← All legal documents
Legal

Privacy Policy

Nothing about your money reaches us. This page is about the little we do handle.

Last updated 29 October 2026 · Augmented Mind AB is the controller

Who we are

Mind My Money is made by Augmented Mind AB (PB 13, 00561 Helsinki, Finland), and we are the data controller for the personal data described here. This policy covers this website, the Mac app, the Windows app, the iPhone app and the optional licence. Write to us about any of it at [email protected].

The short version

The one worth reading

Mind My Money keeps your statements, transactions and reports, your bills, what you own, your debts and your pension, and your answers, in a folder on your own computer. We do not run a server that stores your finances, and nothing about your money is ever sent to us. If you never make an account, what we hold about you is limited to the anonymous counts described below.

On your computer

None of what follows reaches Augmented Mind AB. It is here because it is still your data.

To do what you ask, the app reads and writes files in its folder, runs on your computer under your own user account, and uses a web browser that you sign in to yourself: your bank, your digital mailbox if you use one, and the sites of companies you want to cancel. AI makes mistakes, and what it does on those sites, paying a bill included, is your responsibility. If you allow it, it uses your microphone when you answer by speaking. To find out what a payment was for, it can also look beyond your statements: in your email, in the browser you sign in to yourself, and on a Mac, if you allow it, in your photos, your messages or your calendar. The Windows app does not read those. You can withdraw any of those at any time: on a Mac in System Settings → Privacy & Security, and on Windows in Settings → Privacy & security → Microphone.

When you ask about a fund you own, the app looks it up in your browser by its ISIN (the code that identifies a fund) on the fund's own site or a fund-data site. That site sees a request for that one fund, as it would if you looked it up yourself. How much you hold, the list of what you own and your name never go into the lookup.

A report you share with a coach or anyone else goes from your own email. If you share a period's figures with someone you live with (on a Mac), only the group totals are shared, through your own iCloud account to theirs, under your agreement with Apple. Neither passes through us.

The app's AI is the agent you choose when you set it up: Claude Code, running on your own Claude subscription under your own agreement with Anthropic, or Codex, running on your own ChatGPT subscription under your own agreement with OpenAI. What a task needs goes from your computer to that company directly; we are not in that path and never see it. With Claude, how long Anthropic keeps it depends on your Claude privacy settings: with model improvement off, its usual 30-day retention period applies; with it on, it may keep your sessions, de-identified, for up to five years for training. Turn model improvement off there if you want the shorter one. With ChatGPT, whether OpenAI may use it to improve its models is your ChatGPT data control “Improve the model for everyone”; turn it off there if you do not want that, and see OpenAI's privacy policy.

The iPhone app shows your reports and questions through your own iCloud, between your own devices, under your agreement with Apple. We do not receive any of it, and the iPhone app collects no data.

What the app reads contains other people's details too — who you paid, who wrote to you. That handling happens on your equipment and is yours; we neither receive that material nor decide what the app does with it.

What we hold, and why

Only these, and most of them only if you make an account or write to us.

Your account Your email address, and your name if you give one. To let you sign in here and in the app, and to know which licence amount you chose. You sign in with a code or a link we email you, or on this website with your Apple, Google or GitHub account. If you use one of those, we receive your email address and name from it, and nothing else. With Apple, the address can be a private relay address Apple makes for you. Legal basis: our contract with you.
Your licence payments If you choose to pay, billing details and payment records, handled by Stripe. We never see full card numbers. Legal basis: our contract with you, and our legal obligations for tax and accounting.
What you send us Support messages, problem reports and anything you agree to send us from the app, with your email address if you give it, so we can reply. Legal basis: our legitimate interest in answering you and fixing what is broken.
Email we have sent you A record of the messages we sent, including their contents, and whether they arrived. Legal basis: our legitimate interest in knowing that our own email works, and in showing what we sent and on what basis.
Downloads and update checks The address that fetched a download or checked for an update, the app's version, and for an installed app an install number it makes up at random — see below. For a download started on this website, also where your visit came from, as one word (such as a search engine or a site that linked to us); nothing that identifies you. The first time an installed app checks for updates, we match it to a download from the same internet address in the 48 hours before, and count it under that download's word. Legal basis: our legitimate interest in delivering updates, in knowing roughly how many copies are in use, and in knowing which sites bring people who use the app.
Visits to this website Counts of pages visited, with no cookie and nothing stored on your device — see below. Legal basis: our legitimate interest in knowing roughly how many people visit.

Nothing here is used to make an automated decision about you.

What the app sends us

The app sends us nothing about your finances. It contacts us in these ways only:

  • Checking for updates. The Mac app and the Windows app each ask our download server whether there is a newer version automatically, at most once a day while they are running, and whenever you choose to check for updates. The server sees your internet address and the app's version. Each also sends an install number: a random number it made up when it was installed, so we can count copies in use rather than addresses. It is not linked to your account or to anything about you. The one thing we attach to it is where its download came from: the first time an install checks, we look for a download from the same internet address in the 48 hours before and take that download's word (a search engine, a site that linked to us, or none). That is how we count which sites bring people who actually use the app.
  • Checking that your browser works. During setup the app opens one page on this website in your browser, to confirm it can drive it. That shows up in our visit counts like any other visit.
  • Fetching the list of coaches. The app downloads the coach directory from this website. It is the same file for everyone, served like any other file on this site, and fetching it tells us nothing about whether you pick a coach, or which one.
  • Signing in, if you choose to, with an emailed code.
  • A problem report, only when you send one. It contains what you write, your email address if you give it, details of your computer and the app, and recent lines from the app's logs. You see the whole report before it is sent. Logs can mention file names, so read it first.
  • A message you agree to send us after a round, such as a few words about how it went, with the name you chose to sign it with.

Visits to this website

This site sets no cookies for measurement and stores nothing on your device, so it cannot recognise you on a later visit or follow you elsewhere. We count visits three ways:

  • Cloudflare Web Analytics, which counts page loads without cookies.
  • Our own page counter, which records the page, the country Cloudflare reports for the visit, the site that linked to it, any campaign label in the link, the kind of device, and which buttons were pressed. It joins the events of one page load with a number that is forgotten when you close the tab. Your internet address is not stored.
  • Google Analytics, fed from our server with those same page events. Google receives the page, the country and that per-tab number — not your internet address, and nothing from your browser directly.

We take blunter numbers in exchange for not putting a consent banner in front of you.

Email we send you

Email about your account — a sign-in code or link you asked for, a receipt, a reply to something you wrote — is part of giving you the service. You cannot opt out of it, and it is never marketing.

Updates and news we send only if you asked for them, and you confirm by following the link we email you. Legal basis: your consent. You can stop them in your account settings or from any of those emails, and changing your mind costs nothing.

How long we keep it

  • Your account and preferences: while you have an account. Close it and we erase everything that identifies you.
  • Payment records: as long as accounting and tax law requires.
  • Support messages and problem reports: while we need them to answer you and to see whether a problem recurs, and no longer than your account.
  • Whether an email arrived: 180 days.
  • Download and update-check records: about three months, then deleted automatically.
  • Visit counts: our own and Cloudflare's as aggregate figures; Google Analytics deletes its event data after two months.

Who else is involved

Five companies help us run this, and each gets only what it needs for its job: Stripe for payments, Supabase for your account, Cloudflare for this website and the downloads, Resend for sending email, and Google for counting visits. Who they are and what each handles is on our sub-processors page. None of them receives anything about your money, because we do not have it.

Sending data outside the EU

Your account is stored in the EU. Some of the companies above are American or have American parents, so some data may be processed outside the EU. Where that happens it is covered by the European Commission's adequacy decision for the EU–US Data Privacy Framework, or by the Commission's standard contractual clauses. Ask us at [email protected] for the detail on a particular company.

What we do not do

  • We do not receive, store or sync your financial data.
  • We do not use your data to train AI models.
  • We do not sell your personal data.
  • We do not run advertising, and we share nothing with an ad network.
  • We do not keep your account after you close it.

Your rights

Under the GDPR you can ask us to:

  • show you what we hold about you, and give you a copy you can take elsewhere;
  • correct it, or delete it;
  • stop or limit what we do with it, including objecting to it;
  • withdraw your consent to any email you opted into, at any time. That does not make what we did before unlawful.

Ask at [email protected] and we will answer within a month. It costs nothing. If you think we have got it wrong, you can complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or to the authority where you live.

Changes

We update this page before what we do changes. The date at the top shows when it last changed, and if a change matters to you we will say so.

Something here unclear or wrong? Write to us — it reaches the person who wrote it.
Augmented Mind AB · PB 13, 00561 Helsinki, Finland