Privacy Policy

Who is responsible

Luis Alvarez, who operates Monfly in Mexico, is responsible for your personal data (“we”, “us”). For anything about your data, write to mrluisfeer@gmail.com.

What we collect

• Your account: your email address, your name if you give it, the identifier of your sign-in with Auth0, a seed that draws your generated avatar, your preferred currency, and when your account was created and last changed. We never see your password: Auth0 handles it. If your account comes from Monfly’s first version, we also keep that version’s one-way hash of your old password so its sign-in keeps working; a hash can’t be turned back into the password.
• What you enter: your accounts (their names, kind, issuer, colour and balances), transactions (amount, category, description, date and time, and the account), transfers between your accounts, balance corrections, loans (the other person’s name, amounts, dates, notes, payments, increases and changes of due date), your monthly budget and category limits.
• Your settings: your preferences, the colours you choose, the shortcuts in your header and a history of your changes to them (which shortcut, when and from where), and your dashboard choices.
• Technical data: your time zone; and what every web request carries, such as your IP address and browser, which our hosting provider handles to deliver the site and may keep in its logs for a limited time. When something fails, we log a reference to the error and the address that failed.

We don’t ask for card numbers, passwords to your bank, access to your bank, government identification numbers, or any sensitive personal data (datos personales sensibles) as the law defines it. Please don’t enter them in Monfly’s free-text fields.

Your financial data

The balances, amounts and loans you enter are financial and patrimonial data, which the law lets us process only with your express consent. You give it by creating your account and entering them, having been shown this notice. You can revoke it at any time, as described in Your rights.

Why we use it

Only to provide Monfly to you:

• to create and run your account, and sign you in;
• to store your records and show them back to you, with the figures, charts and statements drawn from them;
• to keep your settings the same on every device;
• to keep the Service secure, prevent abuse and fix errors;
• to answer your requests and messages, and tell you about changes to Monfly or to these documents;
• to meet legal obligations, and to establish or defend our rights.

We have no secondary purposes: we don’t use your data for advertising, marketing, profiling or selling. If that ever changes, we’ll ask you first, and saying no won’t cost you access to Monfly.

Who else handles it

We rely on providers that process personal data only on our behalf and following our instructions:

• Auth0 (Okta, Inc.), for sign-in and account security;
• Neon, the database where your account and records are stored;
• Vercel, which hosts and delivers the site and the app.

These providers may store and process data outside Mexico, including in the United States. We don’t sell, rent or share your personal data with anyone for their own purposes. We disclose it to authorities only when the law requires us to.

Cookies and browser storage

Monfly uses only the cookies it needs to work: no advertising, analytics or tracking cookies, and no third-party trackers.

Cookie	What it’s for	How long
Sign-in session	Keeps you signed in. Set by the sign-in (Auth0), encrypted, and unreadable by the page.	Until you log out or the session expires
Sign-in transaction	Protects the round trip to the sign-in page and back.	Minutes
tz	Your time zone, so months are drawn where you live.	One year
preferences	A copy of your settings, so a page is drawn right before it loads.	One year
income-view	The period and split you chose for the dashboard’s Income card.	One year
accounts-left-out	The accounts you left out of the dashboard’s total.	One year

In your browser’s storage, Monfly also keeps your choice of theme, a transaction you’re halfway through writing (so a reload doesn’t lose it), the tips you’ve dismissed and whether you’ve taken the tour. The installed app keeps a copy of Monfly’s own files so it can open offline, and never a copy of your records.

You can delete cookies and storage in your browser’s settings at any time. Without the sign-in session you’ll be signed out, and without the others Monfly simply forgets those choices.

How long we keep it

We keep your data while your account is open. If you ask us to delete your account, we delete it and your records within the times given below, except anything the law obliges us to keep. Copies in our providers’ backups are overwritten on their own schedule and aren’t used for anything in the meantime. Providers’ logs are kept for the limited time each provider sets.

Your rights

Under Mexican law you can access your personal data, rectify it if it’s wrong, cancel it (have it deleted) and oppose its use for particular purposes, the rights known as ARCO. You can also revoke your consent, and ask us to limit how your data is used or disclosed. You can see and change much of it yourself in Monfly at any time.

To make a request, write to mrluisfeer@gmail.com from the email address of your account (or otherwise show that the account is yours), saying what you’d like and which data it concerns. If you’re acting for someone else, include proof that you can. We’ll answer within 20 business days of receiving your complete request and, if we grant it, make it effective within the following 15 business days. Exercising these rights is free; you’d pay only for any cost of copying or sending, if there is one.

Monfly can’t work without your data, so revoking your consent or deleting your data means we can no longer provide the Service to you. If you think we’ve mishandled your data, you can complain to Mexico’s data protection authority.

How we protect it

Everything travels encrypted (HTTPS). Your session lives in an encrypted cookie the page can’t read, your password is handled by Auth0, and every request checks who you are before it returns anything, so your records are only ever returned to your account. No system is perfectly secure: if a breach significantly affects your rights, we’ll tell you without delay, as the law requires.

Children

Monfly is for people aged 18 and over. We don’t knowingly collect data from anyone younger; if you believe someone under 18 has an account, tell us and we’ll delete it.

Changes to this policy

We may update this policy, for example when Monfly or the law changes. We’ll publish the new version here with its date and, for significant changes, tell you in the Service or by email.

Contact

For anything about your data or this policy, write to mrluisfeer@gmail.com. See also the Terms of Service.