What the AI assistant in Finsight sees, and what it does not

Finsight now has an assistant. You ask "will my money last until the end of the month, counting the loan and the subscriptions?" and get an answer with your numbers in it. You attach a photo of a receipt or a bank statement and get a list of transactions to confirm. It is available on the Pro plan.

We wrote earlier about why Finsight encrypts your data on the device and why the server cannot read it. An assistant that answers questions about your spending seems to contradict that: to answer, a model has to see the spending. This post is about how we squared the two, and about the lines we chose not to cross.

The server still cannot read your data

The first decision followed from the architecture we already had. Amounts, balances, account names and notes are stored on the server only as ciphertext, encrypted with a key that stays with you. The server cannot assemble a picture of your finances for the model, because it does not have one.

So the picture is assembled on your device. The app already keeps local aggregates for its own screens: balances per account, cash flow by month, spending by category, budgets, goals, loans, debts, recurring payments and the month-end forecast. When you ask a question, the app packs those aggregates into a compact summary and sends it together with the question. The Finsight server checks that you are signed in, that your plan includes the assistant, that you have given consent and that you are within the daily limit, then forwards the request to the model provider and returns the answer.

The alternative, decrypting your data on the server so the model could read it there, would have quietly broken the promise that only you hold the key. We did not consider it for long.

What leaves the device

Being precise here matters more than being reassuring, so here is the list.

• Account names, types, currencies and balances.
• Income and expenses by month for the last six months, per currency.
• Spending by category for the current and the previous month.
• Budgets with their limits and what has been spent against them.
• Goals, loans with their remaining balance and next payment, debts by counterparty, recurring payments.
• The forecast to the end of the month.
• Your language, time zone and today's date, so the answer makes sense.
• Any document you attach: a receipt photo, a statement as a photo or PDF, a CSV or XLSX file.

If a question needs individual transactions, for example "show my largest expenses this month", the model asks the app for them and the app sends that slice. It does not send the whole history.

What never leaves the device

Notes attached to transactions are never sent. They are the most personal free text in the app: who the money went to, what for, why. The assistant answers from figures and names, and in our testing that was enough for every question we cared about. If one day it is not, we would rather have a less clever assistant than ship your notes to a model.

The chat history is not stored in your Finsight account. The conversation lives on your device. The server keeps only a service record per conversation: whose it is, how many questions and tokens it used, and when the last summary was sent. The model provider keeps the conversation in a session so you can ask follow-up questions without repeating yourself; "New conversation" deletes that session along with the local history, and so does revoking consent in the settings.

We say all of this in the consent screen inside the app, in the same words. The assistant does not switch on until you have read it and agreed.

Why ten questions a day

Pro costs 20 dollars a year. A single question with a full summary costs us a cent or two, and a bank statement a bit more. Without a limit, a handful of very active users would make the plan lose money for everyone else, and we would be tempted to make the summary smaller or the model cheaper.

Ten questions a day keeps the assistant useful, keeps the summary complete and keeps the plan honest. Follow-up questions within a conversation are cheaper than new ones, because the summary is sent again only when it has gone stale, so the limit goes further than it sounds.

What the assistant will not do

It answers questions about your finances and about the app. Ask it for a recipe or a travel plan and it will politely decline. When it gives advice, whether to pay off a loan early or whether a purchase fits this month, it bases the advice on your figures and says plainly that it is not professional financial advice.

It does not connect to your bank, and it does not move money. It only reads what you have already recorded, and it only writes transactions when you have looked at the list and confirmed it.

Where this goes next

The pieces we are considering, in order of how much we want them: a streaming answer instead of waiting for the whole text, proactive observations on the home screen when something in the forecast deserves attention, and more document formats for import. None of them change the rules above. The summary stays aggregated, the notes stay with you, and the assistant stays off until you turn it on.