My Tin (“we”, “our”, “the app”) is a personal finance budgeting tool operated by Philipp Burath, Australia. This policy explains what information My Tin handles, where it is stored, who we share it with, and your rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Plain-language summary: My Tin is local-first. Your transactions, accounts, budgets, and goals are stored in your browser on your own device — we cannot see them. There are no My Tin accounts or passwords. Our servers only handle licensing and payments (a random device ID, your licence key, and a Stripe reference). If you turn on Pro sync, your data goes to your own cloud storage, not to us. We do not sell your information or share it with advertisers.
1. Who this policy applies to
This policy applies to everyone who uses mytin.app. My Tin is operated by a small business that currently falls within the small business exemption under the Privacy Act 1988 (annual turnover below $3M). We choose to follow the Australian Privacy Principles anyway, because financial information deserves that level of care.
2. Where your data lives
Your financial data: Transactions, accounts, balances, budgets, goals, categories, and rules are stored in your browser’s local database (IndexedDB) on your device. They are never uploaded to our servers.
Imported bank statements: CSV files are read and processed in your browser. The files and their contents are not sent to us. Please only import statements for accounts you own — if a CSV contains another person’s transactions (for example, a joint account holder), they stay on your device as part of your data.
Settings, activity log, and reminders: Your preferences, theme, and bill and budget reminders are kept in your browser’s local storage, and the activity log (Settings → Logs) in your browser’s session storage (cleared when the tab closes), all on your device. Reminders are generated by your browser; nothing is sent to us.
Important: because your data lives in your browser, clearing site data, removing the installed app, or switching browser or device means you lose access to it unless you have a backup or Pro sync. We cannot recover it for you, because we do not have it.
3. What our servers do hold
Licence record: A random device ID generated in your browser, your trial start date, your current plan, your purchase date, a last-seen timestamp, your licence key (MYTIN-XXXX-XXXX-XXXX), and — once you buy — a Stripe customer reference. This contains no transactions, balances, or budgets.
Payment details: Collected and processed by Stripe when you buy. Stripe receives your name, email address, and card details. We never see or store card numbers. We can see your email and billing details in the Stripe dashboard (to issue receipts, handle refunds, and give support), but our own database does not store them.
Support emails: If you email us, we keep your email address and message so we can respond.
Hosting logs and analytics: Our host, Vercel, records standard request logs (such as IP address, time, page requested, and browser type). We also use Vercel Web Analytics and Speed Insights to collect anonymous page-view and performance data so we can see how the site is used and keep it fast.
4. What we do not collect
✓Your transactions, account names, balances, budgets, or goals
✓Bank login credentials (My Tin uses CSV import only — no bank connections)
✓Names, email addresses, or passwords for a My Tin account (there are no accounts)
✓Credit or debit card numbers (handled directly by Stripe)
✓Tax file numbers or government identifiers
✓Biometric data or precise location data
✓Advertising identifiers or cross-site tracking
5. How we use information
We use the information in section 3 only to:
Run your free trial and verify which plan you have, including restoring your licence on another device with your key
Process payments and subscriptions through Stripe
Respond to support and privacy requests
Keep the service secure, reliable, and fast, and prevent abuse
Understand overall site usage through anonymous analytics
Automated categorisation:the app can categorise transactions using rules you define, or rules it suggests based on your own transactions (for example, “Woolworths” → Groceries). This runs on your device, you can review and override any result, and it has no legal or similarly significant effect on you.
Not financial advice: My Tin is a personal budgeting tool. Nothing in the app is financial product advice, an investment recommendation, or a financial service under the Corporations Act 2001 (Cth). We do not hold an Australian Financial Services Licence (AFSL). For financial advice, consult a licensed financial adviser.
6. Optional cloud sync and backups (Pro)
Pro lets you sync between devices using storage you control: Google Drive (private app data folder), Dropbox (app folder), OneDrive (app folder). This is optional, and you can disconnect at any time.
Synced data is encrypted in your browser (AES-256-GCM) before it is uploaded. The key is derived from your cloud account’s identifier rather than a separate passphrase, so treat sync as a convenience backup, not as protection from your storage provider.
Your provider’s own privacy policy applies to what you store with them. For Google, we request access only to the private app data folder, plus your basic profile and email to identify the connected account.
Google sign-in and token refresh pass through our server because they need our app’s credentials. Tokens are not stored by us.
Sync tokens are stored in your browser’s local storage on your device, so keep your device and browser profile secure.
7. Third-party services and overseas storage (APP 8)
The providers below process limited information on our behalf. Several are based overseas, mainly in the United States. We rely on their standard data processing and security terms.
| Service | Location | Purpose | Data shared |
|---|
| Stripe | Australia / US | Payment processing | Name, email address, and card details at checkout (we do not store card numbers) |
| Turso | US (AWS) | Licence database | Device ID, licence key, plan and purchase dates, Stripe customer reference |
| Vercel | US (AWS) | Web hosting, CDN, and analytics | Request logs (IP address, time, page, browser) and anonymous page-view and performance data |
| Google, Dropbox, or Microsoft (only if you enable sync) | Various | Your own cloud storage | Your encrypted sync files, stored in your account |
We do not sell, rent, or share your information with advertisers, data brokers, or any third party not listed above. US-based providers may be subject to US laws such as the CLOUD Act; because your financial data is not stored with us, our systems hold only the licensing and payment records described in section 3.
8. Security
Your financial data stays on your device, so its security depends partly on your device. Use a device lock and disk encryption. There is no My Tin password: anyone with access to your unlocked device and browser profile can open the app.
All connections to our servers use HTTPS.
Card payments are handled entirely by Stripe.
Your licence key works like a password for your plan. Keep it private; you can use it on up to 5 devices.
Synced files are encrypted in your browser before upload, as described in section 6.
9. Data breach notification
Although we are not currently required to under the Notifiable Data Breaches scheme, we commit to following it. If a breach involving information we hold is likely to cause serious harm, we will:
Assess it as quickly as possible (within 30 days)
Notify you, and the Office of the Australian Information Commissioner (OAIC) where required, if there is a likely risk of serious harm
Tell you what steps you can take to protect yourself
If you suspect unauthorised use of your licence or any problem with your data, contact us immediately at privacy@mytin.app.
10. Your rights (APP 12 & APP 13)
Access: Your financial data is on your device and visible in the app. Backup & Export (Settings) lets you download a backup, and CSV export is included with Pro. To see the licence record we hold about your device, email us with your licence key.
Correction: Edit any transaction, account, or category in the app at any time. To correct a licence record, email us.
Deletion: The Data Management page in the app lets you delete transactions and wipe your local data, and it can also delete your cloud backups for connected providers. To delete the licence record for your device, email us. Deleting it ends trial tracking and the ability to restore your licence with its key, and Stripe keeps its own payment records (see section 11).
Activity log: The activity log (Settings → Logs) is stored on your device. You can view and clear it at any time.
Complaint: Contact us using the details below. If you are not satisfied with our response, you can escalate to the OAIC at oaic.gov.au.
11. Data retention
Financial data on your device stays until you delete it or clear your browser data. Licence records are kept while your trial or licence is active and for support and fraud prevention, and are deleted on request (see section 10). Vercel keeps hosting and analytics data under its own retention policies. Stripe keeps billing and payment records independently for its own legal and compliance obligations, under Stripe's privacy policy. We keep support emails for as long as needed to deal with your request.
12. Changes to this policy
We may update this policy as the app or Australian privacy law changes. The “Last updated” date above shows the latest revision, and we will tell you in the app about material changes.
13. Contact
For privacy enquiries, access or deletion requests, or complaints under the Privacy Act 1988:
My Tin — Privacy Officer
Australia
Email: privacy@mytin.app · General support: support@mytin.app
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.