Privacy Policy

This Privacy Policy describes how Evan Paul Lazar (ABN 76318734086), trading as SinkWise ("SinkWise," "we," "us," or "our") collects, uses, and protects your information when you use the SinkWise website at sinkwise.app and the budgeting service offered through it (the "Service").

If you do not agree with this policy, please don't use the Service. Questions? Contact us via our contact page.

1. What Information We Collect

Category	Examples	Why we collect it
Account & identity	Email address, display name, profile photo (if you use Google sign-in), a securely hashed password, email-verification status, date of birth (used for age verification), and account creation / last sign-in times	To create, identify, age-verify, and secure your account
Financial data you enter	Sinking-fund names, goals, balances and target dates; your full deposit & withdrawal history; recurring bills (name, amount, due day, frequency); recurring expenses (name, amount, frequency, category); optional income, pay frequency and savings rate; and preferences such as dark mode	To provide the core saving and budgeting features
Subscription & billing	Stripe customer and subscription IDs, your plan status and renewal / cancellation date. Card details are handled entirely by Stripe — we never receive or store your full card number, CVV, or magnetic stripe data	To manage your Premium subscription
Security & device data	IP address, device and browser type, and approximate location (city / region / country) when you sign in, reset your password or recover your account; plus one-way hashed values of your email/IP used purely for rate-limiting and abuse prevention	To detect new-device sign-ins, send security alerts, and protect your account
AI feature inputs	When you use AI Insights or AI News, all of the SinkWise financial data above — funds, transaction history, bills, expenses and your income profile — and, for AI News, the region/location you enter	To generate your personalised AI Insights and AI News
Communications	Your email address and the content of transactional emails we send you (verification, password reset, security alerts, billing notices)	To operate and secure your account
Usage & analytics	Pages/features used, device and browser type, and approximate location via IP. Google Analytics data is collected only if you accept analytics cookies via our consent banner	To understand usage, fix bugs, and improve the Service (analytics only with your consent)
Consent records	Your acceptance of the Terms, Privacy Policy and age confirmation (including date of birth at signup), with a timestamp and document version	To keep a record that you agreed, as required by law

We don't ask for and don't want sensitive categories of data (such as government IDs, health, racial or ethnic origin, biometric data, or precise geolocation). Please don't enter them into free-text fields like fund or bill names. We do not collect biometric data.

We collect only the personal data that is actually needed to provide the Service — we do not collect data speculatively or beyond what the purposes in this table require.

2. Artificial Intelligence Disclosure

Two optional Premium features use a third-party AI model (currently provided by Anthropic):

• AI Insights generates personalised observations, recommendations and projections. To do this it is given your complete SinkWise financial picture — your sinking funds, your full transaction history, your recurring bills and expenses, and your income profile.
• AI News scans recent local and international news that could affect your money. To personalise the scan it is given the same financial data described above, plus the region/location you enter. This feature also uses an automated web search tool; your personal financial figures are used only to judge which news is relevant to you and are not placed into public search queries.

How your data is handled for these features:

• When you run one of these features, the relevant data is sent securely over TLS from our backend to Anthropic's API to generate the response. We do not use, and Anthropic does not use, your data to train AI models.
• AI-generated content is automated and may be inaccurate, incomplete or out of date. It is not financial, tax, investment, or legal advice — always verify before acting on it.
• Both features are optional, run only when you tap Refresh / Scan, and are limited to 5 generations per hour each. They are available only to Premium subscribers.
• If you'd rather your data never reach the AI provider, simply don't use these two features — every other part of SinkWise works without them.

3. How We Process Your Information

We process your information to: provide and operate the Service (your dashboard, funds, history); process subscription payments via Stripe; generate AI Insights when you request them; communicate with you about your account or security; monitor and improve the Service; and comply with legal obligations.

Your data is never sold, and never shared with any organisation or individual for their own use. No advertisers, no data brokers, no marketers — no one. We do not share your personal information for cross-context behavioural advertising, and we do not use your financial data to show you third-party advertising.

What we do use your information for is making SinkWise better: we use Google Analytics (only if you accept analytics cookies via our consent banner) and similar service tools to understand how the Service is used — which features people use, where errors happen, what's slow — solely so we can improve our services. These tools process data on our behalf and on our instructions; they are never given your data for their own purposes.

Consent boxes on sign-up are never pre-ticked. Where we ask for your consent, you must actively opt in.

4. Legal Bases We Rely On (GDPR / UK GDPR)

If you're in the EU or UK, we rely on the following legal bases to process your personal information:

• Consent — for optional analytics cookies. You can withdraw consent at any time, and withdrawal does not affect processing already carried out.
• Performance of a contract — to provide the Service you've signed up for, including Premium features.
• Legitimate interests — to keep the Service secure, detect fraud, diagnose bugs, and understand aggregate usage patterns, where those interests are not overridden by your rights.
• Legal obligations — where we need to comply with applicable law (e.g., retaining billing records).

5. Who We Share Information With

We never sell your personal information, and we never share it with any organisation or individual for their own purposes. Your information is disclosed only to the service providers ("sub-processors") we need to run and improve SinkWise. Each acts on our instructions, uses your data only to provide their service to us, and only receives as much as necessary:

• Google Firebase (Google Cloud / Google LLC) — authentication and database storage.
• Vercel — hosting and serverless functions. Processes request data such as your IP address and approximate location, and keeps short-lived server logs.
• Stripe — payment processing for Premium subscriptions, including card data we never see. Stripe is a PCI DSS-certified payment processor.
• Anthropic — powers AI Insights and AI News; processes the financial data described in Section 2 solely to generate your response, and does not train on it.
• Resend — delivers our transactional emails (verification, password reset, security alerts, billing). Receives your email address and the email content.
• Cloudflare — provides Turnstile bot/abuse protection on sign-up; may process your IP address and browser signals to confirm you're human.
• Google reCAPTCHA / Firebase App Check — if enabled, helps confirm requests come from the genuine app; Google may process device and usage signals.
• Google Analytics — usage analytics we use to understand how SinkWise is used and to improve our services. Activates only if you accept analytics cookies via our consent banner; until then it collects nothing.

We ensure each sub-processor is bound by data processing agreements that require them to protect your data. We may also disclose information if required by law, court order, or to protect the rights, property, or safety of SinkWise or others.

6. Third-Party Websites

The Service may link to other websites we don't control. We're not responsible for their content or privacy practices, and visiting them is at your own risk.

7. Cookies

We use cookies and similar technologies, described in full in our Cookie Policy. In short: essential cookies keep you signed in and can't be turned off; analytics cookies are optional and off by default until you actively accept them via our consent banner, which includes a genuine "Reject All" option.

8. Social Logins

If you choose to sign in with Google, we receive basic profile information (name, email, profile photo) from Google to set up your account. We don't control, and aren't responsible for, Google's own privacy practices.

9. International Data Transfers

SinkWise is operated from Australia, and our service providers (Google Firebase, Vercel, Stripe, Anthropic, Resend, Cloudflare and Google Analytics) are based primarily in the United States. Because SinkWise has users worldwide, using the Service means your information may be transferred to, stored in, and processed in the United States, Australia and other countries whose data-protection laws may differ from your own.

Where we transfer personal data of users in the EU or UK, we rely on the European Commission's Standard Contractual Clauses (SCCs) — or their UK equivalent — incorporated into our agreements with each sub-processor. For transfers from Australia, we apply protections consistent with the Australian Privacy Principles. By using the Service, you understand your information will be handled as described in this policy regardless of where it is processed.

10. Data Retention

We keep your personal information for as long as your account is active and for a reasonable period afterward to comply with legal obligations or resolve disputes. Specific timeframes:

• Account and financial data — retained while your account is active. If you delete your account, we will delete or irreversibly anonymise this data within 30 days, except where we are legally required to retain it.
• Billing and payment records — retained for 7 years from the transaction date, as required under applicable tax and accounting laws.
• Security logs (IP addresses, device fingerprints, sign-in events) — retained for up to 90 days for fraud prevention and security investigation purposes.
• Consent records — retained for the life of your account plus 3 years after account deletion, to demonstrate compliance.
• Analytics data — retained as aggregated, anonymised data indefinitely; identifiable event data is retained for up to 14 months per Google Analytics default settings, if you have accepted analytics cookies.

Once the applicable retention period expires, data is securely deleted or anonymised.

11. Data Security

We use reasonable technical and organisational measures to protect your information, including:

• Encryption in transit — all data transmitted between your device and our servers, and between our servers and sub-processors, is encrypted using TLS 1.2 or higher.
• Encryption at rest — data stored in Google Firebase is encrypted at rest by Google using industry-standard encryption.
• Per-user data isolation — Firestore security rules ensure no user can access another's data.
• Payment security — we never receive, store, or log full card numbers, CVVs, or magnetic stripe data. All payment card handling is delegated entirely to Stripe, a PCI DSS-certified processor.
• Access controls — access to systems that handle personal data is restricted to those who need it, protected by strong credentials and multi-factor authentication where applicable.

That said, no method of transmission or storage is 100% secure. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and, where required, notify the relevant supervisory authority within 72 hours of becoming aware of the breach.

12. Children's Privacy

We do not knowingly allow anyone under 13 to create an account. At signup, we collect your date of birth to verify your age. If you indicate you are under 13, you will not be able to complete registration — your signup will be blocked at that point. We do not retain the date of birth of users blocked from signing up.

If you are between 13 and 17, you should only use SinkWise with a parent or guardian's knowledge. Any Premium subscription requires a parent or guardian's permission and use of a payment method they control.

If we become aware — through any means — that someone under 13 has created an account or provided us personal information, we will delete that account and all associated personal information as quickly as reasonably possible, and in any case within 5 business days of confirmation.

We do not collect biometric data, precise geolocation, or any data category beyond what is necessary to provide the Service. We do not use marketing or imagery primarily designed to appeal to children under 13.

If you are a parent or guardian who believes your child under 13 has created an account, please contact us immediately via our contact page.

Teen-specific note: If you are between 13 and 17 and located in a US state with specific teen privacy protections (such as California, which treats data of users under 16 as sensitive personal information under the CPRA, or states with additional parental consent requirements), we apply heightened protections to your data consistent with those laws. We do not sell or share the personal information of users we know to be under 18, and we do not use it for targeted advertising.

13. Your Privacy Rights

Depending on where you're located, you may have some or all of the following rights regarding your personal information. We will respond to verified requests within 30 days (or within any shorter period required by applicable law).

• Right to access — you can request a copy of the personal information we hold about you.
• Right to correct — you can ask us to correct inaccurate or incomplete personal information we hold about you.
• Right to erasure ("right to be forgotten") — you can ask us to delete your personal information, subject to certain legal exceptions (such as our obligation to retain billing records).
• Right to data portability — you can request your personal information in a structured, commonly used, machine-readable format. You can already export your fund and transaction data to CSV at any time from your dashboard.
• Right to object — you can object to our processing of your personal information where we rely on legitimate interests as the legal basis. We will stop processing unless we have compelling legitimate grounds that override your interests.
• Right to restrict processing — in certain circumstances, you can ask us to restrict how we use your data (for example, while a correction request is being resolved).
• Right to withdraw consent — where processing is based on your consent (e.g., analytics cookies), you can withdraw that consent at any time without affecting the lawfulness of prior processing.

You can already do much of this yourself directly in the app:

• Export your fund data to CSV from the dashboard;
• Delete individual funds or your full account using in-app tools;
• Manage or cancel your subscription via Settings → Manage Subscription;
• Adjust your cookie preferences via the cookie consent banner.

For anything else — including a full data export, a correction request, or any right listed above — contact us via our contact page. We will respond within 30 days. If your request is complex or numerous, we may extend this by a further 30 days and will notify you of the extension.

If you're in the EU or UK and believe we're processing your data unlawfully, you have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, or the relevant EU supervisory authority in your member state).

14. Global Privacy Control and Do-Not-Track Signals

Global Privacy Control (GPC): If your browser or browser extension sends a Global Privacy Control signal, we will treat it as a request to opt out of the sale or sharing of your personal information. Because we do not sell or share personal information for advertising purposes, this signal has no effect on how we process your data — but we acknowledge and honour it.

Do Not Track (DNT): Some browsers send a "Do Not Track" signal. There is currently no uniform legal standard for how websites must respond to DNT. We don't currently differentiate responses based on DNT signals, but we honour GPC as described above.

15. California and US State Privacy Rights (CCPA / CPRA)

This section applies to residents of California and other US states with comprehensive consumer privacy laws. SinkWise is a small, early-stage service and does not currently meet the CCPA's revenue or data-volume thresholds that would make compliance mandatory. However, we believe your privacy rights matter regardless of those thresholds, and we will honour the rights described below to all users.

Categories of personal information we collect (as defined under CCPA):

• Identifiers (email address, IP address, account ID)
• Personal records (financial data you enter, billing records)
• Internet or other electronic network activity information (usage and analytics data, if consented)
• Geolocation data (city/region-level, derived from IP address)
• Inferences drawn from the above (AI Insights, if used)

Purposes for collection — to provide and operate the Service, process payments, secure your account, improve the product, and comply with legal obligations. We do not collect personal information beyond what is reasonably necessary for these purposes.

We do not sell or share your personal information for cross-context behavioural advertising. Accordingly, we do not offer a "Do Not Sell or Share My Personal Information" opt-out link — because there is nothing to opt out of. If this changes, we will update this policy and add the required link before doing so.

Global Privacy Control: We honour GPC browser signals as described in Section 14.

Sensitive personal information: We treat personal information relating to users we know or have reason to believe are under 16 years of age as sensitive personal information, and we do not sell or share it.

Your rights under CCPA / CPRA and similar state laws:

• Right to know — you can request information about the categories and specific pieces of personal information we have collected about you.
• Right to delete — you can request deletion of personal information we have collected from you, subject to legal exceptions.
• Right to correct — you can request correction of inaccurate personal information.
• Right to opt out of sale/sharing — not currently applicable (we do not sell or share).
• Right to non-discrimination — we will not discriminate against you for exercising any privacy right.

To make a request, contact us via our contact page. We will verify your identity before processing the request and respond within 45 days, with a possible extension of 45 additional days where reasonably necessary. Residents of Virginia, Colorado, Connecticut, Texas, and other states with similar comprehensive privacy laws may exercise the same rights. We may ask for information to verify your identity before fulfilling a request.

16. Australian Privacy Rights

SinkWise is operated from Australia, and we handle personal information in line with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) to the extent they apply. You may ask us to access or correct your personal information at any time. If you believe we've mishandled your personal information, you can complain to us first via our contact page, and if you're unsatisfied with our response, you can escalate to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

17. Changes to This Policy

We may update this policy from time to time. We'll update the "Last updated" date above, and material changes will be flagged in-app or by email. Continued use of the Service after a revised version is posted constitutes acceptance of the changes.

18. Contact Us

Questions about this policy or how your information is handled? Contact us via our contact page.

Evan Paul Lazar (ABN 76318734086), trading as SinkWise
our contact page