Privacy Policy

Last updated: October 9, 2026

Fyney is a personal finance management application. This Privacy Policy describes how Fyney collects, uses, stores, discloses, and protects information when you access or use the application, website, and related services.

Fyney is not a bank, brokerage, payment institution, or Open Finance provider. Fyney does not connect to your bank accounts, request online banking passwords, or collect full payment card numbers. Financial data in Fyney is provided by you or by members of a group in which you participate.

Who We Are

Fyney is operated by Davi Santos da Silva, an individual based in Brazil who uses Studio MWD as a public-facing name. Studio MWD is not a separate legal entity. Davi Santos da Silva is the data controller responsible for the processing of personal information described in this policy. Questions, requests, or notices regarding this Privacy Policy may be submitted to fyney@studiomwd.com.

Information You Provide

We collect information that you choose to enter or upload through Fyney, including:

Authentication and Sign-In

Fyney uses Firebase Authentication and Google Sign-In. When you sign in, we process identifiers and account information necessary to authenticate your account, such as your Firebase user ID, email address, display name, profile photo URL, authentication tokens, and sign-in provider information. If you sign in with email and password, Firebase Authentication processes those credentials. Fyney does not receive your Google account password.

Subscriptions and Payments

Fyney uses Google Play Billing for subscriptions and paid plan features. Google processes payment methods and billing details. Fyney does not store your full payment card number. Fyney receives and stores limited subscription information necessary to activate and administer paid features, such as product identifiers, purchase tokens, subscription status, expiration information, acknowledgement status, and obfuscated account or profile identifiers. We also use the Google Play Developer API and Google Play real-time developer notifications to validate and update subscription status.

Service Operation and Security Data

To authenticate users, synchronize records, deliver notifications, and protect Fyney against abuse, we and our service providers process technical information such as app version, device and operating system information, IP address, network information, service logs, Firebase installation identifiers, App Check or Play Integrity signals, and notification delivery information. These activities continue when you decline optional usage analytics or crash report uploads.

Visiting our website also involves requests to our hosting provider, which may process IP addresses and request information to deliver pages and protect the service. The Android app preferences described below control the corresponding services in the app.

Your Optional Privacy Choices

Usage analytics and sending crash reports are separate, optional choices for users worldwide. Both start unselected when there is no saved choice. Signing in, creating an account, accepting terms, or reading this policy does not by itself grant either permission. You can use Fyney without accepting either option. Users who are already signed in and have not made a choice are also offered these controls.

Menu names are translated according to the app language. Analytics and crash report choices, together with the time of the choice, are saved locally for this installation, not synchronized across devices or separately for each account. Signing out does not itself revoke these choices. You can change them in the app; clearing app data removes the saved choices and a fresh installation starts with these options off.

Optional Crash Reports

Sending reports to Firebase Crashlytics is optional and disabled by default worldwide. With your permission, technical crash reports, device and app information, and installation identifiers help us diagnose and fix problems. You can use Fyney without accepting and change your device-local choice in More > Crash reports, independently of usage analytics and advertising.

Crashlytics may store reports locally even when uploads are disabled. Uploads are considered when the app starts: reports are eligible only when the previous session began with permission, that permission was not withdrawn during the session, and permission is still present. Accepting during a session does not make earlier reports eligible. Ineligible pending reports are discarded through the app's startup and preference-change handling; local capture can continue between those actions. Revoking consent prevents new uploads; it cannot recall reports already sent or an upload already in progress.

Optional Usage Analytics

Google Analytics for Firebase is disabled until you opt in. If you accept, it collects app interactions (such as registration, feature use, and subscription events), device and app information, and app instance identifiers to help us understand usage and improve Fyney. This includes automatic usage events and the feature events recorded by the app. This choice does not authorize advertising uses of Analytics data. We disable advertising ID collection by Analytics. If both analytics and crash reporting are accepted, Analytics events may also appear as a sequence of actions leading up to a crash in a Crashlytics report.

You can sign in and use Fyney without accepting. Your choice is saved on this device and can be changed in More > Usage analytics. Disabling stops future Analytics collection; it does not delete information already sent. Contact us to request deletion of personal data. This preference does not control the authentication, security, diagnostics, notifications, or advertising services described separately in this policy.

Advertising

Fyney uses Google Mobile Ads, including interstitial ads. Google and its advertising partners may process device identifiers, ad identifiers, application activity, ad interaction data, and other information subject to their own privacy policies in order to deliver, measure, and improve advertisements. Paid plans may include features that reduce or remove ads. Fyney uses Google's User Messaging Platform to request advertising privacy choices when required by its configured consent flow and to determine whether ad requests are permitted. You can reopen the form in More > Ad privacy options when it is available. Additional controls may be available in Android and Google settings. Accepting analytics or crash reporting does not grant advertising permission; refusing them does not by itself disable ads.

Notifications

Fyney uses Firebase Cloud Messaging and local Android notifications to send application, group, transaction, invoice, goal, and system notifications. Fyney may subscribe your device to a group notification topic and may process notification payloads that include IDs, names, amounts, dates, owner IDs, actor IDs, and other information necessary to display the notification. You may manage notification permissions and settings in Android and within Fyney where available.

Files, Camera, and Storage

Fyney may request camera and storage or file access so you can attach profile photos or transaction proof files. Fyney may compress images before upload. Proof files are uploaded to Firebase Storage and linked to transactions. Proof files may include receipts, invoices, tax invoices, fiscal documents, or similar records, and may contain sensitive financial or personal information, such as names, tax identifiers, CPF or CNPJ numbers, addresses, bank account details, Pix keys, transaction IDs, amounts, dates, merchant names, purchased items, and recipient information. You should upload proof files only if you are willing for those files to be stored in Fyney and made available to users who have access to the related transaction or group. Depending on the transaction, group settings, and permissions, proof files and their references may be visible to other users who can access the related shared financial record. Fyney may cache downloaded proof files locally to display them efficiently.

Local Storage on Your Device

Fyney stores some information locally on your device using local databases, preferences, cached files, and background workers. This may include synchronized finance data, group settings, notification settings, cached proof files, sync timestamps, and other information necessary for application features. Local data may be deleted when you sign out, delete local data, leave a group, or delete your account, depending on the action taken and the applicable technical limitations of the device.

How We Use Information

We use information for the following purposes:

Shared Groups and Visibility

Fyney supports shared groups. Information in a group may be visible to other group members, depending on group settings, ownership, and permissions. This can include member names, profile photos, balances, banks, cards, transactions, goals, investments, statistics, proof files, proof counters, and other shared finance records. Group creators and members with elevated permissions may be able to view or manage more information than regular members. You should not add information to a shared group unless you are willing for permitted members to access it.

Third-Party Services

Fyney relies on third-party service providers to operate the service. These providers may process information in accordance with their own terms and privacy policies. Services used by Fyney include:

More information is available in Firebase's privacy and security information, Google's Privacy Policy, and Google's explanation of data use in partner apps and sites. These documents supplement the choices and purposes described here.

Data Sharing

We do not exchange personal information for monetary payment. Advertising disclosures described above may be treated as sharing or targeted advertising under some privacy laws. We may disclose or otherwise make information available in the following circumstances, subject to the applicable choices described in this policy:

Legal Bases

Where a legal basis is required, account management, synchronization, shared finance features, and subscription administration are processed as necessary to provide the service you request and perform our agreement with you. Legal compliance may require retaining or disclosing certain records. Security and abuse prevention may rely on legitimate interests, subject to applicable law and your rights.

We rely on your consent for optional usage analytics and crash report uploads. Advertising choices are handled separately as described above. Withdrawing consent does not affect the lawfulness of processing based on consent before withdrawal. We do not treat an optional analytics or crash reporting refusal as permission to continue the same uploads under another legal basis.

Data Retention

We retain information for as long as reasonably necessary to provide Fyney, maintain your account and group data, comply with legal obligations, resolve disputes, enforce agreements, prevent abuse, and keep reliable business records. If you request account deletion, Fyney disables access to the account and schedules the permanent deletion of the Firebase Authentication account, profile record, profile files, and remaining proof files to occur 30 days after the request. Financial records previously shared with a group may remain available to that group for record integrity, but they will no longer be linked to an active Fyney account. Other cleanup processes may follow the retention period applicable to the affected feature. When a group is deleted, access is terminated immediately. Permanent deletion of the group record, its financial records, and group proof files is scheduled to begin 30 days after the deletion request. The deletion process is performed in successive batches and may require additional processing time after that date, depending on the volume of data, service availability, retries, and other technical limitations. Some information may be retained longer where required by law, for security, for fraud prevention, for subscription records, or in backups and logs until they expire.

If a group has no new transaction for 90 consecutive days, Fyney may treat the group as inactive and schedule deletion of the group and its related data. This may include the group record, memberships, permissions, group-related user settings, financial records, proof files, and other data associated with that group. A new transaction may reset the inactivity period before deletion is scheduled. Deletion may be performed in successive batches and may require additional processing time depending on data volume, service availability, retries, backups, logs, legal obligations, security needs, fraud prevention, subscription records, and other technical limitations.

The account and group deletion schedules above do not mean that all previously uploaded telemetry is deleted on the same schedule. Google states that Crashlytics keeps crash traces and associated identifiers for 90 days before beginning removal from live and backup systems; see Firebase's retention information. Our Google Analytics property is configured to retain event-level and user-level data for 2 months. Reset on new user activity is enabled: new activity renews the retention period for the user's identifier and associated user-level data. It does not renew the retention period for every historical event. Expired data is removed through Google's monthly deletion process. These settings do not apply to standard aggregated reports, so they do not mean that all Analytics information is deleted after 2 months. See Google Analytics retention information. Contact us for details or to request deletion. Disabling an optional service stops new collection or uploads as described above, rather than automatically deleting information already sent to that service.

Your Choices and Rights

Depending on your location, you may have rights to access, correct, delete, export, restrict, or object to certain processing of your personal information, and to withdraw consent where processing is based on consent. You may update certain profile and group information within Fyney. You may request account deletion through Fyney where available or by contacting us at fyney@studiomwd.com.

Where applicable, you may also request confirmation of processing, information about recipients, or anonymization or deletion of data processed unnecessarily or unlawfully. You may have a right to opt out of sharing or targeted advertising. Use the advertising controls above or contact us to exercise applicable rights. We may request information reasonably necessary to verify your identity and locate the relevant data. Please do not send passwords or complete financial documents with an initial privacy request.

You may complain to the data protection authority in your jurisdiction, including the ANPD in Brazil or your local supervisory authority in the European Economic Area or United Kingdom. Contacting us first is not a condition for exercising that right. We handle requests within the periods required by applicable law.

Permissions

Fyney may request Android permissions for internet access, network state, notifications, camera, storage or file access, boot completed events, and scheduled alarms. These permissions are used only to support application features such as synchronization, proof uploads, reminders, notifications, and background scheduling.

International Processing

Our Cloud Storage bucket for uploaded files is located in us-central1 (Iowa, United States). Our Cloud Firestore database uses nam5, a multi-region location in the United States. The nam5 location spans multiple US regions; it is not a single us-central1 deployment. These services store the account, group, financial records, and uploaded files described above, according to their respective functions.

These are the configured locations for these resources, not a guarantee that all Fyney-related processing occurs only there. Other services, including Authentication, Analytics, Crashlytics, and advertising, have their own processing arrangements.

Fyney and its service providers may process and store information in countries other than your country of residence. Data protection laws in those countries may differ from the laws applicable in your place of residence. Google describes its processing and international transfer arrangements in its Firebase privacy documentation. You can contact us to request information about the destinations and safeguards applicable to processing your data. An optional analytics or crash reporting choice does not itself authorize unrelated transfers.

Security

We use reasonable technical and organizational measures to protect information, including authentication, Firebase security rules, App Check, access controls, and provider-managed infrastructure security. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Children's Privacy

Fyney is not intended for children under 13 or the minimum age required by applicable law. We do not knowingly collect personal information from children below that age. If you believe that a child has provided personal information to us, please contact us so that we can take appropriate action.

Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be posted on this page with a revised "Last updated" date. If changes are material, we may provide additional notice through Fyney or another appropriate channel, where required or appropriate.

Contact

If you have questions, requests, or complaints about this Privacy Policy or Fyney's privacy practices, please use the contact below.

App: Fyney
Public-facing name: Studio MWD
Responsible developer: Davi Santos da Silva
Email: fyney@studiomwd.com