Privacy Policy
Last updated: August 7, 2026
Fond (“we”, “us”) is a private money tracker available at infond.app and inside Telegram as a mini app and chat bot. This policy explains what data Fond handles, what we can and cannot see, and the choices you have. It applies to the web app, the Telegram mini app and the bot together.
This document is originally written in English. Translations are provided for convenience; if a translation differs from the English version, the English version prevails.
The short version
- Your amounts are end-to-end encrypted. They are sealed on your device before being sent; our servers store ciphertext they cannot decrypt or do arithmetic on.
- Titles, categories, dates and currencies are not encrypted. That is a deliberate design: it is what lets the bot file records from a chat message and send you reminders. Never put sensitive details in a title or comment.
- We do not sell your data, and we do not show ads.
- We cannot recover your encryption key. If you lose your devices and your recovery key, your encrypted data is gone — for everyone, including us.
What we collect
Account identity
Depending on how you sign in, we receive and store:
- Telegram — your Telegram ID, first and last name, username, profile photo URL and language.
- Google — your Google account ID, email address, name and profile picture.
- Apple — your Apple account ID, email address (which may be Apple’s private relay address) and, on first sign-in, your name.
Accounts from different providers with the same verified email are treated as one account. We never see passwords — sign-in is handled by the provider.
Your financial records
Fond stores the records you create: vaults, goals, debts, subscriptions, income and spending entries.
| End-to-end encrypted (we cannot read) | Stored in readable form (we can read) |
|---|---|
| Every amount — balances, transactions, goal targets, debt sums. Encrypted on your device with keys derived from your master key; the server holds ciphertext only. | Titles, descriptions and comments; categories; dates; currency codes; the structure of your data (how many vaults, which records exist, sharing relationships). |
The readable part is what makes Fond work as a product: the assistant needs the text of your message to file a record, and reminders need to know what is due and when. The amounts — the part that describes your wealth — stay sealed.
Keys and devices
Your master encryption key is generated on your device and never sent to us. We store a device identifier and a device public key per session to let your devices exchange shared-item keys securely, and an encrypted queue of pending changes (encrypted at rest with a server-side key) to sync the bot and the app.
Settings and technical data
Display currency, language, notification preferences, timezone (from your device, to time reminders), and standard technical logs (IP address, request metadata) kept for security and abuse prevention.
How we use data
- To run the service: storing records, computing what only your device can compute, syncing your devices.
- To send reminders and digests you have enabled (subscription renewals, debt payments, weekly summaries).
- To parse messages you send the bot into records (see AI processing below).
- To operate Fond Pro subscriptions and the referral programme.
- To keep the service safe: rate limiting, abuse detection, debugging.
AI processing
When you send the bot a message like “coffee 4.50”, the text of that message is sent to Anthropic (Claude) to be turned into a structured record. When you send a voice message (a Pro feature), the audio snippet is sent to OpenAI for transcription first. These providers process the content to provide the feature; your encrypted amounts are never part of what they receive from stored data — only what you chose to say in the message itself.
Service providers
We share the minimum needed with providers that run parts of the service:
- Telegram — the platform the bot and mini app run on; also processes Fond Pro payments (Telegram Stars). Telegram’s own privacy policy applies to your use of Telegram.
- Google / Apple — sign-in, when you choose them.
- Anthropic — assistant message parsing. OpenAI — voice transcription.
- CoinGecko — crypto exchange rates. Receives currency pairs only, never your records.
- Brandfetch — logo search for subscriptions. Receives the name you type in the logo search.
- Cloudflare and our hosting provider — network delivery and servers.
We do not sell personal data and do not share it with advertisers.
Sharing between users
Vaults, goals and debts can be shared. Members of a shared item see its title, records and amounts (shared items are encrypted with a key held by every member). If you leave or are removed, the item stays with the remaining members; your own copy of the history does not vanish from theirs.
Cookies
Fond uses a session cookie (access_token) to keep you signed in and a locale cookie for language. There are no advertising or cross-site tracking cookies.
Retention and deletion
Your data is kept while your account exists. Settings → “Wipe everything” permanently deletes every record only you can decrypt, immediately and irreversibly; shared items remain with their other members, with you removed. Technical logs are kept for a short period and rotated. Because we cannot decrypt your amounts, there is no way for us to hand them over — to anyone — in readable form.
Your rights
Depending on where you live, you may have rights to access, correct, export or delete your personal data, and to object to processing. Most of these you can exercise directly in the app (edit records, change settings, wipe your data). For anything else, contact us at [email protected] and we will respond within 30 days.
Children
Fond is not directed at children and may not be used by anyone under 18.
Changes
We will update this policy as the product evolves and change the date at the top. For material changes we will notify you in the app or via the bot before they take effect.
Contact
Questions about privacy: email [email protected]. See also the Terms of Service.