Privacy Policy
Private, self-hosted Firefly III instance — single user, non-commercial.
Who operates this service
This is a personal, self-hosted installation of Firefly III, a free and open source personal finance manager. It is operated by a private individual for the sole purpose of managing their own personal finances. It has exactly one user: the operator. It is not offered to the public, to customers, or to any third party.
What data is processed
- Bank account details (account holder name, IBAN, currency, balance).
- Transaction data (date, amount, counterparty name and account, description, reference).
This data is retrieved from the operator's own bank accounts through Enable Banking, acting as an Account Information Service Provider under PSD2, and only after the operator has explicitly authenticated with each bank and granted consent.
Why
Personal budgeting and bookkeeping. Nothing else. The data is not used for profiling, advertising, scoring, training of any model, or any form of automated decision-making.
Where the data is stored
In a PostgreSQL database on Railway infrastructure located in europe-west4 (Amsterdam, Netherlands, European Union). The database is reachable only over a private network and is not exposed to the internet.
Who the data is shared with
Nobody. There is no analytics, no tracking, no advertising, no export to any third party, and no other user of the system. The only external party involved is Enable Banking, which acts as the PSD2 intermediary between the banks and this installation.
How access is controlled
The application is not reachable directly from the internet. It is published exclusively through a Cloudflare Tunnel and sits behind Cloudflare Access, which requires the operator to authenticate with a one-time PIN sent to their registered e-mail address before any request reaches the application.
Retention
Data is kept for as long as the operator chooses to keep it and is deleted when the operator deletes it. Bank access consent granted under PSD2 expires after 90 days and must be renewed explicitly.
Withdrawing consent
Consent to access bank data can be withdrawn at any time, either through the operator's own bank, through Enable Banking, or by deleting the application. Withdrawal stops all further data retrieval immediately.
Contact
For any data protection matter: theclounk11@gmail.com