Privacy Policy

Who is responsible

This site is operated by Eduard Ilyin, a private individual, as a personal (non-commercial) project. There is no company behind it. For anything on this page, write to [email protected].

Who the data is about

The subject of the private dashboard data is me, the operator. There is no self-service registration, and accounts exist only for me and a few members of my immediate family who use specific pages. The separate podcast pages, RSS feed, episode artwork, transcript and audio are public by design. Publishing the podcast does not make any dashboard, finance, health or household data public.

Bank account access (PSD2 / AIS)

Bank data is imported through Enable Banking Oy, a licensed Account Information Service Provider registered in Finland and supervised by the Finnish Financial Supervisory Authority (FIN-FSA). Concretely:

• Read-only. The access is account information only (AIS). No payment can be initiated from this application, and no payment initiation service is used.
• I never see bank credentials. Authentication and strong customer authentication (SCA) happen on the bank's own pages. This site only receives a token that lets it read the accounts I explicitly selected.
• Only my own accounts. Only accounts I hold myself are linked. No accounts belonging to anyone else are accessed on their behalf.
• Consent expires. A consent lasts at most 180 days, after which the connection stops working until I re-authenticate at the bank. I can revoke it at any moment in my bank's app or by deleting the stored session on the server.

What is stored

• Account data: my email address, display name, a password hash and/or passkey public key, and session records — the minimum needed to log in.
• Bank data: for my own linked accounts — account identifiers (IBAN, currency, product name), balances, and transactions (booking and value dates, amount, currency, counterparty name and account where the bank supplies it, description, reference, bank's transaction id).
• Access tokens: the AIS session identifiers issued after SCA, kept only so the daily sync can run until the consent expires.
• Technical data: ordinary server logs (request path, status, timestamp) kept for operating the server.

Transactions naturally contain the names of counterparties — shops, services, and sometimes people who sent me money or whom I paid. That information comes from my own bank statements, is not enriched from any other source, is never disclosed to anyone, and is used only to show me my own financial history. It is the same information my paper bank statement would contain.

Podcast analytics

For the public podcast player, first-party analytics records starts, completed 15-second listening intervals and completion after explicit consent. An explicit website download and the delivery of an audio file are counted under legitimate interest so I can operate the feed, understand server load and distinguish a requested file from meaningful listening. The podcast continues to work if consent is refused.

• The server creates a daily pseudonymous code with a secret HMAC from the request's IP address and User-Agent. The raw IP address and User-Agent are not stored in the analytics tables, and the code changes every UTC day.
• Raw analytics events and daily pseudonymous codes are deleted after 90 days. Anonymous daily counts and retention totals are kept indefinitely so the history remains useful.
• Do Not Track and Global Privacy Control signals disable collection. There are no third-party analytics, advertising trackers or cross-site identifiers.
• You may refuse or withdraw consent at any time. Refusal has no effect on access to the audio. You may also object to legitimate-interest processing by writing to the contact above.

Podcast analytics settings Current choice: not chosen

Why

To see my own balances, spending and history in one place instead of five banking apps, and to keep personal notes, workouts and household records. The data is not used for profiling other people, for scoring, for advertising, for training models, or for any commercial purpose.

Where it lives

On my own hardware: a PostgreSQL database running in a private Kubernetes cluster that I own and administer. It is not stored in a third-party analytics platform, data warehouse or CRM. Public access to the site is served over HTTPS through a Cloudflare tunnel, which terminates TLS in transit. The legal pages, login page and `/podcast` publication routes are public. Every unrelated page requires an authenticated owner session; anonymous requests are redirected to the login screen, and signed-in non-owners get a 403.

Who else receives it

Private dashboard data is not sold, rented, shared, syndicated or published. The intentionally public podcast is distributed through this site and podcast directories, including Apple Podcasts. Technical providers may transport or cache those public files. For private dashboard data, the only third parties involved are my banks, Enable Banking as the licensed AIS provider, and Cloudflare for network transport. There are no analytics, advertising or tracking pixels.

How long it is kept

Bank transactions are kept as a personal financial archive for as long as I keep using this dashboard, in the same way one keeps old statements. AIS sessions die when the consent expires (at most 180 days) or when I revoke it. Login sessions expire on their own. Anything can be deleted from the database on request or at will.

Cookies

Strictly functional only: a session cookie that keeps me logged in, and a small preference for theme and language. The podcast analytics choice is kept in browser local storage for 180 days. No analytics or advertising cookies are set.

Your rights

If you believe data about you appears here — for example because you and I exchanged a bank transfer and your name is on my statement — write to [email protected] and I will tell you what is stored and delete it where the law requires. As the data subject of essentially everything on this site, I exercise access, rectification, erasure and portability directly against my own database. You can also complain to your national data protection authority.

Changes

If the way this site handles data changes, this page changes with it, and the date at the top moves. See also the terms of use.