Firn

Privacy policy

Effective July 25, 2026

The short version. Your financial data lives on your iPhone. Firn has no accounts, no sign-up, no analytics, and no server that stores your numbers — we couldn’t see them if we wanted to. The free tier shows ads, and those ads never see your financial data. Beyond that, we process only what this page names: an email address you volunteer for the launch list, redacted crash reports you switch on yourself, and the request logs any website produces.

Who we are

Firn is operated by Haitham Raweh, Hansastr. 20, 45478 Mülheim an der Ruhr, Germany (“Firn”, “we”). It covers the Firn iOS app and myfirn.com. For anything in this policy, write to support@myfirn.com. We are the controller under the EU General Data Protection Regulation (GDPR) for the limited processing described below.

The app: your data stays on your device

Everything you enter in Firn — holdings, amounts, income, spending, taxes, plans — is stored locally on your iPhone. It is never transmitted to us. There is no account to create and no cloud database of yours on our side.

If you turn on iCloud backup in the app, your data syncs through your own Apple iCloud account under Apple’s terms and encryption. We have no access to it and are not the controller for that processing — Apple provides iCloud to you directly.

Market data lookups

When the app fetches a price, your device requests it directly from a third-party market-data service. Such a request contains the symbols being looked up and — as with any internet request — your device’s IP address, which that service processes under its own responsibility as a technical necessity. Your holdings, amounts, and identity are never part of these requests, and none of it passes through our systems. Legal basis for enabling these requests: performance of the service you ask for (Art. 6(1)(b) GDPR).

Advertising

The free tier of the app shows banner ads supplied by Google AdMob (Google Ireland Limited). Firn requests non-personalised ads only — ads are never targeted using a profile of you, and Firn does not track you across apps or websites. No financial data you enter ever leaves your device for advertising, and we receive no personal data back from Google.

To serve and measure an ad, your device communicates directly with Google, which as an independent controller receives technical data such as device and app information, an advertising identifier, and — as with any internet request — your IP address, from which an approximate (city-level) location can be derived. Google processes this under its own privacy terms.

In the EEA, the UK and Switzerland, a Google-provided consent form appears before any ad is requested; if consent is not given, no ad request is made and the slot simply stays empty. Legal basis: your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time with effect for the future (Art. 7(3) GDPR) via the privacy options in the app. Firn Pro removes ads entirely.

Crash reports

If the app crashes, a technical report can be sent to Sentry (Functional Software, Inc.), processed on EU servers. Before any report leaves your phone, every financial amount is redacted on-device. A report contains technical details such as device model, OS version, app version, and the error trace — the minimum needed to reproduce the fault. We use these reports only to fix bugs, never to identify or profile you, and Sentry deletes them automatically after its standard retention period (90 days). Crash reporting is off until you turn it on in Settings → Privacy. Legal basis: your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time in the same place with effect for the future (Art. 7(3) GDPR).

Purchases

Subscriptions are processed by Apple through the App Store; we never see your payment details. To unlock Pro across reinstalls, a purchase receipt and a random identifier, together with basic app and device metadata, are validated through RevenueCat (RevenueCat, Inc.) — this identifier is not your name, email, or Apple ID. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Notifications

Reports and reminders are generated and scheduled locally on your device. Turning them off in iOS Settings turns them off entirely.

The website

myfirn.com sets no cookies and runs no analytics or trackers. If you join the launch list, we store your email address and the time of signup for one purpose: to send you one email when Firn launches. It is stored with our hosting provider (Cloudflare), never shared or sold, and deleted after the launch announcement — or earlier if you ask. Legal basis: your consent (Art. 6(1)(a) GDPR), withdrawable anytime via support@myfirn.com.

Cloudflare, Inc. hosts the site and, like any host, processes technical request logs (including IP addresses) to deliver it and defend it against abuse — legal basis: legitimate interest in a secure, functioning website (Art. 6(1)(f) GDPR); such logs are kept only as long as these purposes require. Providing your email is entirely voluntary.

Recipients and international transfers

Our processors are Cloudflare, Inc. (hosting), Functional Software, Inc. (Sentry, crash reports — configured for EU data residency), and RevenueCat, Inc. (subscription validation); they act on our instructions under data-processing agreements. Google Ireland Limited (AdMob advertising), Apple (purchases, iCloud) and the market-data service your device queries directly act as independent controllers under their own privacy terms. Where any of this involves a transfer to the United States, it is safeguarded by the EU–US Data Privacy Framework and/or the EU Commission’s standard contractual clauses (Art. 45, 46 GDPR).

Your rights

Under the GDPR you can request access (Art. 15), correction (Art. 16), deletion (Art. 17), restriction (Art. 18), and portability (Art. 20), and you may withdraw any consent at any time with effect for the future (Art. 7(3)). Since your financial data never reaches us, most of it is already under your sole control — deleting the app deletes the data on that device; any copy you synced to your iCloud remains under your Apple ID’s control until you remove it. For the launch-list email or crash data, write to support@myfirn.com.

Right to object (Art. 21 GDPR). Where we process data based on legitimate interest — the website request logs — you may object at any time on grounds relating to your particular situation, and we will stop unless compelling legitimate grounds override, or the processing serves legal claims.

We use no automated decision-making or profiling within the meaning of Art. 22 GDPR. You may also lodge a complaint with any supervisory authority, in particular where you live or work; the authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.

Children

Firn is intended for adults — the terms of use require you to be at least 18. It is not directed at children under 16, and we do not knowingly collect their data.

Changes

If this policy changes, the new version appears here with a new effective date. Material changes will be flagged in the app or on the site.