Anfin privacy policy
Last updated 22-10-2026. Managed by PT Anvers Semesta Digital as the personal data controller under Indonesia's Personal Data Protection Law (UU No. 27 of 2022).
Data we collect
- Account: name, email, password (stored as a hash), or your Google account ID if you sign in with Google.
- The financial records you enter: transactions (amount, category, wallet, date, note), budgets, savings goals (including shared goals you join), and split bills (title, items, and the names & contacts of friends you write down).
- Receipt text read from the photo on your phone. The receipt photo is only sent to our servers if you turn on "Save receipt photo".
- Payment details you save (bank or e-wallet name, account or phone number, account holder name, QRIS image), shown on the split bill links you choose.
- Files you import (CSV or Excel) are read on the server and then discarded; what was read is kept encrypted for at most 24 hours, until you import or cancel it. PDF statements are read on your phone and only their text is sent.
- Conversations with Anfin AI, the suggestions it makes, and how much AI you use.
- Automatic recording (when you turn it on): Anfin reads transaction notifications from the bank, e-wallet and paylater apps you choose on your phone. The notification is read on the phone; only the type, amount, a short description (merchant or recipient name, without account, card, or phone numbers), time, and the app's name are sent to the server. Notifications from other apps and OTP codes are never read or stored.
- Device notification tokens (Firebase Cloud Messaging) and notification preferences.
- Plan and subscription: the plan you use, its status and validity. If you subscribe through Google Play, we store Google's purchase token encrypted to check its status; we never receive your card or payment method details.
How the data is used
- Running Anfin's features: recording, calculating balances, budgets, goals, reports, and split bills.
- Sending the notifications you turn on (spending reports, budget alerts, reminders).
- Keeping accounts secure and preventing abuse.
- Managing plans and helping you: Anfin's operators can see your name, email, plan, and usage counts (e.g. how many transactions or AI calls, without their content) in the admin panel, which only admin accounts with two-step verification can open. Financial records, balances, and chat content cannot be opened from that panel, and every plan change by an admin is logged.
- Monitoring the service: statistics (the number of new users, the number of transactions recorded per day without their amounts, and AI usage) and a random code per account when you sign up are sent to Anvers, an internal panel of Anfin's operator. Your name, email, amounts, and financial notes are never sent.
We don't sell your personal data and don't use it for advertising.
Processing by a third-party AI provider
AI features (automatic categories, receipt reading, the assistant, and report suggestions) send transaction notes, receipt text, category names, amounts, and dates to DeepSeek, an AI provider whose servers are outside Indonesia. We never send emails, phone numbers, bank account or card numbers, or the names of friends in split bills; long numbers and emails in receipt text are removed before sending. All financial figures are calculated by our system, not by the AI.
When you import data with "Help with AI", column titles, a few sample rows, statement text and transaction descriptions are sent to DeepSeek after long numbers (accounts, cards, phone numbers) and emails are removed; names in descriptions may be sent too. Without that consent, imports still work without AI.
For transactions from automatic recording, the short description (e.g. a merchant or recipient name) may be sent to DeepSeek to guess the category when AI features are on. Categories you change are remembered on the server as a random code, not as the description text.
Attachments in AI Chat (photos, PDFs, Excel/CSV) are read on your phone, or on our server for Excel/CSV. Only their text is sent to DeepSeek, after long numbers (accounts, cards, phones) and emails are removed. The original file is not stored; the text is stored encrypted with the conversation so you can ask follow-up questions.
Voice input in AI Chat uses the speech recognizer on your phone (e.g. Google's service). Anfin never receives the recording; it appears as text you can check before sending. Transactions you mention in AI Chat (e.g. "lunch 15000") are recorded right away like any other entry and can be edited or deleted.
You can turn AI features off at any time in Settings. Anfin's core features keep working without AI.
Storage and security
- Data is stored on servers in Indonesia. Transaction notes, split bill participant names, and the numbers and holder names in your payment details are encrypted in the database.
- Receipt photos and QRIS images are stored privately with a cloud storage service (Cloudflare R2) whose servers may be outside Indonesia, without photo location data, and can only be opened through temporary links that last 10 minutes.
- Daily database backups are stored encrypted in private cloud storage and deleted after 14 days.
- On your phone, the sign-in token is stored encrypted and the app is locked with a PIN or fingerprint.
- Notifications are delivered through Firebase Cloud Messaging (Google).
Your rights
- Access & export: download all your transactions as CSV in Settings → Export data.
- Correct: edit or delete records directly in the app.
- Delete: Settings → Delete account sends a 6-digit code to your account's email (valid for 10 minutes). Your account and all your data are permanently deleted once you enter that code in the app.
- Withdraw AI consent: turn off AI features in Settings.
- Turning off automatic recording: in Settings → Automatic recording or in your phone's Notification access settings.
Can't open the app any more? You can also request deletion at https://anfin.id/hapus-akun with the same code from your email.
Split bill
Anfin never moves money. A split bill link only shows the bill to the people you send it to, and stops working when the split bill is deleted.
If you choose payment details for a bill, the full number and holder name are shown on that link until every friend has paid. A receipt photo you saved is also shown on that link, and is deleted automatically 30 days after the bill is settled or when the split bill is deleted.
If you photograph a receipt to record your own spending and turn on "Keep receipt photo", the photo is kept with that transaction and only you can see it, including when the transaction is in a shared wallet. It is deleted when you delete the photo or the transaction.
Shared goals and wallets
When you join a shared goal, its members can see your display name, your deposits into that goal (amount and date), and the target share that applies to you. Your wallets, budgets, transactions and other personal goals are never visible to them.
When you join a shared wallet, its members can see your display name and every transaction in that wallet, including notes, who recorded them, and its recurring transactions. When you turn an existing wallet into a shared wallet, its earlier transactions become visible to the members too.
If you delete your account, the transactions you recorded in shared wallets owned by others remain only as numbers (amount, date, type, currency and a built-in category) without your name or notes, so balances do not change suddenly. Your deposits into shared goals owned by others still count without your name. Notifications that mention your name are removed from the other members, and shared goals or wallets you own pass to the member who joined first.
Household
When you create or join a household, its members can see your display name, your role (manager or member) and when you joined, as well as the household's name, kind, tagline and photo. A family photo uploaded by a member is stored privately without location data, is seen only by that household's members, and is deleted when it is replaced or removed, or when the household is dissolved. Your personal wallets, budgets, transactions and goals are never visible to them unless you share them yourself.
An account can belong to one household only, and a household has at most 8 members. Members can leave at any time; managers can remove members or dissolve the household. When a household is dissolved it is deleted; wallets and goals shared with it stay as shared wallets and goals with the same members, and their owners can remove the other members at any time.
The household agenda (title, date, time, place, note and amount), the shopping list (item names, quantities, who added and who bought them) and shared notes are visible to every household member; agenda titles and notes, item names and shared notes are stored encrypted. Shopping items recorded as an expense become a transaction in the household wallet under the buyer's name. A household budget made by a manager counts the spending of every member in the household wallets. When the household is dissolved, its agenda, shopping list and notes are deleted and household budgets are deactivated.
If you delete your account, your household membership is removed and the notifications naming you are deleted from the other members. The agenda and shared notes you added stay for the other members without your name or their text; items you added to the shopping list stay without your name. If you are the last manager, the role passes to the member who joined first; a household left without members is deleted too.
Contact
Questions or requests about personal data: