Privacy policy

Finpello (“we”, “us”) is a free website for learning money skills. This policy explains what we collect and what we do with it. Short version: we collect only what we need to run your account, we never sell it, and you can delete it any time.

What we collect

• Account details: your username, email address and password. Passwords are stored as a one-way scrypt hash, never in plain text.
• Learning progress: lessons completed, scores, XP, streak and when you earned them.
• Technical data: your IP address is used briefly to block spam and repeated failed logins. Our host keeps standard server logs.
• Analytics (only if you accept): anonymous page-view counts via Vercel Web Analytics, which uses no cookies and doesn’t identify you.

Emails we send

We only send account emails: confirming your email address, password resets, a welcome message, and notices when your password changes or your account is deleted. We don’t send marketing emails and never add you to a mailing list. Reset and confirmation links work once and expire (30 minutes and 24 hours). We store only a scrambled (hashed) copy of each link.

What’s public

Your username, XP, streak, badges and completed lessons appear on the global leaderboard and your public profile page. Your email is never shown publicly. You can hide yourself from leaderboards and your public profile in your profile settings.

Certificates: each certificate has a verification page that shows the track, the date and the name on the certificate. You choose that name, and you can hide it; the page then only confirms the certificate is genuine.

Cookies

We use one essential cookie, fp_session, to keep you logged in. It can’t be turned off while you use an account. We don’t use advertising or tracking cookies. Your cookie choice is saved in your browser’s local storage.

Who processes your data

• Vercel hosts the website.
• Turso stores the database.
• Google (Gmail) delivers our account emails, so it handles your email address and the message.

We don’t sell or share your data with advertisers.

How long we keep it

We keep your account until you delete it. Login sessions expire after 30 days. Spam-protection records are deleted after 24 hours.

Your rights

You can see everything we store about your progress on your profile page. You can delete your account and all of its data at any time from your profile. For anything else, including a copy of your data, use the contact form.

Children

Finpello is meant for people aged 13 and over. If you believe a child under 13 created an account, contact us and we’ll delete it.

Changes

If this policy changes, we’ll update the date at the top of this page.

Contact

Use our contact form, or email finpelloteam@gmail.com.