Privacy Policy

Last updated: 28 September 2026

Introduction

Phinly Pty Ltd (ACN 656 671 313) ("Phinly", "we", "us" or "our") makes a money app. This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, where it goes, and how you can access it, correct it or make a complaint. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy covers our websites (www.phinly.com, auth.phinly.com, app.phinly.com and link.phinly.com), the Phinly app for iOS, Chat, and any dealings you have with us by email. Section 5 covers bank data you share with us under Australia's Consumer Data Right (CDR).

Personal information is information or an opinion about an identifiable individual. For Phinly that includes obvious things like your name and email address, and less obvious ones like your transactions, your device details and what you type into Chat.

In short

• We collect what you give us, the account data you choose to connect, what you type into Chat, and how you use Phinly.
• We use it to run Phinly, keep your account secure and improve the product. We do not sell personal information and we do not share it with advertisers.
• Bank data shared through the CDR reaches us through an accredited data recipient (Fiskil or Wych) and is handled under that principal's CDR policy.
• Chat replies are generated by an AI model provider (Google). Your messages are sent to it to produce a reply.
• Some of our service providers are overseas, mostly in the United States. Sections 7 and 8 list them.
• You can ask us to access, correct or delete your personal information at any time by emailing [email protected].

1. What personal information we collect

Account details

• Your email address, first name and last name.
• A password, if you sign up with one. We store a one-way hash of it, never the password itself.
• If you use social login, the identifier, name, email address and (for Google) profile picture that Google or Apple sends us. We never receive your Google or Apple password.
• If you set up two-step verification: a mobile number for SMS codes, or an authenticator app secret, which we store encrypted.
• A gift or invite code, if you sign up with one.

Sign-in and device information

• Your IP address, browser and device type, and the time of each sign-in.
• An approximate location (city, region and country) worked out from your IP address. We use it to warn you about sign-ins from a new device and to set defaults such as your region. We do not collect precise location from your device.
• A device identifier stored in a cookie, so we can show you the devices signed in to your account.

Linked account data

When you connect an account, we collect the data the institution or its data-sharing service makes available under your authorisation. Depending on the institution, that can include:

• the institution, and the names, types and numbers of your accounts;
• balances and holdings;
• transactions, including dates, amounts, descriptions, merchants and categories; and
• for bank accounts shared under the CDR, the data categories you tick on the consent screen (see section 5).

Transaction descriptions can include the names of people and businesses you pay or are paid by. We use that data only to show and analyse your own money.

Connection credentials

For institutions you connect directly, such as crypto exchanges, brokers, PayPal or Wise, we hold the API keys, access tokens or login details you provide so we can sync the account. They are encrypted before they are stored (see section 10). Bank accounts connected through the CDR or Plaid never involve giving Phinly your bank password.

Chat and the things you create in Phinly

• Your messages to Chat and the replies Phinly gives you.
• Information Chat saves so you do not have to repeat yourself between conversations, such as your region, your goals for your money, your risk preferences, watchlists, decisions you have told it about and open questions.
• Plans, Moves and anything else you set up in Phinly.

Usage information

How you use our websites and app: pages viewed, features used, clicks, errors your browser reports, and session replays (a reconstruction of how a page was used). Section 6 explains this, and how to turn analytics off.

Waitlist and correspondence

If you join the waitlist on www.phinly.com we collect your name, email address and device type. If you email us, we keep the correspondence.

Invitations

If you send a friend a gift of Phinly Pro, we record the invite and show you when it is accepted and when your friend connects a first account, but nothing else about their use of Phinly. If you accept an invite, the person who sent it can see that you accepted it.

What we do not collect

We do not ask for your date of birth, government identifiers or identity documents, and we do not run credit checks. We do not currently collect payment card details. If we introduce paid plans, payments will be handled by a payment processor and we will update this policy before we start charging.

2. How we collect it

• Directly from you, when you sign up, connect an account, use Chat, change your settings, join the waitlist or contact us.
• Automatically, from your browser, device and use of the app, including through cookies. Our Cookie Policy lists them.
• From third parties you direct us to: your banks and other institutions, through our CDR principals (Fiskil and Wych), through Plaid, or through the institution's own interface; and Google or Apple, when you use social login.
• From our service providers, for example delivery and bounce notices from our email provider.

If you choose not to give us information, we may not be able to provide part or all of the Service. You can use Phinly without connecting any account, but most of it depends on connected data.

3. Why we collect, hold, use and disclose it

We use personal information to:

• create and run your account, verify your email address and sign you in;
• connect, sync and display your accounts and transactions, generate Chat replies, and provide the other features you ask for;
• keep your account secure: detect suspicious sign-ins, send new-device alerts and verification codes, and prevent fraud and abuse;
• send you service messages, such as confirmation codes, password changes and notices about changes to our terms;
• understand how Phinly is used and improve it, including by finding and fixing errors and testing features;
• tell you about Phinly if you have joined the waitlist or agreed to hear from us (see section 9);
• meet our legal obligations, resolve disputes and enforce our terms; and
• do anything else you agree to at the time.

We do not sell personal information. We do not use it to serve advertising, and we do not share it with advertisers or data brokers.

4. Chat and AI

Chat is where you ask Phinly about your money. When you send a message, we send it to an AI model provider to generate the reply. We currently use Google's Gemini models through Google's API. With your message we send your name, your region, currency and language settings, recent messages from the same conversation, and any information from your Phinly account that is needed to answer you. Google processes this under its API terms to produce the reply.

When Chat looks something up on the web, it sends a search query or web address to a search or page-reading service: Google Search, Perplexity, Exa, Firecrawl or Jina AI. Chat writes the query from your conversation, so avoid typing details you would not want searched for.

We store your conversations so you can return to them, and Chat keeps the short profile memory described in section 1. You can delete a conversation in the app. We also keep records of conversations, including the messages and replies, to monitor Chat's quality, safety and errors; some of that monitoring uses PostHog (see section 6). We do not train AI models on your conversations.

Chat's replies are generated automatically and can be wrong. They are information about your own money, not financial advice. Our Terms of Service explain this.

5. Consumer Data Right (CDR) data

The Consumer Data Right lets you share your banking data safely with accredited businesses. Phinly is not an accredited data recipient. We are a CDR representative of two accredited data recipients, our principals:

• Fiskil Pty Ltd (accreditation number ADRBNK000246): Fiskil's CDR policy
• Wych (Activate Wych Pty Ltd, accreditation number ADRBNK2005): Wych's CDR policy

The consent screen tells you which principal applies before you share anything. The principal collects your data from your bank under your consent and provides it to us under our representative arrangement. As a CDR representative we have adopted, and comply with, the relevant principal's CDR policy for how CDR data is collected, used, stored, disclosed, corrected and deleted. Each policy explains how to contact the principal and how to complain. If anything in this Privacy Policy is inconsistent with the principal's CDR policy in relation to CDR data, the CDR policy prevails.

What you share and what we do with it

You choose what to share and for how long (up to 12 months at a time), and you can review it at any time. The data categories are shown on the consent screen and can include your name and contact details as held by your bank, account names, numbers and balances, transaction details, and direct debits, scheduled payments and saved payees. We use CDR data to show your accounts and transactions in Phinly and to power the features you ask for, including Chat. We do not sell CDR data or use it for direct marketing, and we do not disclose it to anyone other than the service providers that help us run Phinly (sections 7 and 8). We register you with the principal under a random identifier rather than your name or email address.

Withdrawing consent and deletion

You can withdraw a consent at any time in Phinly or through your bank's data-sharing dashboard. When a consent expires or is withdrawn we stop collecting that data, and CDR data we no longer need is deleted or de-identified in line with the principal's CDR policy, except where the law requires us to keep it.

Complaints about CDR data

Contact us first (section 13). You can also complain to the relevant principal using the contact details in its CDR policy, or to the Office of the Australian Information Commissioner.

Accounts outside Australia

Where we offer connections to New Zealand banks, they are made through Wych under the Payments NZ API Centre open banking standards rather than the CDR. Accounts in the United States, the United Kingdom, Europe and Canada are connected through Plaid, and you authorise Plaid directly on its own screens. Data shared this way is not CDR data: this Privacy Policy and the provider's own policy apply. For every bank connection, you enter your bank login details with your bank or the provider, never with Phinly.

6. Analytics, session replay and cookies

We use PostHog to understand how Phinly is used and to check that new features work. It collects events such as the pages you view, the features you use, your browser and device type, and errors your browser reports. It also records session replays: a reconstruction of how you used a page, including mouse movement, clicks, scrolling and what was displayed on screen. Text you type into form fields is masked, but information shown on the page, which can include your account balances and transactions, may be included in a replay. Once you are signed in, PostHog events are linked to your account (your user ID, email address and name) so we can trace an error you report. PostHog is hosted in the United States.

You control this. If you reject analytics in the cookie banner, or later under "Cookie settings", we do not capture analytics events or session replays. If you are visiting from the European Union, the European Economic Area, the United Kingdom or Switzerland, or we cannot tell where you are, then until you accept we store nothing on your device for analytics and record no session replays, but we still collect basic usage events (linked to your account if you are signed in). Our Cookie Policy has the details, including how to change your choice.

We also use PostHog to decide which features to show you (feature flags). This uses only your account ID and is needed for the Service to work.

On www.phinly.com we use Google Analytics to measure visits to the marketing site. It follows the same cookie choice as PostHog, except that it never loads in the regions above until you accept. If you reject analytics after it has loaded, we delete its cookies immediately, but it can keep sending visit data from that browser tab until the page is reloaded or closed.

7. Who we disclose personal information to

We share personal information with service providers that help us run Phinly, only for that purpose. They are bound by contract and may use the information only to provide their service to us.

We may also disclose personal information:

• to Google or Apple when you choose social login, so they can authenticate you;
• to our professional advisers, insurers and auditors, under confidentiality;
• to a buyer or successor if we sell or restructure our business, on the same terms as this policy;
• to law enforcement, regulators or courts where the law requires or permits it; and
• to anyone else you ask us to.

8. Overseas disclosure

Yes, we are likely to disclose personal information to overseas recipients. Based on the providers above, the countries are:

• United States: PostHog; Google (Gemini API, Google Search, Google Analytics and Google Workspace); Vercel; Cloudflare; Twilio and SendGrid; Plaid; Perplexity; Exa; and Firecrawl.
• United Kingdom: Vercel, which also serves our websites from London.
• Germany: Jina AI.

If you connect an institution outside Australia, your credentials and account data also go to that institution and, where relevant, to Plaid, in the countries where they operate.

Our CDR principals are Australian companies, and our own storage buckets and secrets are kept in Australia. Analytics events and session replays go to PostHog in the United States unless you turn analytics off (section 6); Chat quality monitoring records also go to PostHog.

Before we disclose personal information overseas we take reasonable steps to ensure the recipient handles it in line with the APPs, including through our contracts. Overseas recipients may be subject to privacy laws that differ from Australia's, and you may not be able to seek redress against them under Australian law.

9. Direct marketing

We only send marketing if you have joined our waitlist or told us you want to hear from us. You can opt out at any time using the unsubscribe link in any marketing email, or by contacting us. Service messages, such as verification codes, password changes and sign-in alerts, are not marketing and are sent for as long as you have an account. We comply with the Spam Act 2003 (Cth), and we do not give your details to other companies for their marketing.

10. Security

We hold personal information electronically, in systems run by the providers listed in section 7. We take reasonable steps to protect it from misuse, interference, loss, and unauthorised access, modification or disclosure. Among other things:

• every connection to Phinly uses HTTPS (TLS), and our sites enforce it with HSTS;
• the credentials and tokens for your linked institutions, and your authenticator app secrets, are encrypted with AES-256-GCM before they are stored, and passwords are hashed with bcrypt;
• you can protect your account with two-step verification (authenticator app or SMS), we warn you about sign-ins from new devices, sessions expire, and you can sign out of every device at once;
• our database enforces per-user isolation (row-level security), and secrets are kept in a managed secret store; and
• personal details are redacted from our logs.

No system is perfectly secure, and we cannot guarantee the security of your information. If a data breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme. If you find a security problem, tell us at [email protected].

11. How long we keep it

• Account and linked account data: while your account is open. When you close your account we delete or de-identify your personal information, except what we must keep by law or need to resolve disputes, prevent fraud or enforce our terms (for example, sign-in and security records for a limited period).
• CDR data: as described in section 5.
• Chat: conversations until you delete them or close your account; Chat's profile memory until you close your account or ask us to clear it.
• Waitlist details: until you unsubscribe or ask us to delete them.
• Analytics data: only for as long as we need it to analyse how Phinly is used.
• Backups: deleted data can persist in backups for a short period before it is overwritten.

To close your account and have your personal information deleted, email [email protected]. We aim to complete deletion requests within 30 days.

12. Accessing and correcting your personal information

You can see and update most of your account details in the app. You can also ask us for a copy of the personal information we hold about you, or ask us to correct it, by emailing [email protected]. We will respond within 30 days. We may need to verify your identity first. We do not charge for making a request; if a request is unusually complex we may charge a reasonable fee for providing access, and we will tell you before we do. If we refuse access or correction, we will tell you why in writing and how to complain.

13. Making a complaint

If you think we have breached the Privacy Act, the APPs or, for CDR data, the CDR rules, email [email protected] with your name, contact details and a description of the problem. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If we need longer, we will tell you why.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

For CDR data you can also complain to the relevant principal (section 5).

14. Children

Phinly is for adults. You must be at least 18 to create an account, and we do not knowingly collect personal information from anyone under 18. If you think a child has given us personal information, contact us and we will delete it.

15. Changes to this policy

We will update this policy when our practices change, for example when we add a service provider or a feature that handles personal information differently. The date at the top shows the current version. If a change is significant, we will tell you by email or in the app before it takes effect.

16. Contact us

• Phinly Pty Ltd (ACN 656 671 313)
• Privacy questions, access, correction, deletion and complaints: [email protected]
• Security issues: [email protected]