Privacy Policy

Last updated: September 14, 2026

Our Commitment to Your Privacy

IncomeSync is built on a zero-knowledge architecture. Your financial data never leaves your device. We don't store, access, analyze, or monetize your personal financial information. You own your data entirely.

What Data We Store

We only store:

• Account Profile: Email, name, billing address, subscription status
• Authentication: Encrypted password via Firebase Auth
• App Settings: Preferences, notification settings, display options

What We Do NOT Store: Your financial data (paychecks, bills, taxes, income) remains encrypted locally on your device.

Where Your Data Lives

• Financial Data: Stored locally in your browser/device with AES-256-GCM encryption
• Backups: Encrypted backup files stored locally on your device (you control when/where they sync)
• Cloud Backups: Completely encrypted - we cannot access the contents even if requested

Google OAuth Integration

We use Google OAuth for secure authentication. We only access your email address and basic profile info for account creation. We do not store or access your Google Calendar data beyond syncing event titles.

Encryption Standards

• AES-256-GCM: Military-grade encryption for all sensitive data
• SHA-256: Checksums to detect data corruption
• TLS 1.3: Secure data transmission

Data Retention

Account data is retained as long as your account is active. When you delete your account, all associated data is permanently removed from our servers within 30 days.

Third-Party Services

IncomeSync integrates with:

• Firebase (Google): Authentication, secure storage
• Stripe: Payment processing (PCI-DSS compliant)
• Google Calendar: Optional event syncing (you control permissions)

We share only the minimum necessary data with each service. Read their privacy policies for details.

Your Rights

You have the right to:

• Access all data we store about you
• Delete your account and associated data
• Export your account information
• Opt-out of non-essential communications
• Request a data deletion report

Security Practices

• All data transmitted via HTTPS/TLS 1.3
• No passwords stored in plaintext
• Regular security audits
• Zero-logging policy for financial data
• Device transition via secure hex serial codes

Children's Privacy

IncomeSync is not intended for children under 13. We do not knowingly collect data from children. If we become aware that a child has provided us with personal information, we will delete such information promptly.

Changes to Privacy Policy

We may update this policy from time to time. We will notify you of any material changes via email or prominent notice on our website.

Contact Us

Questions about this privacy policy? Contact us or email privacy@incomesync.app

IncomeSync is committed to protecting your privacy. Your financial data is your property, not ours.