MyFinFree Privacy Policy
Last updated: 31 October 2026
This policy explains what MyFinFree does with information about you: what it collects, why, who else handles it, how long it is kept and what you can ask of us.
It covers the website at myfinfree.com, the MyFinFree web app and the emails the service sends. It does not cover your broker, the sign-in providers you may choose (Google, Apple) or an AI assistant you connect yourself — each of them has its own privacy policy. MyFinFree and its emails link to pages run by others, such as filing pages on the SEC's website; what those sites collect when you open them is up to them, and this policy stops at the link.
Short version:
- We use your data to run MyFinFree for you, to improve it, to keep it secure and to meet or defend our legal position.
- Beyond the cookies the service needs to work, the site uses analytics and advertising tools only if you agree to them in the cookie banner, one category at a time. Rejecting is as easy as accepting, and you can change your mind at any time with the "Cookie settings" link at the bottom of every page. If you agree to marketing, Google and Meta learn which of their ad visitors signed up and paid, and may add you to an ad audience so that they can show you our ads elsewhere; they are independent controllers of that data and may use it for their own purposes (section 7). We never record your screen, and none of these tools is sent your portfolio (section 6).
- Before you choose, the site counts page visits on our own server, without cookies, without your IP address and without any identifier (section 2.12).
- Your portfolio lives on a server in Germany. The service providers that help us run MyFinFree are all named in section 7.
- You can delete your account yourself, at any time, in Settings. That removes your data from the live service at once, apart from short-lived working copies and the few records listed in section 8. The last copies (backups, logs, emails in our mailbox) expire on the schedule in section 8, which also lists the few things kept longer and why.
1. Who is responsible for your data
MyFinFree is run by MyFinFree ("we", "us"), a Dutch sole proprietorship (eenmanszaak) registered with the Netherlands Chamber of Commerce (KVK) under number 42197491. A sole proprietorship is not a separate legal person: the same private individual who has run MyFinFree from the start runs it now. Under the EU General Data Protection Regulation (GDPR), we are the controller of your personal data — the one who decides how and why it is processed — and the party you deal with for everything in this policy.
- Email: [email protected]
- Address: Johan van der Keukenstraat 26, 1087 BN Amsterdam, Netherlands
MyFinFree is small and does not process sensitive categories of data on a large scale, so no data protection officer has been appointed. Privacy questions go to the email address above and are handled by the operator.
If MyFinFree is later moved into a company with its own legal personality (for example a private limited company), or taken over by another person or company, the new operator becomes the controller. Your data goes with it only so that the service can carry on under this policy; we will email you at least 30 days beforehand (see section 13), and you can delete your account first. While a takeover is only being discussed, a candidate sees totals and anonymised figures, never data about you.
2. What we collect
2.1 Your account
- Your email address, whether it has been verified, and your name if you give it.
- The identifier our sign-in provider assigns to your account.
- How you sign in: with a password, or with your Google or Apple account. When you sign up, sign in from a new browser or reset a password, a one-time code is sent to your email to confirm it is you.
- Your password is typed into our sign-in page but sent straight from your browser to our sign-in provider (section 7). Our servers never receive or store it.
- Your settings, such as the base currency your figures are shown in.
2.2 What you put into your portfolio
- Accounts you keep by hand, the positions in them and the transactions you record — purchases, sales, dividends, deposits, withdrawals and fees — including any notes and labels you add.
- The target allocation you set, the drift watches you switch on and the results of their checks.
- Your plans in the goal planner: the income and expense streams you enter, the growth assumptions you choose and the goals you save towards.
2.3 Brokerage accounts you connect
If you connect a brokerage account, the connection runs through SnapTrade, a specialised data provider (section 7). You sign in to your broker on SnapTrade's or your broker's own screen — your broker username and password never reach MyFinFree. What we receive is:
- the name of the institution and, for each account the connection gives us access to, what your broker reports about it: name, number, type, status, whether it is a paper-trading account, opening and funding dates, total balance and buying power;
- its holdings (with average purchase price and unrealised profit or loss), cash balances and transaction history, including the descriptions your broker attaches to transactions;
- the status of the connection itself, and any label you give the account in MyFinFree.
To keep the connection working, SnapTrade issues a secret that lets MyFinFree ask for fresh data. We store that secret, and your account numbers, encrypted (section 10). MyFinFree only reads: it has no function to place orders, move money or change anything at your broker. You can stop updates for a connected account at any time — MyFinFree then stops fetching data and keeps what it already has — or remove it, which deletes what the brokerage sent and ends the connection at SnapTrade.
2.4 Screenshots and files you import
If you choose to import positions from a screenshot of your broker's app, we receive the image and have it read by an AI model (section 5).
If you choose to import a file your broker lets you download, such as an account statement, we receive the whole file. Such a file usually shows your name and address, your account numbers and every transaction and balance it covers. We read it on our own server; only when we do not know its layout yet, and only if you consented, is part of it sent to an AI model to learn the layout (section 5). Security numbers the file names may be checked with a public lookup service, without anything that ties them to you (section 5). You tell us which broker the file comes from — from our list, or by typing the name — and which of your MyFinFree accounts each brokerage account in the file goes into. We remember that choice, with the account number as the file prints it, for your next import.
In both cases the rows read are kept as a draft for you to review; only the rows you confirm are added to your portfolio. We also keep a record that you agreed to sending screenshots and file samples to an AI model, which version of the consent text you agreed to, and when.
2.5 AI assistants you connect
Where this feature is available, you can connect an AI assistant of your own (for example Claude or ChatGPT) so it can read your portfolio when you ask it to. You approve the connection on a MyFinFree page, through our sign-in provider, which then holds the assistant's authorisation. For each connection we keep which assistant it is, its status, when it was first and last used and which version of our consent terms applied, plus a log line for every request the assistant makes: which area of your data it read and whether the request succeeded. The log does not contain the question you asked the assistant or the answer it received. A connection that has not been used for 90 days expires.
2.6 Messages and bug reports
- When you report a problem from inside the app, we receive what you write, the full address of the page you were on, your browser's identification string (browser, version and operating system), a reference to the error if there was one, and up to three pictures. A picture can be one the app draws of the MyFinFree page you were on — it shows everything on that page, including portfolio figures — or an image you choose. The operator is emailed that a new report has arrived, with its reference number only — not what you wrote, your email address or your account identifier.
- When you email us, we receive your message and whatever it contains.
2.7 Emails we send you
Which emails were sent to you and the delivery information our email provider reports — for example that a message bounced or was marked as spam, so that we stop writing to an address that does not want our mail — and which kinds of alert you have turned off.
2.8 Technical and security data
Each request to MyFinFree leaves a short record: the time, your account identifier if you are signed in, what was asked for and whether it succeeded or was refused. These records do not contain your IP address. Your IP address is seen by our network provider, which passes traffic to our server; by our sign-in provider, which records the device, browser and IP address of each sign-in to detect and block misuse of your account; and, when you use them, by SnapTrade's connection screen and by Google or Apple.
2.9 What we do not collect
We do not ask for payment details (MyFinFree is currently free and charges nothing), identity documents, or data about you from data brokers. We run no advertising pixels or analytics tools unless you agree to them in the cookie banner (section 6), and we do not fingerprint your device to recognise or follow you. The checks on your device are those our sign-in provider makes to secure your sign-in (sections 2.1 and 2.8), the bot-protection checks described in section 6 and, only if you agree to analytics, the analytics tool described in section 6, which keeps an identifier in your browser. Our emails contain no tracking pixels and their links are not rerouted to count clicks; about an email we learn only whether it was delivered, bounced or reported as spam (section 2.7). The share prices, fund compositions, exchange rates and company filings shown in MyFinFree come from market-data vendors and public sources such as the U.S. SEC; they describe securities and companies, not you, and nothing that identifies you is sent to those sources (section 5 describes the security numbers from a file you import that we may check with one of them).
MyFinFree never asks about your health, beliefs, political views or other sensitive matters. Please leave such details out of notes, labels, plans and bug reports; if some end up there anyway, they are handled only as part of your own data and removed on request.
2.10 What you have to give us
An email address is needed to create an account and sign in. Everything else is up to you: without it, the parts of MyFinFree that depend on it simply stay empty.
2.11 Data about other people
Some things you add may be about someone else: a partner's salary in a plan, a joint account, a name visible in a screenshot or printed in a broker's statement. Add them only if you are entitled to share them with us. We use them only to run MyFinFree for you, under this policy.
2.12 Your cookie choices, visit counts and the source of your sign-up
- Your choice in the cookie banner. Each time you accept, reject or change a category, we add a record: a random identifier our banner makes in your browser, the time, the version of the banner and what you chose for each category. It holds no IP address and no name. When you sign in or create an account, we tie the choice standing at that moment to your account, so that what our server sends on its own (see section 6) follows your latest choice on any device. Records are only ever added, never rewritten.
- A count of page visits, before and whatever you choose. For every page request that reaches
our web server we add one to a daily total kept by page type (not the exact address), the
referring website's name and the
utm_campaign values in the address if there are any, and a coarse device class (phone, tablet or computer). We do not store a cookie, an IP address, a browser identification string or any identifier, and we leave out known bots. The totals describe no one in particular, so they cannot be traced back to you or removed for you. - Where your sign-up came from, only if you agreed. If you agreed to analytics, we keep the page
you first landed on, the time, the campaign values in the address and the referring website for up
to 60 days, and write them once to your account when you create it. If you agreed to marketing,
we also keep the ad click identifiers in the address (for example
gclidorfbclid). If you did not agree when you created your account, your account's source reads "unknown" and nothing is written. - Analytics events, only if you agreed. Which pages you open, which buttons and links you click and how far you scroll, plus whether a sign-up and a payment happened. Page addresses are cut down to the page type, and all text on the page, amounts and what you type are masked before anything leaves your browser. No portfolio content is sent.
- Ads signals, only if you agreed to marketing. A "signed up" signal and a "paid" signal (the amount in euros, the plan and billing period, and a random reference of its own) go to Google and to Meta (section 7).
2.13 Questions you ask the Assistant
Where this feature is available, on the Plus and Pro plans, you can ask MyFinFree's Assistant questions about your own portfolio and plans. It is locked until you give explicit consent in the app (section 5). For each question we keep what you typed (or that you chose "Explain this screen"), which screen you were on and what that screen showed, the answer, which areas of your data were read to write it (the names of the reads, not the data), the result of our checks on the answer, whether you marked it good or bad, and the times. They are kept as conversations, which you can read and delete. We also record that you agreed, which version of the consent text you agreed to, and when.
For each call to the AI model we record, apart from any account, how many tokens it used and what it cost. These records hold no question, no answer and nothing that identifies you.
A small sample is read by the operator. To check that the Assistant stays within its rules, we keep a small sample of answers where the operator can read them: refusals, answers our checks held back, answers you marked as bad, answers with a figure our checks could not find in your data, and about one in a hundred others. An entry holds the question, the answer, which areas of your data were read and what the checks found, under a reference that cannot be traced to you without our database — it carries no name and no email address. The operator reads it only on the server, never inside the app, and it is removed after 30 days, or at once when you delete the conversation or your account. Answers are written by an AI model and are not investment advice.
3. Why we use your data, and on what legal basis
The GDPR allows personal data to be used only when there is a legal basis for it. This table links every use we make of your data to its basis. "Our agreement" means the Terms and Conditions.
| What we do | Data involved | Legal basis (GDPR Art. 6(1)) |
|---|---|---|
| Create your account, sign you in, keep your settings | Account data, sign-in records | Performance of our agreement (b) |
| Show your portfolio, analytics, drift checks, plans and projections | Portfolio data, brokerage data | Performance of our agreement (b) |
| Keep your connected brokerage accounts up to date | Brokerage data, connection secret | Performance of our agreement, at your request (b) |
| Send a screenshot you upload to an AI model to read it | The image | Your consent (a) |
| Send the structure and a few sample rows of a broker file whose layout we do not know yet to an AI model to learn the layout (section 5) | The file's structure and sample rows | Your consent (a) |
| Read a broker file you upload on our own server, and keep the rows read from a screenshot or a file as a draft until you confirm them or the draft expires | The file, draft rows | Performance of our agreement (b) |
| Remember which of your accounts each brokerage account in a file goes into, and keep a layout learned from your file, for your next import | The account number as the file prints it, the account it goes into, the learned layout | Performance of our agreement (b) |
| Show a broker name you typed in your own broker list | The name, linked to your account | Performance of our agreement (b) |
| Look at a broker name you typed, and — if it names a broker — add it to the broker list every user sees, or keep it as another spelling of a broker already on the list | The name as you typed it, without who typed it | Our legitimate interest in an accurate broker list free of abuse (f) |
| Check the security numbers a broker file you import names with a public lookup service, and record a confirmed number in the catalogue of securities every user shares (section 5) | The security numbers, without who imported them | Our legitimate interest in an accurate catalogue of securities (f) |
| Answer requests from an AI assistant you connected | The portfolio data the assistant asks for | Your consent (a) |
| Answer the questions you ask MyFinFree's Assistant: send your question, the screen you are on and the parts of your portfolio and plans it reads for that question to an AI model, check the answer, and keep your conversations (sections 2.13 and 5) | Your question, the screen, the portfolio and plan data read, the answer, your rating | Your consent (a) |
| Keep a small sample of the Assistant's answers for the operator to read for 30 days, to check that it stays within its rules (section 2.13) | The question and the answer, the areas read, the result of the checks, under a reference without your name or email | Our legitimate interest in an Assistant that stays within its rules (f) |
| Show you and us what a connected assistant read | The assistant request log | Our legitimate interest in transparency and security (f) |
| Send the welcome email | Email address | Performance of our agreement (b) |
| Send alerts: drift alerts for the watches you set up, and alerts about new filings of companies you hold (sent by default) | Email address, alert contents | Performance of our agreement (b). Every alert email has a link, valid for 7 days, that turns that kind of alert off (the drift link also stops drift digests); after that, write to us |
| Investigate and fix problems you report | Bug reports, pictures, technical data | Our legitimate interest in a working product (f) |
| Build, maintain and repair MyFinFree, including with an AI coding assistant that can read data on our server (section 7) | Whatever data a task needs, which can include yours | Our legitimate interest in a working product (f) |
| Reply to messages you send us | Your message, email address | Our legitimate interest in answering you (f) |
| Keep the service secure: detect abuse, limit request rates, investigate incidents | Technical and security data | Our legitimate interest in protecting you and the service (f) |
| Look into a suspected breach of the Terms — scraping, misuse of an assistant connection, unlawful content — and act on it, up to closing the account | Technical data, account data, the content concerned | Our legitimate interest in enforcing the Terms (f) |
| Tell you about your account and the service: security warnings, changes to this policy or the Terms, a takeover or the end of MyFinFree, replies to your requests. These messages cannot be switched off while you have an account and never contain advertising | Email address | Performance of our agreement (b); legal obligation where the law requires the message (c) |
| Work out totals from our own records — how many accounts exist, how often a feature is used or fails — to decide what to fix or build. The totals name nobody and are produced on our own server | Account, usage and technical data | Our legitimate interest in improving MyFinFree (f) |
| Count page visits on our own server, before and whatever you choose in the cookie banner: how many people came, from which source and to which pages (section 2.12) | Day, page type, referring website, campaign values, device class — no IP address, no cookie, no identifier | Our legitimate interest in knowing whether anyone comes to the site and where from (f). It stores nothing on your device |
| Show the cookie banner, remember your choice and keep a record of each choice | Your choice, a random browser identifier, the banner version, the time | Legal obligation to demonstrate consent (c), GDPR Art. 7(1); the cookie mff_consent is strictly necessary for this |
| Understand how people use MyFinFree — pages, clicks, scrolling and how far a visitor gets towards a sign-up or a payment — through PostHog (section 6) | Pseudonymous identifier, page type, clicks, whether a sign-up and a payment happened, plan, billing period and amount | Your consent (a), GDPR Art. 6(1)(a), and Art. 11.7a of the Dutch Telecommunications Act for what is stored on or read from your device. Analytics category in the cookie banner |
| Keep where your sign-up came from, for the account you create | Landing page, first-seen time, campaign values, referring website (analytics); ad click identifiers (marketing) | Your consent (a). Analytics and marketing categories in the cookie banner |
| Tell Google Ads and Meta which of their ad visitors signed up and paid, and run their tags | Ad click identifiers, the identifiers their tags keep in your browser, the amount, plan and billing period of a payment | Your consent (a), GDPR Art. 6(1)(a), and Art. 11.7a of the Dutch Telecommunications Act. Marketing category in the cookie banner |
| Remember addresses that bounced or reported our mail as spam, so that we stop emailing them; important notices then appear in the app instead (Terms section 20.2) | Email address | Our legitimate interest in not sending unwanted mail (f) |
| Keep backups so that a failure does not lose your data | All data held on the server | Our legitimate interest in not losing your data (f) |
| Keep proof of the consents you gave or withdrew | Consent records | Legal obligation to demonstrate consent (c), GDPR Art. 7(1) |
| Answer your requests under this policy and meet other legal duties | Whatever the request or duty concerns | Legal obligation (c) |
| Pass your data to a new operator if MyFinFree is taken over (section 1) | All data MyFinFree holds | Our legitimate interest in the service continuing (f) |
| Disclose data to the police or another authority when someone's safety is at risk (section 7) | The data the situation needs | Vital interests (d) or our legitimate interest (f) |
| Establish or defend a legal claim, if one ever arises — including, after an account is deleted, the limited record described in section 8 | The data relevant to the claim | Our legitimate interest (f) |
Where we rely on legitimate interest, we have weighed it against your interests: the data involved is limited to what the task needs, it is kept only as long as section 8 allows and it is used only for the purposes in this table. You can object to it (section 9).
We do not send marketing emails. If we ever want to, we will ask for your permission first and make it as easy to withdraw as it was to give. The same holds for the cookie banner: you can withdraw a category at any time, and withdrawing is as easy as agreeing.
4. No automated decisions about you
MyFinFree calculates things about your portfolio — its allocation, how far it has drifted from your targets, risk measures, projections of your plans. These are descriptions of your own data, shown to you. MyFinFree does not use them to make decisions that have legal or similarly significant effects on you (GDPR Art. 22), does not score you, and does not use your portfolio to build a profile of you for marketing. If you agree to analytics or marketing in the cookie banner, the tools in section 6 see how you use the site and, for marketing, Google and Meta may combine the signals we send with what they already know about you under their own terms (section 7); you can switch both off at any time.
5. Screenshots, files and AI
Reading holdings out of a picture is done by an AI model, and so is learning the layout of a broker file we do not know yet. Because this sends data to another company, both stay locked until you give explicit consent in the app. A file whose layout we already know — an Interactive Brokers statement, or a layout learned earlier from one of your own files — is read on our own server, and nothing from it is sent to an AI model.
- What is sent: for a screenshot, only the image you upload, together with fixed instructions to read the holdings in it. For a file whose layout we do not know yet, once per upload: the file's structure — its section and column names — and at most five sample rows per section, together with fixed instructions to describe the layout. Before sending, we replace digits with 9, show dates written in figures only by their format (a month written as a word stays), and hide email addresses, long numbers, codes that mix letters and digits (such as an account or security number), and your name, address and account number wherever the file labels them in a way we recognise (for example "Account holder" or "Rekeninghouder"). Words stay — operation names, currency codes, instrument names — and so does a name or address we did not recognise, for example under a heading we do not know or inside a free-text description. So some personal content of your statement may still be sent. We do not add your name, email address or account details.
- Who processes it: Anthropic, the maker of the Claude models. Our contract is with Anthropic Ireland, Limited; what we send is processed on Anthropic's systems in the United States (see section 7.1 for the safeguards). Under Anthropic's commercial terms, content sent through its API is not used to train its models. Anthropic deletes it within 30 days, unless a request is flagged for breaching Anthropic's usage policy, in which case it may keep it for up to 2 years.
- What we keep: the image never enters our database or our backups. While it is being read it is held only in our server's memory, never on its disk (for iPhone HEIC pictures, also a temporary conversion file), and is deleted automatically within 15 minutes. An uploaded file is held the same way, only in memory, and is deleted as soon as it has been read, in any case within 15 minutes. The rows read from a screenshot or a file are kept as a draft for your review; only the rows you confirm become part of your portfolio. A draft is deleted once every account in it is confirmed or left out, or 24 hours after your last action on it.
- What a file import leaves: the transactions you confirmed, each with a one-way code made from the transaction's details, so that the same transaction in a later upload is recognised, and a note naming the statement type and its period; a record of the statement type and the period it covered; which of your accounts each brokerage account goes into, with the account number as the file printed it; if the broker's own totals differed from what was recorded, the size of the difference; if a layout was learned, that layout, which is checked to hold no amounts, dates or account numbers from your file, nor your name where we detected it; and a record of each layout learning — when it happened, which layout it was for and whether it worked — which we use to count how many learnings you have used each month; and, in the catalogue every user shares, a security number checked as described below, with no link to you.
- Check your picture first: a screenshot can show more than holdings — an account number, a balance, your name. Crop the image to the holdings table before uploading if you would rather not send the rest.
- Changing your mind: you can withdraw your consent at any time in Settings. Screenshot import and learning new file layouts then lock again; files whose layout we already know can still be imported. Withdrawing does not undo imports you already confirmed and does not affect the lawfulness of anything that happened before. Drafts you have not confirmed are deleted 24 hours after your last action on them.
Security numbers. From any broker file you import, one more thing can leave our server: security numbers. When a file names a security that our catalogue holds without its international securities identification number (ISIN), our server may ask OpenFIGI, a public lookup service run by Bloomberg, whether the number the file prints belongs to that security; if it does, our catalogue, which is the same for every user, records it. Only the numbers are sent — the numbers from one import, which can hold several files, may go together in one request — never your name, email address, account, the file or anything else that ties them to you, and our own records of the check do not name you either. This does not depend on the consent above. When a file names a security our catalogue does not hold on the exchange the file names, our server may also ask OpenFIGI which listing of that security trades on the exchange the file names: it sends that security number and exchange, and nothing else. If OpenFIGI names a listing, our server then asks our price-data provider, Marketstack, for the prices of it: only the listing's ticker with the exchange suffix and a range of dates are sent, never who imported the file. The new listing is added to the catalogue every user shares.
The Assistant. MyFinFree's Assistant (section 2.13) is locked until you give explicit consent in the app, and that consent is separate from the one above. To answer a question it sends Anthropic your question, the screen you are on and what it shows, and the parts of your portfolio and plans it reads for that question; a second, smaller request sends the draft answer to a model that checks it before you see it. We add fixed instructions, and we do not add your name or email address. It is processed by Anthropic Ireland, Limited on Anthropic's systems in the United States (section 7.1), under the commercial terms described above: not used to train its models, deleted within 30 days, or up to 2 years if a request is flagged for breaching Anthropic's usage policy. We keep your conversations for 90 days after your last message, and you can delete any of them earlier. The sample the operator reads is described in section 2.13. You can withdraw your consent at any time in Settings; the Assistant then locks again, your conversations stay until you delete them, and withdrawing does not affect anything that happened before.
6. Cookies and similar technologies
Your choice. When you open MyFinFree for the first time, and again about every six months or when the banner's wording or categories change, a banner asks you to choose. "Accept all" and "Reject all" sit side by side with the same weight, and nothing is ticked beforehand. There are three categories:
- Necessary — always on. They keep you signed in, protect our forms and remember your choice.
- Analytics — off until you agree. Lets us see how the site is used, and keeps where your sign-up came from.
- Marketing — off until you agree. Lets Google and Meta recognise visitors who came from their ads and tells them about sign-ups and payments. It also lets Google and Meta build ad audiences of our visitors (remarketing) and show them our ads elsewhere, based on their visit to our marketing pages. The Google settings for ad personalisation are switched on with this category.
Until you choose, no analytics or advertising tool is loaded and nothing outside the Necessary category is stored on your device. The only thing that runs is the count of page visits on our own server (section 2.12), which stores nothing on your device and no identifier. You can reopen the banner from the "Cookie settings" link at the bottom of every page and change any category; turning a category off takes effect at once, removes the cookies listed below for that category and stops the tools from loading. If you later switch analytics off on one device, that also stops what our server itself sends to the analytics tool for your account, on all your devices. Agreeing on one device never switches anything on in another: you are asked again there.
MyFinFree's public pages (the home page, the legal pages and the error pages) set only the cookies listed below for the categories you agreed to. The home page and the error pages also read whether our sign-in provider's cookie from an earlier visit is present — and the home page also whether you chose to stay signed in — so that a signed-in visitor is offered "Go to my dashboard" instead of "Sign in".
| Cookie | Set by, on | Purpose | Lifetime | Category |
|---|---|---|---|---|
mff_consent | MyFinFree, on myfinfree.com | Remembers your choice per category, the banner version and the random identifier of your browser, so that the banner is not shown again and your choice can be proved | Six months, then you are asked again | Necessary |
__session | Clerk, on myfinfree.com | Proves to our server that the request comes from you, signed in | About a minute; renewed while MyFinFree is open | Necessary |
__client_uat (also with a suffix, such as __client_uat_785xU6I7) | Clerk, on myfinfree.com | Records when you last signed in (0 when signed out), so the app can tell whether you are signed in | Up to 400 days, the longest a browser allows | Necessary |
__client | Clerk, on clerk.myfinfree.com | Keeps you signed in | Up to 400 days, renewed while you use MyFinFree — but see "Keep me signed in" below | Necessary |
__cf_bm | Cloudflare, on clerk.myfinfree.com (and possibly on myfinfree.com, whose traffic Cloudflare also carries) | Tells people from bots | 30 minutes | Necessary |
_cfuvid | Cloudflare, on clerk.myfinfree.com | Limits the rate of requests and blocks abuse | Until you close the browser | Necessary |
myfinfree_session_alive | MyFinFree, on myfinfree.com | Tells the app that you signed in during this browser session without ticking "Keep me signed in" | Until you close the browser | Necessary |
mff_src | MyFinFree, on myfinfree.com | Keeps where you came from (landing page, time, campaign values, referring website) for up to 60 days; it is written also if you already have an account, and is cleared when the source is attached to a new account or the server finds that it cannot be attached | Up to 60 days; the first visit is kept, never replaced | Analytics |
ph_phc_…_posthog (the middle part is our project key) | PostHog, through our own domain myfinfree.com | Recognises your browser between visits so that PostHog can count visits and follow a visitor's way to sign-up and payment; after sign-in, our account identifier takes its place. PostHog may also keep the same value in the browser's local storage | Up to one year | Analytics |
__ph_opt_in_out_… (browser storage, the end is our project key) | PostHog, through our own domain myfinfree.com | Remembers on your device whether PostHog may capture; we remove it when you do not agree to analytics | Until removed | Analytics |
ph_phc_…_posthog_window_id (browser session storage) | PostHog, through our own domain myfinfree.com | Tells the tabs of one visit apart so that PostHog can group the events of one visit | Until you close the tab | Analytics |
ph_phc_…_posthog_primary_window_exists (browser session storage) | PostHog, through our own domain myfinfree.com | Marks that a tab of this visit is already open, so that a second tab gets its own window identifier | Until you close the tab | Analytics |
ph_mff_signup_sent (browser storage) | MyFinFree, on myfinfree.com | Remembers that the sign-up of your account was already reported to analytics, so that it is not reported twice | Until removed (it holds a one-way fingerprint of your account identifier, not the identifier itself) | Analytics |
mff_ads | MyFinFree, on myfinfree.com | Keeps the ad click identifiers from the address (for example gclid, gbraid, wbraid, fbclid) for up to 60 days; cleared when the source is attached to a new account or the server finds that it cannot be attached | Up to 60 days | Marketing |
_gcl_au | Google, on myfinfree.com | Lets Google Ads recognise a visitor who came from an ad and measure the sign-up and payment that followed | Up to 90 days | Marketing |
_gcl_aw | Google, on myfinfree.com | Stores the Google Ads click identifier from the address, when you arrive on a marketing page by an ad | Up to 90 days | Marketing |
_gcl_gb, _gcl_dc (Google may also add _gac_…) | Google, on myfinfree.com | Further Google Ads click and campaign identifiers, set only when the address carries the matching identifier | Up to 90 days | Marketing |
_fbp | Meta, on myfinfree.com | Lets Meta recognise your browser across visits, to match ad clicks to sign-ups and payments | Up to 90 days | Marketing |
_fbc | Meta, on myfinfree.com | Stores the Meta click identifier, only if you arrived by a Meta ad | Up to 90 days | Marketing |
The Google and Meta tools also talk to their own servers while you are on the site. Meta's pixel
may set or read cookies on Meta's own domain (for example fr, about 90 days); that is governed by
Meta's own policy (section 7).
Keep me signed in. The sign-in cookies stay in your browser when you close it. Unless you tick "Keep me signed in" when you sign in or create your account, MyFinFree ends your session the next time you open it after closing the browser, and you sign in again. If you tick it, you stay signed in until you sign out (the Sign out button next to your name at the bottom of the menu) or the session expires. Do not tick it on a shared device.
MyFinFree itself also keeps a few small entries in your browser's own storage. They never leave your browser on their own:
| Entry | Kind | Purpose | Lifetime |
|---|---|---|---|
myfinfree:keep-signed-in | Local storage | Remembers that you ticked "Keep me signed in" | Until you sign out |
myfinfree.terms-acceptance-marker | Session storage | Carries your acceptance of the Terms from the sign-up screen to the moment it is recorded | Until it is recorded, usually seconds |
myfinfree:notices:session-dismissed:… | Session storage | Remembers that you hid the "we can't deliver email" notice | Until you close the browser |
Our sign-in provider's script may keep short technical entries of its own in your browser's storage to make signing in work.
What the analytics tool sees. If you agree to analytics, PostHog receives which page types you open, which buttons and links you click, how far you scroll and whether a sign-up and a payment happened. We switch off session replay: your screen is never recorded. All text on the page and all element details are masked before anything leaves your browser, and web addresses are cut down to the page type, so amounts, holdings, names and what you type are not sent. Our server also sends PostHog one event when you pay for a plan (the plan, billing period and amount), but only while your latest choice says analytics is on. The traffic goes through our own domain, and each event also carries your country, as a two-letter code that our network provider Cloudflare works out from your connection; PostHog never receives your IP address and does not work out a place from it.
If you reject analytics. PostHog then runs without storing anything on your device. It may count the visit under a short-lived anonymous key that it works out from the browser details we forward (never your IP address) and changes every day; that key does not identify you, the event is marked as coming from a person who said no, and such events are left out of every view of individual visitors and of the funnel. These events too carry your country as the same two-letter code from Cloudflare.
What the ad platforms receive. If you agree to marketing, Google's tag and Meta's pixel load on
the marketing pages only (the home page, /plans, /privacy and /terms), so that they see the ad
click identifier in the address, and set the cookies above. Inside the signed-in app they load only to report a
sign-up or a payment. On those four marketing pages Meta's pixel sends one page view and Google's tag
sends one page view, which is how the audiences described below are built; neither sends a page view
inside the app, and Google's tag sends no automatic page views. Meta's automatic tracking of clicks, forms and in-app navigation is switched off. Your browser then contacts them, so they receive your IP address and browser
details, and they see which pages you open. With your agreement, Google's tag and Meta's pixel on
these pages let Google and Meta build ad audiences of our visitors and show them our ads elsewhere, on other sites and apps
(remarketing); for that, each acts as an independent controller. We tell each of them, once, when you sign up, and once
for each payment: that it happened, the amount in euros, the plan, the billing period and a
random reference of its own (not your account identifier and not the checkout's), together with the identifiers above, and
the address they are told it happened on carries no search, company or checkout detail (it is the
bare dashboard or after-payment page, or just "/app"). We do not send your email address,
your name or anything from your portfolio. If you do not agree to marketing, neither tool is
loaded and no signal is sent. PostHog does not receive your IP address; Google and Meta do, because your
browser contacts them directly.
The cookies and entries in the Necessary category are needed to provide the service you asked for and to keep it secure, so the banner does not ask for them. You can block or clear all cookies in your browser; the public pages keep working, but signing in will not. Cookies in the Analytics and Marketing categories are set only after you agree.
7. Who else handles your data
If you agree to marketing, Google and Meta receive the data described in section 6 as independent controllers and use it for their own purposes, such as measuring advertising and showing ads. Apart from that case, we share data only with the providers below. They process it on our behalf and receive only what their task requires. They may not use it for their own purposes, apart from the limited uses their terms allow, such as abuse checks (see section 5).
| Provider | What it does for MyFinFree | Data it handles | Location and safeguard (section 7.1) |
|---|---|---|---|
| Hetzner Online GmbH | Hosts the server; stores our backups | Everything MyFinFree stores | Germany (EU) |
| Cloudflare, Inc. | Carries all traffic between your browser and our server, filters malicious traffic, runs the bot check on the sign-up form | IP address and the content of requests and pages passing through it | Global network, U.S. company — SCCs / DPF |
| Clerk, Inc. | Sign-in, sessions, account security; authorisations of AI assistants you connect | Email address, name, password (in protected form), sign-in method, device and IP address of each sign-in, assistant authorisations | United States — SCCs / DPF |
| SnapTrade | Connects your brokerage accounts | A pseudonymous identifier from us (not your name or email); your broker authorisation and account data from your broker | Canada and the United States — adequacy decision (Canada); SCCs / DPF (United States) |
| Anthropic Ireland, Limited | Reads screenshots you import, learns the layout of a broker file we do not know yet, and answers your questions in the Assistant and checks the answers — only if you consented | The uploaded image; a file's structure and up to five sample rows per section, with the personal details we can detect hidden; your Assistant questions, the screen you are on and the parts of your portfolio and plans read for the question (section 5) | Processed in the United States — SCCs |
| Resend, Inc. | Sends our emails (from its EU sending region in Ireland) | Email address, email contents (alerts include account names and figures), delivery events | United States — SCCs / DPF |
| Google (Google Workspace) | Hosts our mailbox | Emails you send us; our own notices to ourselves, such as a broker name a user typed (without who typed it) | EU and United States — SCCs / DPF |
| PostHog, Inc. (PostHog Cloud, EU region) | Shows us how the site is used, for people who agreed to analytics (section 6) | A pseudonymous identifier (our account identifier after you sign in), page types, clicks, scrolling, whether a sign-up and a payment happened, plan, billing period and amount, your browser and device type as part of each event; your country as a two-letter code, taken from our network provider Cloudflare; your IP address is not passed on to PostHog, because the traffic goes through our own server, which forwards only the event, its content type and your browser identification | Stored in the EU (Frankfurt, Germany); PostHog is a U.S. company — SCCs / DPF |
SnapTrade's own end-user terms also apply between you and SnapTrade when you connect a brokerage account.
An AI coding assistant used by the operator (not one of the providers in the table above). The operator builds and maintains MyFinFree with the help of Claude, an AI assistant made by Anthropic. When a problem is investigated on our server, the data the assistant reads — which can include data about you — is sent to Anthropic in the United States. This use runs under Anthropic's terms for individual subscribers, not under a data processing agreement with us, so the safeguards in section 7.1 do not cover it. Model training on these conversations is switched off in our Anthropic account, and Anthropic deletes them within 30 days, unless a conversation is flagged for breaching Anthropic's usage policy, in which case it may keep it for up to 2 years. The assistant is used only to build, repair and protect MyFinFree, and only the data a task needs is read.
A public security lookup service (not one of the providers in the table above: it does not work on our behalf, and nothing it receives identifies you). OpenFIGI, a lookup service run by Bloomberg in the United States, receives from our server the security numbers described in section 5 — without your name, email address, account or anything else that ties them to you — and answers which security each number belongs to. Marketstack, our provider of share prices for European exchanges, receives from our server a ticker with an exchange suffix and a range of dates, when a listing is added from a file you imported (section 5) and afterwards for the prices of listings people hold; nothing it receives identifies you.
Some parties receive data because you decide so. They are not our providers, and their own terms and privacy policies apply:
- Google Ireland Limited and Google LLC (Google Ads) and Meta Platforms Ireland Limited and Meta Platforms, Inc., if you agree to marketing. When their tags run, they receive your IP address, browser details, the pages you open, their click identifiers, and the sign-up and payment signals described in section 6. They are independent controllers: they decide for themselves what to do with it, under their own terms, privacy policies and retention periods — they are not our processors, and we cannot delete what they hold. They may process it in the United States, under the EU–U.S. Data Privacy Framework (section 7.1) and their own safeguards. Their privacy policies tell you how to see and control the ads and data they hold about you.
- Your broker, when you connect an account through SnapTrade.
- Google or Apple, if you choose to sign in with them. They learn that you use MyFinFree, and we receive the name and email address they share.
- An AI assistant you connect. It receives the portfolio data it asks for, on your instruction. Its provider may be outside the European Economic Area; what it does with the data is governed by your own agreement with it.
We may also disclose data, limited to what the matter needs:
- when the law requires it, for example to comply with a binding order from a court or authority;
- to a lawyer, accountant or insurer advising us in confidence;
- to a court, authority or opposing party in a legal claim;
- to the police or another competent authority when reporting serious misuse of MyFinFree, or when someone's safety is at risk.
If MyFinFree is taken over, your data passes to the new operator as described in section 1.
7.1 Transfers outside the European Economic Area
Where a provider in the table above, or Google or Meta, processes data in the United States, the transfer is protected by the European Commission's Standard Contractual Clauses (SCCs) and, where the provider is certified under it, the EU–U.S. Data Privacy Framework (DPF). For data SnapTrade processes in Canada, the European Commission has recognised that Canadian privacy law provides an adequate level of protection. You can ask us for a copy of the safeguards that apply to a given provider. Even with these safeguards, data kept in another country is subject to its laws, and its authorities may in some cases be able to obtain it.
8. How long we keep it
| Data | How long |
|---|---|
| Account, portfolio, brokerage, planner, alert and email-delivery data | Until your account is deleted — by you, or by us under section 15 of the Terms (see the rows below for the little kept after deletion) |
| Import drafts from screenshots and files (rows you have not confirmed) | Until every account in the import is confirmed or left out, or 24 hours after your last action on it |
| Uploaded screenshot images and broker files | Deleted from our working storage within 15 minutes; a file as soon as it has been read. At Anthropic, see section 5 |
| What a file import leaves: the account numbers as the file printed them and which account each goes into, layouts learned from your files and the record of each layout learning, the code and note on each imported transaction, the size of a difference from the broker's totals | Until your account is deleted; a remembered account choice also goes when you delete the MyFinFree account it points to |
| A broker name you typed | Your link to it is deleted with your account, and the name too, unless someone else typed it, we added it to the broker list or we kept it as another spelling of a listed broker. Such a name stays, as typed and without any link to you, after your account is deleted |
| A security number checked from a file you imported (section 5), and the lookup service's answer | Kept without any link to you, in the catalogue of securities every user shares and in our archive of source data, also after your account is deleted |
| Consent records | Until your account is deleted; after that, only within the legal-claims record below |
| An AI assistant's access to your data | Until you revoke it, or until 90 days pass without use |
| The record of each AI-assistant connection, its request log, and the assistant's authorisation at our sign-in provider | Until your account is deleted |
| Your Assistant conversations: your questions, the answers, the screen you were on, your ratings | 90 days after the last message in the conversation, or earlier when you delete it or your account. At Anthropic, see section 5 |
| The sample of Assistant answers kept for the operator (section 2.13) | 30 days, then the entry is cleared; removed at once when the conversation or your account is deleted |
| The Assistant's records of tokens used and cost (no question, answer or account identifier) | 13 months |
| Bug reports and their pictures | 30 days, then deleted automatically |
| Technical and security records (section 2.8), and records of background tasks that carry your account identifier | 30 days, then deleted automatically, including after your account is deleted |
| Cached calculation results | Up to 26 hours |
| Internal event records that carry your account identifier | Until your account is deleted |
| Cookie-choice records tied to your account, and the source of your sign-up, with any ad click identifiers | Until your account is deleted |
| Cookie-choice records never tied to an account | 5 years from the entry, then deleted automatically |
| Daily page-visit totals (section 2.12) | Kept as totals. They hold nothing about a person, so they are not deleted when an account is deleted |
| Analytics events at PostHog | One year at PostHog; your account's record there is deleted when you delete your account (below) |
| Data held by Google and Meta (section 7) | Governed by their own retention periods, not by us |
| The cookies in section 6 | As listed in the table in section 6 |
| Addresses that bounced or reported our mail as spam | Kept after account deletion, only to avoid writing to them again; removed 3 years after the last bounce or spam report, or earlier on request |
| After an account is deleted: its email address; the versions of the Terms it accepted; each consent to sending screenshots, file samples or Assistant questions to an AI model, and each withdrawal, with the date and the version of the consent text; and the list of alert emails sent to it | 5 years, only to establish or defend legal claims |
| Encrypted database backups (stored off the server) | About 15 days |
| Database copies taken just before a new version is installed | About a week, on the server |
| Full-disk backups kept by our hosting provider | The last 7 daily copies |
| Emails you send us | Until the matter is closed, and no longer than 12 months after that |
| Data read by the operator's AI coding assistant (section 7) | At Anthropic: deleted within 30 days, or up to 2 years if a conversation is flagged for breaching Anthropic's usage policy |
Our providers keep their own operational logs (for example sign-in records at Clerk and traffic logs at Cloudflare) for the periods set in their own policies.
We may close a free account after 12 months without a sign-in, as the Terms describe (section 15.4), and email you at least 60 days beforehand.
Two exceptions apply to every period in this section. If the law obliges us to keep something, or a specific complaint, dispute, abuse case or order from an authority concerns your data, we set aside only the data involved, keep it out of the live service, and delete it once the matter is settled.
When you delete your account (Settings → Delete account), your data is removed from MyFinFree's live service straight away — including your bug reports and their pictures — except the legal-claims record and the do-not-mail entry in the table above, which are kept apart from the live service, and data set aside under the exceptions above. Records of background tasks (deleted within 30 days) and cached calculation results (expired within 26 hours) outlast it briefly. We then ask SnapTrade, Clerk and PostHog to delete what they hold about you. Until all three confirm, we keep the identifier needed to make that request; if a request fails because their service is unavailable we retry automatically, and any other failure is resolved by hand. We aim to have all confirmations within 7 days. Your cookie-choice records and the source of your sign-up go with the account. What Google and Meta already received is theirs to keep or delete under their own terms. Copies in logs, backups and the operator's mailbox disappear on the schedule above. What remains after that is a record that a deletion took place — its time and how many items of each kind were removed — which does not identify you; a broker name you typed, without any link to you, if we added it to the broker list, kept it as another spelling of a listed broker, or someone else typed it too; a security number checked from a file you imported, and the lookup service's answer, without any link to you; for 5 years, the limited record for legal claims listed in the table above; and, if your address ever bounced or reported our mail as spam, that address on our do-not-mail list.
9. Your rights
Under the GDPR you can ask us to:
- show you the personal data we hold about you and give you a copy (access);
- correct data that is wrong — most of it you can edit directly in the app (rectification);
- delete your data — the quickest way is Settings → Delete account (erasure);
- pause the use of your data in the cases the GDPR provides, for example while we check a correction you asked for (restriction);
- hand your data over in a structured, machine-readable format, so you can take it elsewhere (portability). MyFinFree has no export button yet; ask us by email and we will make the file available to you securely, for example as a download after you sign in.
- withdraw consent you gave — for sending screenshots and file samples to an AI model and for AI assistant connections this is a button in Settings; for analytics and marketing it is the "Cookie settings" link at the bottom of every page, which takes the same few steps as agreeing did. Withdrawing does not affect what happened before. To ask Google or Meta what they hold, or to delete it, use their own tools (section 7).
Your right to object. Where we rely on our legitimate interest (section 3), you can object at any time to that use of your data, for reasons relating to your situation. We will then stop, unless we have compelling legitimate grounds that override your interests, or need the data for a legal claim.
You can make any request by writing to [email protected]. Writing from the email address of your account lets us confirm quickly that the request comes from you; otherwise we may ask you to confirm it from inside the app. We answer within one month; if a request is unusually complex we may take up to two more months, and we will tell you why within the first month.
Requests are normally free. For a request that is clearly unfounded or excessive — for example the same request repeated over and over — we may charge a fee that covers our costs, or decline it; for extra copies we may charge such a fee. If we refuse all or part of a request, for instance to protect someone else's data, we tell you why and point you to section 12 and to your right to go to court.
10. How we protect your data
- Every connection between your browser and MyFinFree is encrypted (HTTPS).
- No web traffic reaches the server directly: it arrives only through an encrypted tunnel that the server itself opens to our network provider. The only other way in is administrative access over SSH, which accepts cryptographic keys only.
- Administrative access is held by the operator — who sometimes works through an AI coding assistant (section 7) — and by the automated pipeline that installs new versions of MyFinFree.
- The secrets that keep your brokerage connections alive, and the account numbers of brokerage accounts you connect, are encrypted inside the application before they are stored. Account numbers remembered from an imported file are protected like the rest of your portfolio data, without that extra encryption.
- Our nightly database backups are encrypted before they leave the server. Our hosting provider's full-disk backups (section 8) are not separately encrypted by us.
- MyFinFree is built so that each account can reach only its own data, and the number of requests an AI assistant can make is limited.
No system is immune to failure. If a personal data breach occurs, we report it to the Dutch Data Protection Authority and, where the risk to you is high, tell you directly, as Articles 33 and 34 of the GDPR require.
11. Age limit
MyFinFree is for adults. Accounts are for people aged 18 or over; an account we find to belong to a minor is closed and its data deleted.
12. Complaints
Not happy with how your data is handled? Tell us at [email protected] and we will try to put it right. You don't have to contact us first: you can also complain directly to a data protection supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl); you may also go to the authority in the EU country where you live or work.
13. Changes to this policy
When MyFinFree changes the way it handles data, this policy changes with it; the date at the top shows when it last changed. If a change matters to you — a new kind of data, a new purpose, a new provider or a new controller — we will email you at least 30 days before it takes effect, and where a change needs your consent we will ask for it. If a change cannot wait — because a provider stops its service, a security problem needs fixing or the law requires it — we tell you as soon as we can, at the latest when it takes effect.
14. Contact
MyFinFree · KVK 42197491 · Johan van der Keukenstraat 26, 1087 BN Amsterdam, Netherlands · [email protected]