Privacy Policy

Our Commitment to Privacy

At Nyphex, we take your privacy seriously. This Privacy Policy explains how we collect, use, protect, and share your personal information when you use our personal finance platform. We are committed to transparency and giving you control over your data.

What Data We Collect

Account Information

• Email address: Required for account creation and login
• Name: Optional, used for personalization
• Password: Encrypted using bcrypt (10 rounds) - we never store plain passwords
• Two-Factor Authentication (2FA): Optional TOTP secret for enhanced security

Financial Data

• Transactions: Date, amount, merchant, category (user-entered or imported)
• Accounts: Institution name, account type, masked account numbers (last 4 digits only)
• Budgets: Budget amounts and categories
• Investments: Holdings, symbols, quantities (optional)

What We DON'T Collect

Bank Connections (Plaid Integration)

When you connect your bank account using Plaid:

• Encrypted Tokens: Plaid access tokens are encrypted using AES-256-GCM before storage
• Data Minimization: We only access transaction data, account balances, and institution names
• User Consent: You explicitly authorize the connection through Plaid Link
• Right to Disconnect: You can disconnect your bank at any time, which revokes all access

Document Upload Privacy

We use industry-leading privacy protection for document uploads:

Privacy-First Processing

1. Local Text Extraction: We first attempt to extract text locally (no cloud processing)
2. Automatic PII Detection: We scan for 15+ types of PII including:
   • Names, addresses, phone numbers
   • Social Security Numbers
   • Bank account numbers, credit card numbers
   • Email addresses, IBANs, sort codes
3. Human-in-the-Loop Review: If PII is detected, YOU review and approve before cloud processing
4. PII Redaction: Detected PII is automatically redacted (e.g., "123-45-6789" to "XXX-XX-XXXX")
5. Encrypted Storage: Original documents stored encrypted in our secure storage

How We Use Your Data

We use your data solely for the following purposes:

• Core Service: Provide personal finance tracking, budgeting, and reporting
• AI Analysis: Generate insights, detect anomalies, and provide personalized recommendations
• Document Processing: Extract transaction data from receipts and statements
• Notifications: Send budget alerts, bill reminders, and unusual spending warnings (if enabled)
• Security: Detect fraud, prevent unauthorized access, and maintain audit logs

What We DON'T Do

How We Protect Your Data

Encryption

• In Transit: All data transmitted over HTTPS/TLS 1.2+ encryption
• At Rest: Sensitive data encrypted using AES-256-GCM (Plaid tokens, documents)
• Passwords: Hashed using bcrypt with 10 salt rounds (industry standard)
• Database: SSL connections, parameterized queries (SQL injection protected)

Security Measures

• Rate Limiting: 5 login attempts per 15 minutes (prevents brute force)
• Two-Factor Authentication: Optional TOTP (Google Authenticator, Authy)
• Trusted Devices: Remember secure devices to reduce 2FA prompts
• Security Headers: CSP, X-Frame-Options, HSTS configured
• Audit Trail: 7-year activity logs for compliance and security

Data Retention & Deletion

Retention Periods

• Transaction Data: Retained until you delete your account
• Documents: Retained until you delete them or your account
• Audit Logs: 7 years (legal/compliance requirement)
• Webhook Events: 90 days
• Sync History: 180 days (6 months)

Automated Cleanup

We automatically delete old temporary data to minimize storage:

• Failed job logs after 30 days
• Resolved duplicate notifications after 30 days
• Old exchange rate data after 365 days

Your Privacy Rights (CCPA)

California Residents: You have additional rights under CCPA. Contact us at support@nyphex.com to exercise your rights.

Third-Party Services

We integrate with the following third-party services:

Cookies & Tracking

We use minimal cookies for essential functionality:

• Authentication Cookie: Stores your login session (JWT token)
• Preference Cookie: Remembers your theme, language, and settings
• Security Cookie: CSRF protection

We do NOT use: Third-party analytics, advertising trackers, or social media pixels.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Email notification to your registered email address
• In-app notification when you next log in
• Updating the "Last Updated" date at the top of this page

Contact Us

If you have questions about this Privacy Policy or how we handle your data: