FinPlanTools

Trust   ·   Where your data lives

Your money data stays yours.

Here is exactly what FinPlanTools stores, where it lives, and how to get rid of it — laid out per deployment mode, with no bank-level-security hand-waving. Every claim on this page maps to code you can read.

01   Two modes

Local, or hosted. You choose the blast radius.

Run FinPlan fully local and our servers never enter the picture. Or connect the hosted server for zero-install setup — and even then, what we hold is a short-lived scratch copy, not a record of you.

Where your state lives
Local CLI Plain JSON files on your own disk. FinPlan reads and writes them where you tell it to; nothing is uploaded.
Hosted server A plain JSON document held in the server's scratch directory under a random handle for up to 60 minutes, then it stops resolving. Never written to a database or a persistent volume.
What leaves your machine
Local CLI Nothing goes to our servers. The tools run against your local files over stdio.
Hosted server Your state document is uploaded so the tools can run on it. It is referenced by an unguessable random handle, not by your name or account.
What our servers can see
Local CLI Nothing. There is no server in the loop.
Hosted server The current state document, for up to 60 minutes. We do not link it to your identity, and the handle stops resolving within the hour.
How to delete it
Local CLI Delete the file. It is yours; there is no copy anywhere else.
Hosted server It ages out on its own: every document expires after 60 minutes and stops resolving, and each redeploy wipes the scratch directory entirely.

One thing is true in both modes: your conversation runs through your AI provider — Anthropic, OpenAI, or Google. Local mode means our servers see nothing. It does not mean the model sees nothing. If you want the model kept out of the loop too, that is a question for your provider's privacy terms, not ours.

02   What we never touch

The most private data is the data we never collect.

No bank credentials

Account sync reads a file you export from Monarch. FinPlan never sees a bank login, and there is no account-aggregator connection to break.

No SSN, ever

There is no Social Security number field in the data model. FinPlan does not ask for one, and there is nowhere to put one.

No selling, no sharing

There is no analytics, no tracking, and no third party that receives your financial data. Nothing about you is a product.

03   Hosted, in detail

If you use the hosted server, here is the whole picture.

Your financial state

When a tool needs your full profile, the document is uploaded and stashed under a random 128-bit handle in the server's temporary directory. It has a 60-minute time-to-live: the server stops resolving it once it expires, and the next request for an expired handle gets nothing back and clears the file. The directory is ordinary container storage with no persistent volume attached, so every deploy starts it empty. There is no database of your finances — only this transient copy.

Your account

An account is optional and exists only to issue API keys. It lives in Supabase and holds your email plus your keys. We never store a raw API key — only its SHA-256 fingerprint, so the key is shown to you exactly once at creation and can never be read back, by us or anyone. Keys carry an expiry (90 days by default), and you can revoke any of them yourself, at any time, from the dashboard.

Where it runs

The server runs on Railway; accounts and keys live in Supabase. Deleting an API key is self-serve and immediate. Your uploaded state needs no delete button — it expires on its own within the hour. Removing the account record itself (your email) is not yet self-serve; until it is, ask us and we will remove it.

04   The exits

Leaving is easy. That is deliberate.

Your data is plain JSON — the same format going in and coming out. Nothing is locked in a proprietary schema or a cloud you cannot reach.

  • Export anytime. Your whole profile is one JSON document you can save on demand.
  • Readable and portable. Open it in any editor. Back it up however you like.
  • Version it in git. Track every change to your plan over time, on your terms.

A tool you cannot walk away from is a trap. FinPlan is built so you can leave with everything, in a format you already own.

Read the code

Don't take our word for it. Read the source.

Every claim on this page is enforced by code, and the plugin that talks to your assistant is open for inspection.

View the plugin on GitHub