1. Who is responsible
Matcha is an independent personal-finance project maintained by Jason Krijgsman. For questions or requests about personal data, email contact@jasonkrijgsman.com.
2. What this notice covers
This notice covers the public Matcha website, the local Matcha application, and the optional read-only Open Banking connection. It does not replace the privacy notices of your bank, Enable Banking, or the service hosting this website.
3. Data Matcha handles
- Local financial data: account names, balances, transaction records, categories, budgets, reconciliations, plans, and the evidence attached to them.
- Connection data: the chosen bank, consent status and expiry, provider session references, and technical identifiers needed to prevent repeated or unauthorised callbacks.
- Website request data: the hosting service may process an IP address, browser information, timestamps, and security logs when this site is requested.
- Contact data: information you choose to include if you email the privacy contact.
Matcha does not ask for or receive your online-banking password, PIN, or bank authentication codes.
4. Why the data is used
5. Local storage and retention
Matcha is local-first. Financial records you choose to retain are stored in an encrypted vault on your device. Matcha does not operate a hosted database of your financial history and does not use that history for advertising, profiling, sale, or AI training.
Short-lived authorisation state and one-time callback material are held by the loopback companion on your device only as long as needed to finish or abandon the connection. You control the local vault and can delete it. Operational website logs, if any, are retained by the hosting service under its own security and retention practices.
6. Open Banking and recipients
When you enable a bank connection, Matcha uses Enable Banking Oy to carry your authorisation request to your bank and return the account information you approved. Your bank performs authentication directly; credentials never pass through Matcha. Matcha requests account information only—accounts, balances, and booked or pending transactions—and does not initiate payments.
Data may therefore be handled by your chosen bank, Enable Banking, and the infrastructure needed to deliver this static website. Matcha does not sell personal data or share it with advertisers or data brokers. Read the Enable Banking privacy notice and manage active sharing through its consent dashboard.
7. Cookies and analytics
The Matcha website does not add analytics, advertising trackers, or a marketing cookie banner. The hosting service may still use essential security mechanisms and request logs to deliver and protect the site.
8. Your choices and rights
You can decline a bank connection, select which eligible accounts to share, revoke bank consent, stop synchronisation, or delete your local vault. Depending on the law that applies, you may also have rights of access, correction, erasure, restriction, portability, and objection. Contact the address in section 1 to exercise a right.
You may also complain to your competent supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens.
9. Security and changes
Matcha separates provider credentials from the browser, uses a loopback-only callback service, checks short-lived state, and keeps financial storage encrypted locally. No system is completely secure; keep your device, browser, operating system, and backups protected.
This notice will be updated before Matcha materially changes what it collects, where it stores information, or who can use it. The version and effective date above identify the current notice.