FinTargetFinTarget
AI (MCP)

MCP privacy and limits

A connected AI app can read your own FinTarget data. If you choose, it can also add records such as expenses and income. It cannot edit or delete the records you entered yourself, and you can disconnect it at any time.

What an app can see

  • Portfolios, holdings and trades, with live prices.
  • Dividends and franking credits.
  • Income, expenses, budgets and recurring schedules.
  • Superannuation, gift cards and fixed deposits.
  • Net worth history and your notifications.

What an app cannot do

  • Edit or delete the records you entered yourself.
  • Add anything, unless you ticked Also let this app add records when you connected it.
  • Change your settings, password or two-factor authentication.
  • See another person's data. Every request is tied to the account that approved the connection.
  • See your password, your sign-in tokens or your authenticator secret.

How access works

StepDetail
Sign-inDetailYou sign in on a FinTarget page, with your password or Google. The app never sees your password.
Two-factorDetailIf you have two-factor authentication on, you enter your code before the consent screen appears.
ConsentDetailThe consent screen names the app, lists what it can read and has a box, unticked, to also let it add records. Access starts only when you choose Allow access.
TokensDetailThe app holds a token that lasts 15 minutes and a refresh token that lasts 30 days and changes each time it is used. FinTarget stores refresh tokens as hashes.

What an app can add, if you allow it

  • Only with your say-so. The box on the consent screen is the only way to give an app this permission. Apps connected without it stay read-only, and Settings shows which apps can add records.
  • What it can add. Expenses, income, budgets, fixed deposits, super balances and gift card spends, and it can undo what it added in the last 24 hours. It can also correct an expense it added in that time. It cannot add trades or holdings.
  • New records only. It cannot change a budget or a super month that already exists. It tells the app to ask you to edit those in FinTarget.
  • Your own categories. An entry must use a category or income type you already have. The app is told the valid names and asked to check with you, never to guess.
  • Not supported yet. Gift card payments and split bills on an expense, and recurring schedules. Add those in FinTarget.
  • Undo and corrections are limited to what it added. Undo and corrections only reach records an app added in the last 24 hours. They cannot reach anything you entered yourself.
  • Repeats are skipped. If an app sends the same entries twice within a few minutes, they are added once.

Turn access off

  • One app. Open Settings, then Security, then Connected apps, and choose Disconnect. Its access ends fully within 15 minutes. To change what an app can do, disconnect it and connect it again.
  • Every app. Change your password, or reset two-factor authentication through email. Both disconnect all connected apps.

What FinTarget records

FinTarget keeps a log of each tool call with the tool name, whether it worked, how long it took and which app made it. It does not store your questions, the inputs an app sent or the results it received. For each record an app adds, FinTarget also keeps the record's id, so that it can be undone.

Limits

  • Rate. About 60 tool calls a minute for each account. Past that, the app is asked to wait and try again.
  • Changes. At most 20 records in one call and 30 adding or undo calls an hour for each account.
  • Size. Lists return up to 500 rows, and holdings up to 300. Results say when they were cut short.
  • Live data. Prices and exchange rates can lag by a minute or two. Lookups that need one request per share, such as sectors and event dates, run within a time limit and report what they covered.

Once an app has read your data, what it does with it follows that app's own privacy terms and settings. Check them before you connect an app to your finances. FinTarget shows your own records and does not give financial, tax or investment advice.

Related