myfinancialposition
Privacy

We take your privacy seriously

This policy explains what data we collect, how we store it, and how we protect it. We will never sell your data.

Effective date: 7 April 2026  •  Last updated: 7 April 2026

1. Who We Are

About My Financial Position

My Financial Position (“we”, “us”, “our”) is an Australian personal finance tracking platform operated under ABN 86 764 389 699, accessible at www.myfinancialposition.com.au.

We are committed to protecting your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Questions about this policy can be directed to: support@myfinancialposition.com.au

2. Information We Collect

What Data We Hold

When you create an account and use the Service, we collect and store the following:

  • Account information: Your email address and hashed password.
  • Profile information: Name, date of birth, job title, and address — if you choose to provide them.
  • Financial data: Assets, debts, budget items, income, savings, investments, milestones, and forecasts that you manually enter into the platform.
  • Usage data: Basic server logs including IP address, browser type, and pages visited for security and diagnostic purposes.

We do not collect or access your bank account credentials, transaction history, or any data directly from financial institutions. All financial data is entered manually by you.

3. How We Use Your Data

Purpose of Collection

We use the information we collect to:

  • Provide, operate, and maintain the Service;
  • Save and sync your financial data across sessions and devices;
  • Send transactional emails (e.g. password reset, account verification);
  • Improve the platform based on aggregated, anonymised usage patterns;
  • Respond to support requests;
  • Comply with legal obligations.

We will never sell, rent, or share your personal data with third parties for marketing purposes.

4. How We Store Your Data

Storage & Security

Your data is stored on servers hosted by Railway (railway.app), a cloud infrastructure provider. Servers are located in the United States. By using the Service, you consent to your data being stored and processed in the United States.

We implement the following security measures to protect your data:

  • All connections are encrypted via HTTPS/TLS;
  • Passwords are hashed using Django’s PBKDF2 algorithm and never stored in plain text;
  • Database access is restricted and not publicly accessible;
  • We use environment variables for all sensitive credentials — no secrets in source code.

While we take reasonable precautions, no method of transmission or storage is 100% secure. You use the Service at your own risk.

5. Cookies & Local Storage

Cookies

We use the following cookies:

  • Session cookie: Required to keep you logged in. This is a functional cookie and cannot be disabled without affecting your ability to use the Service.
  • CSRF token: A security cookie used to prevent cross-site request forgery attacks.

We do not use advertising cookies, tracking cookies, or any third-party analytics cookies. We do not use Google Analytics or similar tracking tools.

We may use localStorage in your browser to temporarily persist UI state (such as collapsed sections or display preferences). This data never leaves your device.

6. Third-Party Services

Services We Use

We use a limited number of third-party services to operate the platform:

  • Railway — cloud hosting and database infrastructure;
  • SendGrid — transactional email delivery (password resets, account emails). Your email address is passed to SendGrid solely for the purpose of sending you emails you requested;
  • Google Fonts — font delivery via CDN. Google may log your IP address when fonts are loaded.

We do not share your financial data with any of these providers. They receive only the minimum information necessary to perform their function.

7. Your Rights

Access, Correction & Deletion

Under the Australian Privacy Principles, you have the right to:

  • Access the personal information we hold about you;
  • Correct any inaccurate or outdated information;
  • Request deletion of your account and all associated data;
  • Withdraw consent at any time by closing your account.

To exercise any of these rights, contact us at support@myfinancialposition.com.au. We will respond within 30 days.

Account deletion requests will result in permanent and irreversible removal of all your data from our systems.

8. Data Retention

How Long We Keep Your Data

We retain your data for as long as your account remains active. If you request account deletion, all personal data will be permanently deleted within 30 days of the request.

Server logs (IP addresses, access logs) may be retained for up to 90 days for security purposes before being automatically purged.

9. Children’s Privacy

Under 18s

The Service is not directed at children under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with their data, please contact us and we will delete it promptly.

10. Changes to This Policy

Policy Updates

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. For significant changes, we may notify you by email.

Continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

11. Contact & Complaints

Get in Touch

For any privacy-related questions or complaints, contact us at:

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.