
Notifications. Every notification category can be turned off in settings.
Residents of Canada have rights under PIPEDA, and residents of certain U.S. states have rights under state privacy laws, including access, correction, deletion, and portability. Exercise any of these in the app or by emailing admin@nikklab.com. We respond to verified requests within the time the applicable law requires, and we do not discriminate against you for exercising your rights.
Age
Finights is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.
Changes
If we materially change what we collect or how long we keep it, we will update this policy and notify you in the app before the change takes effect. The retention of your financial history will never change without notice to you.
Contact
Nikklab Inc. · Mississauga, Ontario, Canada
admin@nikklab.com