Privacy Policy

The Better Decision (“we”, “us”) is a personal finance application operated by FJ Cloud & AI Consulting. We care about your privacy and keep what we collect to the minimum needed to run the service. This policy explains what we collect, why, how long we keep it, and your rights.

1. What we collect

When you create an account and use The Better Decision, we collect:

• Identity: username, email, first/last name, optional phone and avatar URL.
• Credentials: a bcrypt hash of your password (we never store the password itself). For Google sign-in, we store the verified email address Google provides. If you enable two-factor authentication, we store an encrypted TOTP secret and hashed recovery codes.
• Financial data you enter: accounts you create, transactions you record or import, budgets, forecasts, recurring items, and categories. This data stays scoped to your organization and is never shared with other organizations.
• Operational telemetry: request logs containing IP address, user agent, path, and timestamp for up to 7 days, used for debugging and abuse prevention. Performance metrics and traces without personal data go to our monitoring provider (section 3).
• Cookies: an HTTP-only refresh-token cookie to keep you logged in, a short-lived oauth_state cookie issued during Google sign-in (deleted within 10 minutes of the sign-in flow completing or being cancelled), a theme preference in local storage, and a bot-management cookie set by Cloudflare. On our public marketing pages (never once you are signed in to the app), we use Google Analytics 4. It runs only after you opt in: a consent banner lets you accept or reject, and until you accept, Google Analytics is loaded in a consent-denied mode (Google Consent Mode v2) that sets no _ga / _ga_* cookies. If you accept, those first-party cookies measure aggregate, anonymized visitor traffic; we do not use this data for advertising. Your choice is stored in a tbd-consent-v1 local-storage entry and re-requested every six months. You can change or withdraw it anytime via the “Cookie preferences” link in the page footer.

2. Why we collect it

• To authenticate you and protect your account.
• To store and present the financial data you explicitly enter.
• To run the AI features your organization turns on (section 4).
• To send transactional emails: account verification, password reset, MFA codes, and trial/billing notices.
• To debug errors, prevent abuse, and secure the service.

We do not sell your data. We do not train AI models on your data. We do not use your data for advertising.

3. Third parties we share with

We share data only with service providers strictly necessary to run The Better Decision:

• Hetzner (hosting): runs the service and stores your data at rest, including the database, on servers in Nuremberg (Germany, EU).
• Amazon Web Services (backups): stores our nightly encrypted database backups in the Frankfurt region (eu-central-1, Germany, EU).
• Cloudflare (CDN / edge): handles TLS termination, DDoS protection, and edge routing.
• Mailgun (EU region): sends transactional emails. We send only what’s needed (your email address, the subject line, and the email body).
• Google (optional, if you choose “Sign in with Google”): we receive your email, name, and profile picture from Google after you authorize the sign-in.
• Google (Analytics, on our public marketing pages only, and only if you accept analytics cookies): Google Analytics 4 receives aggregate, anonymized visitor traffic data, as described in section 1.
• AI providers (only while AI is on for your organization): the provider your organization sets up with its own key, under your organization’s agreement with it, and platform AI once we offer it. Section 4 explains what is sent and where it is processed.
• Grafana Labs (Grafana Cloud, EU region, monitoring): receives operational metrics and traces, made of the request method, route pattern, status code, error type, timing, scheduled job names, and database query text without its values. It never receives your financial data, request contents, IP address, or request logs.

4. AI features

AI is off until you turn it on. An admin of your organization turns AI on in Settings, AI providers, after accepting our AI Terms. An admin can turn it off at any time.

Where AI data is processed. The data stored in The Better Decision stays in the EU (section 8). What you send through an AI feature is the exception: it goes to an AI provider, which may process it outside the EU, including in the United States, under that provider’s own terms.

• With your organization’s own key, the provider is the one it chose: OpenAI, Anthropic, an OpenAI-compatible service such as OpenRouter, or an Ollama server your organization runs. Your organization’s agreement with that provider applies.
• Platform AI, where we supply the AI provider, is not offered yet. When we offer it, requests will go through OpenRouter, Inc. (United States), which passes each request to the company whose AI model answers it.
• A connected AI app sends the data it reads to the AI model it uses, wherever its maker processes it.

What we never send. We never send your profile to an AI provider: your name, email address, phone number, username, and sign-in details.

What we remove first. Before any text leaves our servers for an AI provider or a connected AI app, we replace the IBANs, card numbers, email addresses and phone numbers that we recognize with placeholders such as [IBAN] and [CARD]. An unusual format can slip through.

What is sent as written. Names of people or businesses in your transaction descriptions, account and category names, and everything else you type to the assistant are sent as you wrote them. If you do not want a name to reach an AI provider, leave it out of what you type.

What each feature sends:

• Assistant: what you type, and the data it looks up to answer you. That can be account names and types, balances (including opening balances) and currencies, credit limits, interest rates, payment days, and loan amounts, rates and terms; categories; budgets; transactions (description, amount, date, status, category, account and tags); and spending and forecast figures.
• Suggest a category: one transaction’s description, amount and type, plus your category names and descriptions.
• Forecast refinement: monthly spending totals per category, category names, and the forecast figures. No transaction descriptions.
• Budget rebalance: budget amounts, spending and projections for each category, plus category names.
• Plans smart suggestions, when available: the plan type and length, the plan’s numeric assumptions, and the average monthly net of each account, without account names.

Assistant conversations. What you send to the assistant goes to your organization’s AI provider, which is a cloud service unless your organization runs its own AI server. We do not store your conversations with the assistant. A conversation lives in your browser tab and is gone when you close it.

Changes the assistant proposes. The assistant stages each change as a proposal that you confirm in the app. A connected AI app with read-only access only reads. With change access, its changes are staged as proposals that only that AI app can confirm, using the same token. A token you create with automatic access applies changes without a proposal; apps connected through sign-in never get automatic access. A proposal you do not confirm within 10 minutes expires. We delete each proposal record (what was asked, the preview, and what happened) 48 hours after the proposal was made. When a proposal is carried out, our security log keeps a short entry: the kind of change, when it happened, and whether it succeeded, without its details.

Connected AI apps. You can connect an AI app, such as Claude Desktop or another MCP client, with an agent token or by approving it at sign-in. That app reads your data through our tools, and we remove the identifiers listed above first. The app then sends that data to the AI model it uses, under your agreement with the app’s maker. We do not control that step. You can revoke an app’s access in Settings, Agent access, and an org admin can revoke any member’s token.

When AI is off. When AI is off, none of your data is sent to any AI provider. No connected AI app can read your data either: its requests are refused, and it cannot get new access. If an admin turns AI back on, apps that were already connected work again. While AI is on but no AI provider is set up, AI features send nothing, though a connected AI app can still read your data.

Usage records. For each AI request we keep the feature, model, token counts, cost and time, so we can apply spend caps. We never keep the text.

5. How long we keep your data

• Account and financial data are kept for the lifetime of your account.
• If you close your account, we delete your data within 30 days. Backups are rotated within 90 days.
• Request logs are kept for up to 7 days. Backups of our servers that may contain these logs are deleted within 14 days.
• Email delivery records at Mailgun follow their retention policy (typically 3 days for logs).
• Metrics and traces at Grafana Cloud follow its retention policy.
• Records of changes proposed by the assistant or a connected AI app are deleted 48 hours after the proposal was made.
• We do not store assistant conversations.
• AI usage records (feature, model, token counts, cost, time; never the text) are kept for the lifetime of your account.
• What an AI provider keeps follows that provider’s terms. With your own key, your organization’s agreement with the provider applies.

6. Your rights (GDPR)

If you are in the EU/EEA, you have the following rights under the GDPR:

• Access: request a copy of your data.
• Rectification: fix anything inaccurate. Most of this is self-serve inside the app.
• Erasure: delete your account and all data associated with your organization.
• Portability: export your data in a machine-readable format.
• Restriction / Objection: ask us to stop or limit specific processing.
• Complaint: lodge a complaint with your national data-protection authority (in the Netherlands, the Autoriteit Persoonsgegevens).

To exercise any of these rights, email us at privacy@thebetterdecision.com. We respond within 30 days.

7. Security

Passwords are stored as bcrypt hashes. TOTP secrets are encrypted at rest. All traffic is served over HTTPS with HSTS. Session refresh tokens are cookies scoped to the refresh endpoint with the HttpOnly, Secure, and SameSite=Lax flags. We review the application regularly with static analysis and third-party security tools.

No system is perfectly secure. If you discover a vulnerability, please report it to security@thebetterdecision.com.

8. International transfers

Your data is stored in the EU: the service runs at Hetzner in Nuremberg, Germany, and our backups are kept at Amazon Web Services in the Frankfurt region, Germany. Grafana Cloud stores operational metrics and traces in its EU region. Cloudflare may process requests at edge nodes globally as part of delivering the service. Mailgun operates in the EU region.

AI features are the exception. While AI is on, what you send through an AI feature goes to an AI provider that may process it outside the EU, including in the United States, under that provider’s own terms. Section 4 explains which provider that is.

9. Children

The Better Decision is not intended for children under 16. We do not knowingly collect personal data from children.

10. Changes to this policy

When we make material changes we update the effective date and notify you by email before the changes take effect. The current version is always available at this page.

11. Contact

Privacy questions or requests: privacy@thebetterdecision.com. General contact: hello@thebetterdecision.com.