Privacy Policy

SomedayFund ("we", "us", "our") operates the SomedayFund personal finance platform, accessible at somedayfund.app. This Privacy Policy applies to all users of the service and describes how personal information is collected, used, stored, and protected.

By creating an account and using SomedayFund, you agree to the practices described in this policy. If you do not agree, you should not use the service.

Account information

When you create an account, we collect:

• Name and email address — required to create your account and communicate with you
• Password — stored as a bcrypt hash (cost factor 12). We never store or have access to your plaintext password
• Phone number — optional, encrypted at rest using AES-256-GCM
• Country — used for display purposes
• Primary currency — set at registration and used throughout the app

Financial data

The core of what SomedayFund stores on your behalf:

• Transactions — merchant name, amount, date, category, optional note, optional tag, and linked account
• Bank accounts — bank or wallet name, account type, optional last 4 digits of card, and opening balance
• Subscriptions — service name, amount, billing frequency, and next charge date
• Savings goals — goal label, target amount, amount saved, and estimated completion date

Technical data

We collect limited technical information to operate and secure the service:

• IP address — logged in security audit events (login, password changes, 2FA activity)
• Authentication tokens — short-lived access tokens (15 minutes) and long-lived refresh tokens (7 days), stored securely
• Security events — timestamps of logins, failed attempts, 2FA changes, and password resets

We do not use advertising networks, data brokers, tracking pixels, or behavioral surveillance tools. We do not use Google Analytics, Meta Pixel, Microsoft Clarity, or any tool that sends your usage data to third-party advertising infrastructure. Any analytics we use are privacy-first tools that collect no personal data and require no cookies.

We use your data only for the following purposes:

• Providing the service — displaying your transactions, calculating balances, generating analytics, powering the dashboard
• Account security — verifying your identity, powering two-factor authentication, detecting and blocking suspicious activity
• Transactional email — sending verification emails, password reset links, and security alerts. We do not send marketing email unless you explicitly opt in
• Service improvements — aggregate, anonymised usage patterns (e.g. which features are used most) to improve the product. Individual transaction data is never used for this

We do not use your financial data to build advertising profiles, score your creditworthiness, sell data to financial institutions, or make automated decisions that affect you outside the app.

We use field-level encryption for the most sensitive data. This means sensitive values are encrypted in the application before being written to the database, using AES-256-GCM with a unique random IV per value. The encryption key is stored separately from the database, in a secrets management system, so a database breach alone cannot expose your data.

What is and isn't encrypted at rest

Other security measures

• Passwords — hashed with bcrypt (cost factor 12). Never stored in any recoverable form
• Session tokens — refresh tokens are hashed with bcrypt before storage. Raw tokens are never stored
• Token invalidation — logging out immediately invalidates your session token via a Redis blacklist. Changing your password invalidates all active sessions
• Two-factor authentication — TOTP-based 2FA available, with 10 single-use encrypted backup codes
• Transport security — all data in transit is encrypted via TLS (HTTPS)
• Rate limiting — login, registration, and sensitive endpoints are rate-limited to prevent brute-force attacks

We share limited data only with the following service providers, strictly for the purpose of operating SomedayFund:

We may disclose your information if required by law, court order, or governmental authority, or if necessary to protect the rights, property, or safety of SomedayFund, our users, or others. We will notify you of such requests where legally permitted to do so.

We retain your data for as long as your account is active. When you request account deletion:

• Your account is immediately disabled — you cannot log in and your data is not accessible through the app
• Your data is scheduled for permanent deletion after a 30-day grace period
• During the grace period, you can reactivate your account by signing in and cancelling the deletion request
• After 30 days, all your data — transactions, accounts, goals, subscriptions, and profile information — is permanently and irreversibly deleted from our systems

Security audit logs (IP addresses, event timestamps, event types) are retained for up to 12 months for security and fraud prevention purposes, even after account deletion.

You have the following rights over your data. Most of these can be exercised directly inside the app without contacting us.

• Access — you can view all your data through the app at any time.
• Export — use Settings → Danger zone → Export your data to download a complete JSON export of your transactions, accounts, categories, subscriptions, and goals.
• Correction — edit your profile information, transaction details, and account details at any time through the app.
• Deletion — delete your account via Settings → Danger zone → Delete account. All data is permanently deleted after the 30-day grace period.
• Portability — your exported data is in standard JSON format, readable by any JSON-compatible tool.

GDPR (EU users)

If you are located in the European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR):

• Right to restriction — you may request that we restrict processing of your personal data in certain circumstances
• Right to object — you may object to processing based on legitimate interests
• Right to lodge a complaint — you have the right to lodge a complaint with your local data protection authority

To exercise any of these rights, contact us at support@somedayfund.app. We will respond within 30 days.

We use a single authentication cookie to keep you signed in. This cookie:

• Is set with HttpOnly — it cannot be read by JavaScript, protecting against XSS attacks
• Is set with SameSite=Strict — it is not sent on cross-site requests, protecting against CSRF attacks
• Is set with Secure in production — it is only sent over HTTPS
• Expires after 7 days of inactivity
• Is immediately invalidated when you log out

We do not use advertising cookies, tracking cookies, or any third-party cookies. We do not use Google Analytics, Facebook Pixel, or any equivalent tracking technology.

SomedayFund is not directed at children under the age of 16. We do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has created an account, please contact us at support@somedayfund.app and we will delete the account and all associated data promptly.

We may update this Privacy Policy from time to time. When we do:

• We will update the "Last updated" date at the top of this page
• For material changes — changes that meaningfully affect how we use your data — we will notify you by email at least 14 days before they take effect
• For minor changes (clarifications, formatting, non-material updates), we will update the policy without individual notification

Continued use of SomedayFund after a policy change takes effect constitutes acceptance of the updated policy. If you do not agree with a change, you may delete your account before the change takes effect.

If you have questions about this Privacy Policy, want to exercise your data rights, or have a privacy concern, contact us at:

We aim to respond to all privacy enquiries within 5 business days and to formal data subject requests within 30 calendar days.