Privacy Policy

Mr. Fino is a financial-education product operated by RETURNX EDUMODE LLP (“we”, “us”, “our”), registered at Chennai, Tamil Nadu, India.

This Privacy Policy covers the Mr. Fino website and the Mr. Fino mobile app for iOS and Android — both run on the same account and the same backend. It explains what data we collect, why we collect it, how we keep it safe, and what choices you have. By using Mr. Fino, you agree to this policy.

We only collect the data needed to run the product:

• Account data — name, email, password (hashed), phone number (if you verify it) and email-verification status.
• Personal details — date of birth, dependants, city, occupation. You enter these once and can edit them anytime.
• Assessment inputs — your income, expenses, savings, debt, insurance and habit answers. Used only to compute your Mr. Fino score and personalise your report and action plan.
• Messages you send us — questions submitted through the “Ask Mr. Fino” bubble, the contact form, quote or help requests, and live-chat messages in the app. Our team reads these to respond to you.
• Game activity — level progress, answers, scores and money-saved figures from the in-app money games, so your progress syncs across devices.
• Payment records — if you buy a paid plan: the plan, amount, payment status and the payment reference from our payment processor. We never see or store your card, UPI or bank credentials (see “Payments” below).
• Push notification tokens — if you enable notifications in the app, a device push token so we can deliver alerts. Removed when you sign out or disable notifications.
• Usage telemetry — basic device, browser and page-view information so we can debug issues and improve the product.
• Activity & security logs — records of key account actions (such as logins, profile changes and payments) including your IP address and device/browser user agent, used for security, fraud prevention and support. Retained for up to 180 days.

We do not ask for your bank login, scrape your bank statements, or pull data from any third-party financial provider.

Strictly to operate Mr. Fino:

• Compute your 0–100 Financial Health Score and breakdowns.
• Generate your personalised report, action plan and progress history.
• Send transactional emails (verification, password reset, score summary) and — if you have the app with notifications on — helpful nudges about your score, games and requests. You can turn app notifications off in your device settings at any time.
• Process paid-plan purchases and issue invoices.
• Respond to your messages and support requests.
• Diagnose bugs and improve the product.

• We never sell your data.
• We never share your data with advertisers.
• We never read your bank account or credit-card statements.
• We never store your card, UPI or banking credentials — payments are handled entirely by our payment processor.

Your account and assessment data is stored on managed MongoDB Atlas infrastructure with encryption at rest. All traffic between your browser or app and our servers uses HTTPS/TLS. Passwords are hashed with bcrypt (12 rounds) — we cannot read them, even internally.

Web sessions use HttpOnly JWT cookies issued via NextAuth, which protects against XSS-based token theft. The mobile app authenticates with short-scope bearer tokens kept in your device's secure storage (Keychain on iOS, Keystore on Android). Every request to our API is validated server-side with strict schemas before it touches the database.

The app also keeps a small local cache of your own data on your device (your sections, score and game progress) so screens load instantly; it is scoped to your account and cleared when you sign out.

Paid plans are processed by Razorpay. Your card, UPI or bank details go directly to Razorpay and never touch our servers — we receive only the payment reference, amount and status needed to activate your plan and issue an invoice. Invoices are issued by RETURNX EDUMODE LLP. See Razorpay's privacy policy for how they handle payment data.

We rely on a small number of vendors to run the service. Each receives only what it needs and is bound by its own contractual privacy terms:

• MongoDB Atlas — encrypted database hosting.
• Vercel — application hosting and CDN.
• Resend — transactional email delivery (account verification, password reset, score summary).
• Wacto — WhatsApp delivery of one-time passcodes. Your phone number is shared with Wacto only to send the OTP when you verify or sign in by phone.
• Razorpay — payment processing for paid plans (see “Payments” above).
• Expo — push-notification delivery for the mobile app (your device push token is shared to deliver alerts).

We do not run third-party advertising or analytics scripts that identify you personally.

We use first-party cookies only:

• Authentication — an HttpOnly session cookie that keeps you signed in on the web.
• Referral attribution — if you arrive through a partner's link, a mrfino_ref cookie remembers the partner's code for 30 days so the referral can be credited if you sign up or contact us (see “Referrals” below).
• Preferences — small conveniences such as remembering a dismissed banner.

We do not use third-party tracking cookies.

Mr. Fino has a partner programme. If you reach us through a partner's referral link (or enter their code at signup), we record which partner referred you. That partner can see that their referral converted — including the basic contact details you provide on signup or in a referred enquiry — so we can credit them. Partners never see your assessment inputs, score details, messages or payment information.

The in-app money games store your level progress and scores so they sync across devices. The leaderboard is pseudonymous by design: other players see a generated handle (like “Player #12345”) and your scores — never your name, email or any personal detail.

You can access and edit your data from your account settings on the web (/my/settings) or in the app. The same screen has a Danger Zone where you can deactivate or permanently delete your account yourself — no email or support ticket needed. You can still write to hello@mrfino.com if you would rather we did it for you; we act on those requests within 30 days.

Deactivating pauses your account: notifications stop and your profile goes quiet, but nothing is deleted. Sign back in at any time and we will offer to reactivate it.

Deleting happens immediately, and cannot be undone. We confirm it with a code sent to your registered email (and WhatsApp, if your number is verified), then erase your assessments, reports, plan, requests, support and community messages, notifications, personal details, game progress, activity logs and the account record itself. Messages you posted in a community group remain in place as “deleted message” placeholders so other members’ conversations stay readable, with your name and content removed.

Two things deliberately survive. Paid invoices are kept as long as tax law requires, with your account reference and payment metadata stripped so they can no longer be linked back to you. And we keep a single record of the deletion itself — your name, email address and phone number, plus the dates the account was opened and closed and who closed it — so we can show that the request was honoured. Aggregated, fully-anonymised analytics may also be retained. Activity and security logs for accounts that have not been deleted (including IP address and device/browser user agent) are kept for up to 180 days for security, fraud prevention and support, then deleted.

Mr. Fino is intended for users 18 or older. We do not knowingly collect data from anyone under 18.

If we make material changes, we'll update the effective date at the top of this page and notify signed-in users by email when appropriate. Continued use after a change means you accept the updated policy.

Questions about this policy? Email hello@mrfino.com or visit our contact page.