LegalPrivacy Policy

Who we are

Funance is operated by Troy Popovic, an Australian individual based in Melbourne, Victoria. For the purposes of the Privacy Act 1988 (Cth) and the Australian Privacy Principles, Funance is the entity collecting and managing your data.

Contact: hello@funance.com.au

What information we collect

Account information

• Email address (for account creation and magic-link login)
• Display name (optional)
• Authentication session tokens (managed by Supabase)

Newsletter subscription (no account required)

If you enter your email address into a newsletter form on this site without creating an account, we store that address separately from any account data, along with:

• The page the address was submitted from, and the date and time
• A one-way hash of your IP address and your browser’s user-agent string — kept as a record that consent was given, and to limit abuse of the form. We do not store the IP address itself
• Whether and when you confirmed the subscription, and whether and when you unsubscribed

We use double opt-in: submitting the form sends you a confirmation email, and you receive nothing further unless you click the link in it. A newsletter subscription is not an account, holds no financial data, and can be ended with the unsubscribe link in any email we send you.

Financial data you enter

• Income, expenses, debts, assets, savings goals, subscriptions
• Names you give to budget categories or partners
• Property values, super balances, novated lease details
• Birth years (used for retirement projections only)

This data is what we exist to help you manage. It is encrypted in transit (TLS 1.3) and at rest in our database.

Payment information

Payments are processed by Stripe. We never see or store your full credit card number. We retain only the Stripe customer ID and subscription status, which is enough for us to know whether your account is active.

Technical information

• IP address (used for rate limiting and abuse prevention; not stored long-term)
• Browser user-agent string (for debugging)
• Sync activity logs (timestamp + payload size only, not contents)
• Sign-in timestamps, and how long each dashboard visit lasts
• Which Pro features you tried to open while not on Pro, on which days, and whether you clicked through to upgrade

Usage measurement

While the dashboard is open in a visible tab, your browser sends us a timestamp roughly every 30 seconds. We store the start and end of each visit so we can see how long people spend in the app and whether new features get used. This is first-party only — it never leaves our own database, and it records when you were in the app, never what you were looking at or typing.

We also record the time of your most recent sign-in, so we can tell active accounts from dormant ones.

If you are not on Pro and open a Pro feature (for example the Goals tab, or cloud sync), we record against your account which feature it was, the day, and whether you clicked through to the pricing page. That is all: it never includes anything you have entered. We use it to see which features matter most to people deciding whether to upgrade, and it may decide which product-update emails you receive (for example, one about the feature you tried). You can opt out of those emails with the unsubscribe link in any of them. These records are kept while you have an account and deleted with it.

When you use the rate check, we record which part you used: seeing the lender comparison, pressing the Overview rate check card, copying the “ask your lender” script, opening a lender’s own page, or switching rate alerts on or off. These are stored against your account if you are signed in. They never include your rates, balances, lender or anything else you have entered. We use them to decide how prominent the rate check should be. The rates themselves are lenders’ public data, and the comparison with your loan happens in your browser.

What we do NOT collect

• We do not use third-party analytics that profile you (e.g. Google Analytics, Facebook Pixel). The only measurement on this site is our own, described under Cookies below, and it never leaves our database
• We do not sell your data to anyone, ever
• We do not share your data with advertisers or data brokers
• We do not access bank accounts via Open Banking or screen scraping — all data you see in Funance is data you entered yourself

How we use your information

1. Provide the service: store and sync your financial data across your devices
2. Authenticate you: verify your identity at login via magic-link email
3. Process payments: via Stripe, for subscription billing
4. Send essential emails: account confirmation, payment receipts, password resets, security alerts. You cannot opt out of these as they are required for the service to function.
5. Send product updates: occasional email about new features, changes and new articles. Creating an account subscribes you to these — you are told so on the sign-in screen — and so does confirming a newsletter signup. Every one carries a one-click unsubscribe link, and opting out never affects the essential emails above or your access to the service.
6. Improve the product: we look at usage patterns (e.g. which tabs are most-used, and which Pro features people try to open, as described under Usage measurement) but never at your financial data without your consent
7. Provide support: if you contact us, we may temporarily access your account to diagnose the issue. We log such access.
8. Rate alerts, only if you switch them on: once a week our server reads the home loans in your synced dashboard (rate, balance, property value, loan type, lender and fixed-rate end date), compares them with lenders’ published rates, and emails you if something has changed. Nothing from that comparison is stored except a record of which alerts were sent, so each is sent once. Alerts need cloud sync on. Switch them off in the Insights tab or from the link in any alert email; that record is deleted with your account.

Sharing with a partner

If you invite a partner to share your household, the two of you see and edit one set of numbers, and each of you can see everything in it. Nobody joins unless they accept the invite while signed in with the address it was sent to. Either of you can stop sharing at any time, and you each keep a copy of the numbers as they were. We record who invited whom and when, and which of you saved last, but keep no history of your edits.

Where your data is stored

Funance uses several service providers to deliver the product. Each is selected for security and reliability. Some of these providers store or process data outside Australia.

Application data (Supabase)

Your financial data, account profile, and session information are stored with Supabase in their Sydney region (ap-southeast-2) — physically located in Australia.

Payment processing (Stripe)

Stripe processes payment information per their own privacy practices. Stripe processes payment data in the United States. View Stripe's privacy policy.

Transactional email (Resend)

Email delivery (magic links, payment receipts, trial-ending notices) is handled by Resend, which processes email metadata (your email address, the message subject, and timestamps) on AWS infrastructure in the United States. The body content of the emails passes through this infrastructure during delivery but is not retained beyond Resend's standard logging period.

Hosting (Vercel)

The Funance website and API are deployed on Vercel. Static page content is served via Vercel's global CDN (which has nodes worldwide), and our API functions execute in Vercel's Sydney region (syd1).

Cross-border disclosure (APP 8)

Some of the service providers above are located outside Australia. Under Australian Privacy Principle 8, we are required to disclose this to you and to take reasonable steps to ensure overseas recipients comply with the APPs.

By using Funance, you consent to your personal information being disclosed to the following overseas recipients:

• Stripe (United States) — for payment processing
• Resend (United States) — for transactional email delivery
• Vercel (United States, with Sydney edge nodes) — for hosting and content delivery

You acknowledge that, by giving this consent, APP 8 will not apply to these disclosures. This means that if an overseas recipient handles your information in a way that would breach the APPs, Funance will not be accountable under Section 16C of the Privacy Act for that breach. You may withdraw this consent at any time by deleting your account, which will stop further data being sent to these providers.

We choose providers we consider to have substantially similar privacy and security standards to the APPs. All data in transit is encrypted with TLS 1.3.

Your rights

Under Australian privacy law, you have the right to:

• Access your data — there's an export button in the app, or email us
• Correct your data — you can edit anything in the app at any time
• Delete your data — there's a delete-account button in the app, which removes all data and cancels any active subscription. Email us if you can't access your account.
• Object to specific uses — contact us
• Lodge a complaint — with the Office of the Australian Information Commissioner (oaic.gov.au)

How long we keep your data

• Active accounts: as long as the account exists
• Deleted accounts: all financial data and profile information removed immediately on deletion request
• Payment records: retained by Stripe per their policies (typically 7 years for tax compliance)
• Server logs: 30 days, then deleted
• Website funnel records: 12 months, then deleted

Cookies

We use two first-party cookies and nothing else. There are no third-party cookies, no advertising cookies, and no tag manager or vendor script of any kind on this site.

• Authentication: keeps you logged in.
• Visitor ID (from 19 September 2026): a random identifier, valid for 90 days, used only to measure our own signup funnel — see below. It is not derived from your IP address, your device or anything else about you, it is unreadable by any script on the page, and it means nothing to anyone but us.

How we measure our own website

We want to know whether people who arrive from a search engine find what they were looking for, and whether the interactive demo is worth having. To answer that we record, against the random visitor ID above: which pages of this website you view and in what order, whether you opened the demo (and how far you got through its guided tour) or used one of the calculators, whether you asked for and entered a sign-in code (that a code was sent or accepted, never your email address or the code), and the domain that referred you — google.com, for example.

We do not store the full referring web address, because it can contain another site’s query parameters. We do not store your IP address in this record at all. We do not follow you across other websites, because we have nothing on any other website to follow you with.

If you later create an account, that visitor ID is linked to it, so we can tell that a particular landing page produced a signup. If you never create an account the record stays anonymous and is deleted within 12 months.

Blocking cookies, or using a browser that clears them, means we simply do not measure you. Nothing about the site stops working.

Children

Funance is not intended for users under 18. We do not knowingly collect data from minors. If you believe a child has used Funance, please contact us so we can delete the account.

Security

We take security seriously. Specifically:

• All data in transit is encrypted with TLS 1.3
• Authentication is passwordless (magic-link); we never store passwords
• Database access is restricted by Row Level Security policies
• Application secrets are stored in encrypted environment variables, never in code
• We will notify you within 72 hours of any breach affecting your data, in line with the Notifiable Data Breaches scheme

Changes to this policy

We may update this policy occasionally. Material changes will be communicated by email at least 14 days before they take effect. Minor changes (e.g. typo corrections) may be made silently. The "last updated" date at the top of this page reflects the most recent change.

5 September 2026 — website measurement

We added the Cookies section describing first-party measurement of our own website: a random visitor ID, stored in a cookie for 90 days, used to work out which pages bring people to Funance and whether the interactive demo is worth keeping.

This is a material change, so it takes effect on 19 September 2026, fourteen days after this notice. No measurement data is recorded before that date. There is no third party involved at any point, your IP address is not stored in these records, and if you never create an account the record stays anonymous and is deleted within 12 months.

The previous version of this page said we used no tracking cookies at all. That was true when it was written, and this change is the reason it no longer will be — which is why you are getting an email about it rather than a silent edit.