FINSTRIDE Privacy Policy

Last updated: 6 November 2026

This policy explains what personal data FINSTRIDE collects, why, where it is kept, who else handles it, and the rights you have over it. It is written to the standard of the EU and UK General Data Protection Regulation (GDPR), and it covers the main rights given by the California Consumer Privacy Act (CCPA).

1. Who we are

FINSTRIDE is provided by Muhammad Babar, a sole proprietor trading as ApexPaths, based in Lahore, Pakistan (“ApexPaths”, “we”, “us”). We are the data controller for the personal data described here.

• Privacy requests: [email protected]
• Payments and refunds: [email protected]
• Everything else: [email protected]
• Website: https://apexpaths.co

2. What this policy covers

• The FINSTRIDE web app at https://finstride.apexpaths.co, including the version you install on a phone or computer from your browser.
• The FINSTRIDE Android app, when it is released.
• The FINSTRIDE pages on the ApexPaths website, such as https://apexpaths.co/finstride. Other visits to apexpaths.co are covered by the ApexPaths Website Privacy Notice at https://apexpaths.co/privacy.
• Emails we send you and support conversations with us.

Paddle, which sells FINSTRIDE subscriptions on our behalf, has its own privacy policy for the payment details it collects (see section 7).

3. The data we collect

3.1 Account details

• Your email address, or a User ID if you register without one.
• A display name, if you choose one.
• Your password, stored only as a scrambled hash (scrypt). We cannot see it.
• Whether your email is verified, your language, your settings and preferences.
• If you turn them on: the secret for your authenticator app (two-step verification), and the public keys for passkey (Windows Hello) and fingerprint log-in. The private keys never leave your device.
• Your plan, its start and end dates, and a record of plan changes.
• The date and time you agreed to these terms, and which version you agreed to.

3.2 Your financial records

Everything you enter or import: income, expenses, transfers, amounts, dates, categories, descriptions, accounts and card names, budgets, goals, recurring items, loans, assets, opening balances and separate “books”. Also earlier versions of entries you edit (your edit history). You can delete any earlier version, or all of them, from History at any time. This can include names of people you track spending for. Only add them if you have the right to.

You choose what to enter. FINSTRIDE never asks for bank log-ins, card numbers, PINs or one-time banking passwords, and you should not enter them.

3.3 Receipt scanning

If you use Scan Receipt, the photos you take (up to four per scan) and your list of expense categories are sent to Google’s Gemini service to read the receipt. See section 6.

3.4 Log-in and security records

For each log-in and security event (such as a password change or turning on two-step verification) we record the date and time, your IP address and your browser or device type. We also record each receipt scan this way, to apply daily limits. You can see your recent log-ins in Settings › Account.

3.5 Support messages

If you contact us through Help & Feedback or by email: your messages, any screenshot you attach, the page and device type you sent it from, and our replies.

3.6 Payment and subscription details

Paddle handles payments. We receive from Paddle only what we need to manage your plan and any refunds: your plan, billing period, subscription status, renewal and cancellation dates, Paddle’s customer and transaction references, payment dates, and the amounts paid and refunded. We never receive or store your card or bank details.

3.7 Website visits

On apexpaths.co, including the FINSTRIDE pages, we use Cloudflare Web Analytics, which counts visits without cookies and without identifying you.

4. Why we use your data, and our legal basis

We do not sell your data, share it for advertising, or profile you for marketing. To prevent abuse, we check signs such as several accounts logging in from one IP address. We do not send marketing emails unless you separately agree to them.

We get data from you, and payment status from Paddle. We make no decisions about you by automated means that have legal or similar effects. You must give an email or User ID and a password to have an account. Everything else is optional.

We do not look at your financial records. Our admin tools show account-level counts (for example, how many entries an account has), never amounts or descriptions. We access your records directly only when you ask us to in a support request, or when it is strictly necessary to keep the service secure.

5. Where your data is stored

Your account and financial records are stored in a PostgreSQL database run by Neon, and the app runs on servers run by Render. Both are located in Singapore. Data is encrypted in transit (HTTPS) and encrypted at rest by these providers.

6. Receipt scanning with Google Gemini

• Photos are sent to Google only when you press Scan Receipt.
• FINSTRIDE uses Google’s paid Gemini API, under which Google does not use the content to train its models.
• FINSTRIDE does not keep your photos. What Gemini reads is held for up to one day so you can review and save it, then deleted.
• Google may keep what we send for a short time to detect abuse, under its terms for the paid Gemini API.
• Receipts can show personal details, such as your name or the last digits of a card. Crop or avoid photos that show more than you want to share.
• Gemini can misread receipts. Always check the amounts before saving.

7. Who else handles your data

These service providers handle data for us under data processing agreements:

Paddle is the merchant of record. When you buy a plan, you buy it from Paddle, which collects your payment details, name, email address and billing country under its own privacy policy (https://www.paddle.com/legal/privacy). Paddle handles your payment details as an independent controller under its own policy.

Have I Been Pwned: to check a new password, we send only the first 5 characters of its hash, which cannot identify you.

We may also disclose data if the law requires it, to protect the rights and safety of users or the service, or as part of a transfer of FINSTRIDE to a new owner, who would be bound by this policy.

8. International transfers

We run FINSTRIDE from Pakistan, and we access your data from there to support you and run the service. Your data is stored in Singapore. Google and Cloudflare may process it in the United States and other countries. Where the law requires a safeguard, we use the European Commission’s Standard Contractual Clauses (with the UK Addendum) in our provider agreements.

9. How long we keep data

10. Your rights

Wherever you live, you can:

• Access and export: Settings › Data › Download My Data gives you your entries, settings and plans as spreadsheets. For a copy of everything else we hold (account details, edit history, log-ins, support messages, plan and payment records), email [email protected].
• Correct it: edit any entry or detail in the app, or ask us.
• Delete it: Settings › Account › Delete My Account, or ask us.
• Object to or restrict processing based on our legitimate interests.
• Withdraw consent where we rely on it, without affecting what we did before.

If you are in the EU or UK, you also have the right to data portability and to complain to your local data protection authority.

California residents: in the last 12 months we collected the categories in section 3 (identifiers, financial records you enter, internet activity, and support messages), from you and from Paddle, for the purposes in section 4. We do not sell or share personal information, and we use sensitive information (log-in details, financial records) only to provide the service. You can ask to know, correct or delete your data, including through an authorized agent. We will not treat you differently for doing so.

To use any right, email [email protected] from the address on your account. We reply within 30 days, and may ask you to confirm your identity first. If we refuse a request, reply to ask us to look again.

11. Cookies and storage on your device

FINSTRIDE uses only what it needs to work:

The installed app keeps copies of key pages, which show your figures, and entries you record offline. Logging out yourself deletes them. If you are logged out for being idle, waiting entries stay on the device until they upload or you delete them. They only ever upload to the account that recorded them.

We use no advertising or tracking cookies, so we do not show a cookie banner. Paddle’s checkout may set its own cookies, under Paddle’s privacy policy. We don’t track you across sites, so there is nothing to opt out of.

12. Security

Passwords are stored as hashes (scrypt), and one-time codes are stored only as hashes. FINSTRIDE offers two-step verification and passkeys: Windows Hello on computers, and your fingerprint, face or screen lock on phones. It uses HTTPS everywhere, limits repeated attempts, and logs you out when idle. No system is perfectly secure. If a breach is likely to put you at risk, we will tell you without undue delay, and tell the authorities as the law requires.

13. Children

FINSTRIDE is for people aged 18 and over. We do not knowingly collect data from anyone younger. When you create an account, you confirm you are 18 or older, agree to the Terms and the Refund Policy, and confirm you have read the Privacy Policy. If you believe a child has an account, email [email protected] and we will delete it.

14. Changes to this policy

We will post any change here with a new effective date. If a change is significant, we will email you or show a notice in the app before it applies.

15. Contact and complaints

Email [email protected]. If you are in the EU or UK and are not satisfied with our reply, you can complain to your local data protection authority.