Privacy Policy
Last updated: 23 October 2026
1. What we collect
- Account details you give us: name, username, email address, date of birth, gender and phone number.
- Financial information you enter: accounts, balances, transactions, budgets, goals and the reports generated from them. Fmaps does not connect to your bank; these figures are only what you type or import.
- Optional profile photo, if you upload one.
- Contact form details: your name, email address, phone number, country and city, and the message you send us.
- Technical data: IP address, browser and device information, and the pages you visit. Our web server keeps standard request logs for security and troubleshooting.
- Product usage: which actions you take inside Fmaps - confirming your email, signing in, adding an account, transaction, budget or goal, exporting or importing data. These records are kept in our own database, tied to your account, and hold no balances or transaction amounts. We use them to see whether the product works and where people get stuck; they are deleted after six months.
- Cookies: a session cookie, an anti-forgery cookie, a recent-accounts cookie and analytics cookies. Section 2 lists each one, what it does and how long it lasts.
2. Cookies and similar technologies
A cookie is a small text file a site asks your browser to keep. Fmaps uses three first-party cookies and, when an analytics measurement ID is configured, two Google Analytics cookies. None of them holds a balance, a transaction or any other financial record, and none is used for advertising.
| Cookie | Set by | What it does | Category | Lasts |
|---|---|---|---|---|
sessionid |
Fmaps | Identifies your signed-in session so you are not asked to log in on every page. | Necessary | 12 hours, refreshed as you use the site |
csrftoken |
Fmaps | Proves a form submission came from Fmaps rather than from another site acting as you. | Necessary | 1 year |
fmaps_recent_accounts |
Fmaps | Remembers the account names last used on this browser, so the sign-in page can offer them. It is signed so it cannot be edited, and contains no password and no session key. | Functional | 30 days |
_ga |
Tells one visitor apart from another, so visits and page popularity can be counted in aggregate. | Analytics | Up to 2 years | |
_ga_<id> |
Keeps a visit together as you move between pages. | Analytics | Up to 2 years | |
cf_clearance _cfuvid |
Cloudflare | Set only when the CAPTCHA runs on the sign-up or sign-in form, to show a person completed it rather than a script. | Necessary (security) | Session up to 30 minutes |
Necessary cookies
These are required for the Service to work: without sessionid you cannot
stay signed in, and without csrftoken forms cannot be submitted safely.
They are not switched off through Fmaps, though your browser can block them — the
Service will then not work.
Functional cookies
fmaps_recent_accounts lets the sign-in page list the accounts last used
on this browser. Clearing it only removes those shortcuts.
Analytics cookies
Analytics is enabled only when a measurement ID is configured for the deployment, and
for visitors outside the European Economic Area and the United Kingdom it is
on by default. The Google Analytics tag then loads with the page and
sets _ga and _ga_<id>. You can turn it off at any time
in
Settings → Privacy; the choice is stored in
this browser and the tag is not loaded again while it is off.
Visitors in the EEA or the UK are asked first: a notice appears until you choose, and nothing is measured and no analytics cookie is set until you allow it. Allowing or declining changes nothing else about the Service.
The tag is configured to remove query strings, so search terms never reach the report, and to disable Google signals and ad personalisation, so this traffic cannot build advertising audiences. Google processes this data in the United States; see section 4.
How to control cookies
- Analytics: switch it off in Settings → Privacy — no account changes and no loss of features.
- Every browser also lets you block or delete cookies for a site; look for "cookies" or "site data" in its settings.
- To opt out of Google Analytics across all sites, install Google's Analytics Opt-out Browser Add-on.
- Deleting the necessary cookies signs you out; deleting the others only resets a preference.
Fmaps does not use cookies to profile your financial activity, and does not share cookie data with advertisers or data brokers.
3. Why we collect it
- To create and secure your account, including confirming your email address.
- To provide the Service: store your records and produce dashboards, forecasts and statements.
- To protect the Service against fraud, abuse and automated attacks.
- To send service messages such as password resets and security notices.
- To reply to questions, feedback and media enquiries submitted through the contact form.
- To understand and improve how the Service is used, in aggregate.
We do not sell your personal information, and we do not use your financial records for advertising.
4. Who we share it with
We use service providers that process data on our behalf, under contract and only for the purposes above:
- Amazon Web Services (SES, Sydney region) — delivery of transactional email.
- Heroku / Salesforce — application hosting and database.
- Google Analytics — only if an analytics measurement ID is configured. The tag is coded not to send account balances, transaction data or search terms, and advertising signals are disabled.
- New Relic — application and browser performance monitoring: request timings, errors, page-load timing and the browser/device making the request, used to keep the Service fast and to notice failures. The browser agent sets no cookies (New Relic removed them in agent v1220); it derives an approximate country or city from your IP address, which New Relic does not retain, and it never receives account balances, transaction data or page content.
Some providers store data outside Australia (for example, Heroku in the United States). Where that happens we take reasonable steps to ensure the information is handled consistently with the Australian Privacy Principles.
We may also disclose information where required by law or a court order.
5. How long we keep it
We keep your account and financial records while your account is open. If you archive your account, access is paused but your records are retained so you can reactivate the account later and so Fmaps can continue to analyse financial behaviour. Archived records are not automatically deleted. Server and security logs are kept for a shorter period.
6. Your choices and rights
- Access and export: download a machine-readable copy of your data at any time from Account → Export my data.
- Correction: most details can be edited in your profile and settings; contact us if something cannot be changed there.
- Archive and reactivation: pause access from Account → Archive my account, and request reactivation later through the emailed confirmation link.
- Analytics opt-out: turn analytics cookies off in Settings → Privacy, or block them in your browser. Neither affects your ability to use the Service.
7. How we protect it
Data is encrypted in transit (HTTPS), passwords are stored using Django's salted password hashing, and access to production systems is restricted. Sign-in is rate limited and, where configured, protected by a CAPTCHA. No system is perfectly secure, but we work to keep these protections current.
8. Children
The Service is intended for people aged 18 and over. We do not knowingly collect information from children.
9. Complaints and contact
Questions or complaints about privacy can be submitted through our contact page at https://www.fmaps.tech/contact/. We will respond within a reasonable period, normally 30 days. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.