Last updated: 3 November 2026
The short version
Zinfai is software you install and run yourself. Your holdings, transactions,
expenses, income, liabilities, goals and plans are stored in a database on your own
computer. We operate no backend that receives them, so we could not read your
financial data even if we wanted to.
This website, www.zinfai.com, does have one account system: downloading an
installer requires a free account with a verified email address. That account is
for the download only — it holds your email, never your finances, and the app you
install never signs in to it. There are still no tracking or analytics scripts on
this site.
The video guides are hosted on YouTube. Pages show our own preview image, and
nothing is loaded from YouTube until you press play; the player then runs in
YouTube's privacy-enhanced (no-cookie) mode, under Google's privacy policy.
What stays on your machine
- Every asset, account, transaction, expense, income and liability you record.
- Your local login credentials, stored as a hash in your own database.
- Uploaded statements, and everything extracted from them.
- AI-generated plans, ratings and analyses, once returned.
- Your AI provider API keys, in your local database or a local
.env file.
- Daily portfolio snapshots and the whole history they build up.
What leaves your machine, and when
Zinfai reaches out to the internet for a handful of specific things. Each one is
listed here so there are no surprises.
-
Market prices and FX rates. The app requests quotes for the instruments you
hold from public market-data sources (exchange quote APIs, AMFI for mutual fund
NAVs, public crypto APIs) and daily foreign-exchange rates. These requests contain
ticker symbols and scheme codes — never your quantities, cost basis or identity.
-
Market, macro and news data. Index levels, commodity prices, macro series and
news feeds for your region. Nothing about you is sent.
-
AI provider requests — only if you configure a key. When you generate a
financial plan, rate or value an asset, parse an unsupported statement or tax
document, categorise expenses, run news analysis or ask Mr Mirror a question,
the relevant data is sent from your machine directly to the provider you chose
(OpenAI, Anthropic, Google, xAI, Mistral, DeepSeek, Groq, Perplexity, OpenRouter,
AWS Bedrock, or any OpenAI-compatible endpoint you configure) using your own API key. It
does not pass through us. That data is handled under that provider's
privacy terms, so read them if this matters to you. Mr Mirror in particular
sends the portfolio figures it looked up to answer your question — that is how it
answers from your own numbers — and never your passwords, statement passwords or
API keys. Its web searches send only the search text. Leave the keys blank and no AI
request is ever made.
Before any request leaves your machine, Zinfai replaces your name, account, card, folio,
UAN and PRAN numbers, PAN, Aadhaar, phone number and email address with stand-ins, and
removes your address. It puts the real values back when the reply arrives. Amounts, dates and
transaction descriptions are sent as they are, because they are what is being read. A
description can name a person or shop you paid. Stock and fund ratings and news send
only the names, tickers and ISINs of what you hold, never quantities, cost or returns.
Under Application Setup → AI & Data Sharing you choose, feature by
feature, which parts of Zinfai may use AI at all. A feature you switch off never
contacts a provider.
-
Google Drive backups — only if you enable them. The backup file is encrypted on
your computer with a passphrase only you know, then written to your own Drive account,
with access you grant and can revoke at any time. We never receive it, and neither
Google nor anyone else can read it without the passphrase. See Google user data below.
-
Installing and updating. The installer downloads Docker Desktop (if you don't
already have it) and the Zinfai image from Docker Hub, and Update Zinfai
downloads newer images from there too. Docker, Inc. receives those downloads like any
web request. Docker Desktop is Docker's own software and may send usage and
diagnostic data to Docker under
its privacy policy;
you can review that in Docker Desktop's settings. None of your Zinfai data is
included. It stays in the Docker volume on your computer. See the
Terms of Use for Docker Desktop's licence terms.
-
Update checks. The app asks Docker Hub for the latest Zinfai version so it
can show the update banner. This is a plain request for a version number and
carries no data about you — it is not tied to your download account.
Google user data
Two Zinfai apps can connect to your Google account: Zinfai on your computer, to write
backups to Drive, and Zinfai Buddy on your phone, to read them. Both ask Google for the
same single Drive permission, drive.file, together with your email address so
each app can show which account is connected. drive.file lets an app see only
the files Zinfai itself created. Neither app can open, list or read anything else in your
Drive.
- What is accessed: the backup folder Zinfai creates, the backup files it writes
there and the dated copies in its History folder, and your Google account email address.
- How it is used: Zinfai uploads your backup, lists your backups and downloads one
when you ask to restore it. Zinfai Buddy lists your backups and downloads the latest one
to show your portfolio on the phone. Buddy never writes, changes or deletes anything in
your Drive. The email address is shown on screen and used for nothing else.
- Encryption: backups are encrypted before they leave your computer. Buddy decrypts
them on the phone with the passphrase you enter there. The passphrase is never sent
anywhere.
- Where it is kept: Zinfai stores the sign-in token Google issues in the Zinfai
database on your own computer. On the phone, the Google sign-in session is held by
the operating system's Google sign-in service. Neither is ever sent to us or anyone
else.
- Sharing: none. No Google user data reaches a Zinfai server, an advertiser or an
AI provider, and none is used to train any AI model.
- Removal: click Disconnect on Zinfai's Backup and Recovery page, which
also revokes the token at Google; tap Disconnect under Google Drive in Buddy's Settings; or remove
Zinfai at myaccount.google.com/permissions,
which disconnects both apps. Deleting the backup folder in Drive removes the backups
themselves.
Zinfai's use and transfer to any other app of information received from Google APIs will
adhere to the Google API Services User Data Policy,
including the Limited Use requirements.
What we collect
From the app: nothing. No telemetry, no crash reporting, no analytics, and no way
for your financial data to reach us.
Problem reports. If you send one from Zinfai or Zinfai Buddy, we keep what the
report screen showed you before you sent it: what you wrote, an email address if you gave
one, the app version and environment, the page or screen you were on, your browser or
phone's language, time zone and screen size, and a random install id. We also keep a
one-way hash of the sending IP address and the browser or app's user agent, to stop abuse;
never the address itself. We use reports only to fix problems and reply to you, and you
can ask us to delete one by writing to the address below.
From this website, if you register for a download, we hold exactly this:
- Your email address, and your name if you gave one.
- How you signed in — email and password, or Google.
- Whether your email is verified, and when you last signed in.
- Which installers you downloaded — product, platform, version and time.
- When you agreed to the Terms of Use, which version, and
where (at registration or at a download), with the IP address and browser it came
from, as the record of your agreement.
- The IP address and browser the registration and each download came from,
kept as an anti-abuse record.
That is the complete list. We do not track which pages you browse, we set no
advertising or analytics cookies, and we do not sell, rent or share any of it. The
one cookie-equivalent in play is the sign-in token your browser stores to keep you
logged in, which you clear by signing out.
Why we ask. So we can tell you when a security or data-correctness update
ships, and so we know roughly who is running Zinfai. We do not run marketing
campaigns off this list.
Who processes it. Sign-in and the account record are handled by Google
Firebase (Authentication and Firestore) on our behalf. Verification email is sent
through our email provider. The installer itself is served from GitHub, which logs
the request under its own privacy policy. Our hosting and DNS providers process
standard request logs (IP address, user agent, page requested) to serve and protect
the site, as any website's do.
How long we keep it. For as long as you have an account. Ask us to delete it
and we remove the account and its download history.
If you email us
Writing to support@zinfai.com means we hold
your email address and whatever you put in the message, for as long as it takes to
help you. We don't add you to any list, and we don't share it.
Please never send passwords, API keys, full account numbers or an unredacted backup
file. We will never ask for them.
Zinfai Buddy (Android and iOS)
Zinfai Buddy is the companion app for your phone. It shows the portfolio from your Zinfai
backup and cannot change it. Like Zinfai, it has no server behind it: we receive nothing
from it unless you send us a problem report.
- Where your data comes from: the latest Zinfai backup in your Google Drive (see
Google user data above), or a backup file you pick
yourself from the phone's storage.
- What stays on the phone: the opened backup, kept in the app's private storage,
optionally behind a fingerprint or face lock. Your backup passphrase is kept in the
phone's secure keystore (Android Keystore or the iOS Keychain). Alerts and the daily
digest are worked out on the phone and shown as local notifications. There are no push
notifications and no server sends them.
- What leaves the phone: requests for live prices, exchange rates, market
sentiment and news. These go to public sources: Yahoo Finance, AMFI, CoinGecko, Binance,
Coinbase, Gate.io, Frankfurter, ExchangeRate-API, alternative.me, CNN, and the RSS feeds
of the news sites shown in the app. Price requests contain only ticker symbols. They never
contain your quantities, values or identity. Like any website, those sources see the
phone's IP address. A background task repeats the price requests now and then to keep
the daily digest current.
- Mr Mirror — only if your backup carries an AI key. When you ask Mr Mirror a
question, Buddy sends the question and the portfolio figures it looked up to answer it
straight from the phone to the AI provider set as Primary in Zinfai, using your own key
from the backup. It does not pass through us, and the provider's own privacy terms apply.
Names and account numbers are swapped for stand-ins first, and passwords, statement
passwords and API keys are never sent. Switch it off under Data & Internet
in Buddy's Settings, or leave the key out of Zinfai, and nothing is sent.
- Problem reports — only when you tap Send. Report a Problem or Idea
in Settings sends us what you type (kind, title, description, and an email address
only if you give one), the screen you came from, the app version, the phone's
operating system, language, time zone and screen size, and a random install id that
lets us group your reports. If you tick it, the last Google Drive sync error goes too,
with names and account numbers masked. The report screen shows the whole report
before it is sent. No portfolio figures are included.
- Version check — the version downloaded from zinfai.com only. That build asks
zinfai.com whether a newer Buddy exists; the request carries nothing about you. The
Google Play and App Store versions never make it: the store delivers updates.
- Nothing else. Apart from the sources above and Google Drive, Buddy contacts
nothing.
- What we collect: only the problem reports you choose to send (see
Problem reports). Buddy has no account with us, and no
analytics, advertising or crash-reporting SDKs. It does not track you across apps or
websites.
- Removal: Clear Cached Data in Buddy's Settings deletes the backup,
the saved passphrase and every cached figure from the phone. Uninstalling the app does
the same.
Security is yours to hold
Running on your own machine means the safeguards are yours too. Keep your computer
and disk encrypted, use a strong password for the app, and export backups
regularly — if you lose the machine or delete its data volume, the data is gone
and we have no copy to restore from.
By default the app listens on localhost only, so it isn't
reachable from your network. If you deliberately expose it, put it behind
authentication and HTTPS — that configuration, and its consequences, are yours.
Your data, your call
- Export — one JSON file with everything, any time, from Settings → Backup.
- Delete — remove the data volume and the data is permanently gone.
- Revoke — remove API keys in Settings, or revoke Drive access in your Google account.
None of that needs a request to us, because we hold none of it. For the download
account we do hold, email
support@zinfai.com and we will send you a
copy of the record or delete it, whichever you ask for. Deleting it does not affect
a copy of Zinfai you have already installed.
Not financial advice
Zinfai is a tracking and planning tool for your own research and education. The AI
planner and asset quality ratings are AI-generated and can be wrong. Zinfai is not a
registered investment adviser, broker or tax adviser, and nothing in the app or on
this site is a recommendation to buy or sell any security. Verify anything that
matters, and consider a registered adviser in your own jurisdiction. The full terms on which Zinfai
is provided are in the Terms of Use.
Changes to this statement
If this changes, the date at the top changes with it. If the change is significant
and you have a registered account, we will email you about it.
Contact
Questions about any of this: support@zinfai.com.