Last updated: 1 August 2026
This notice explains what My Financial Tracker collects, why, and what you can do about it. The service is operated by My Financial Tracker, who is the data controller for the purposes of Kenya's Data Protection Act 2019.
| Data | Why |
|---|---|
| Your email address or phone number | It is your login handle and how we identify your account. |
| Your name | Shown in the greeting on your dashboard. |
| Your age | To confirm you meet the minimum age, and to apply the extra protections the law requires for under-18s. |
| Your password | Stored only as a PBKDF2-SHA256 hash with a random per-account salt. We cannot read it, recover it, or tell you what it is. |
| Your financial entries | Income, expenses, assets, liabilities and transactions you type in. This is the service. |
| Guardian name and email (under-18s only) | To record the consent the law requires. |
| Recovery email (optional, phone sign-ups) | So a forgotten password can be reset. |
We do not ask for, and you should never enter, your bank account numbers, card numbers, M-Pesa PIN, or online banking credentials. The tracker has no connection to any bank and never needs them.
Your data lives in a Cloudflare D1 database, reachable only through this application, and every query is restricted to your own account. Cloudflare acts as our data processor and operates servers in multiple countries, so your data may be stored or processed outside Kenya.
Under the Data Protection Act 2019 you may ask us to show you the data we hold on you, correct it, delete it, or give you a copy to take elsewhere. You can export everything yourself at any time from the tracker using Export Excel Backup, without asking anyone. To have your account and all its data deleted, email info@myfinancialtracker.co.ke and we will do it within 30 days.
You also have the right to complain to the Office of the Data Protection Commissioner if you think we have handled your data improperly.
You must be at least 13 to open an account, and if you are under 18 a parent or guardian must give consent when the account is created. A parent or guardian can email us at any time to see, correct or delete their child's account.
Your data stays until you delete your account. If an account is inactive for two years we may delete it, and would email you first where we have an address for you.
No system is perfectly secure. Passwords are hashed and never stored in readable form, sessions are stored as hashes rather than usable tokens, and all traffic uses HTTPS. But this is a small service, not a bank. Please use a password you do not use anywhere else, and do not enter anything you could not bear to lose.
If this notice changes in a way that matters, we will say so in the application. Questions, requests or complaints: info@myfinancialtracker.co.ke.
← Back to the tracker