Privacy policy

1. Who we are

This website, mifos-x-open-banking-relay.pages.dev, is run by the Mifos Initiative, a Washington State non-profit corporation, as part of Mifos X Open Banking, an open-source reference app. In this policy, "we" means the Mifos Initiative.

2. What this policy covers

This policy covers this website only: the home page, these legal pages and the /callback/ page your bank sends you to. It doesn't cover your bank's website or the Mifos X Open Banking app, which are described in section 6.

The Mifos Initiative's general privacy notice covers mifos.org and our other services, including the cookies and analytics used there. None of those are used on this website. For this website, this policy applies wherever the two differ.

3. Your bank's answer

When you approve access or a payment, your bank redirects your browser to /callback/ on this site. Its answer (a one-time authorisation code, a signed identity token and a reference value the app created) is placed after the # in the address.

• It never reaches a server. Browsers don't send the part of an address after # when they request a page, so neither we nor Cloudflare receive it.
• It is read in your browser only. A small script on the page reads it and hands it to the app on your device.
• On a computer, the page sends it to the app over a connection to 127.0.0.1, an address that never leaves your own machine. Your browser may ask your permission first.
• On a phone, the page opens the app through its own link, org.mifosx.openbanking://callback.
• It is cleared at once. The page removes the answer from the address bar and your browser history as soon as it has been read.

The authorisation code can be used only once, only by the registered app, and only for a short time.

4. What we collect

Nothing. This website has:

• no accounts, sign-in or forms
• no cookies, local storage or other browser storage
• no analytics, tracking pixels or advertising
• no third-party scripts, fonts or embedded content
• no server code or database

You can check this yourself. The complete source of the site is published on GitHub, and its security headers block any third-party content from loading.

5. Hosting by Cloudflare

The site is served by Cloudflare Pages. Like any web host, Cloudflare processes the technical details of each request in order to deliver the page and protect the site from abuse. These include your IP address, browser type, the page requested and the time.

Cloudflare never receives your bank's answer, for the reason given in section 3. We haven't turned on any Cloudflare analytics or tracking product. Cloudflare's handling of this data is described in the Cloudflare privacy policy.

6. Your bank and the app

Your bank handles your sign-in, your consent and your account data under its own privacy notice. The Mifos X Open Banking app connects to your bank directly. Your account and payment data travels between the app and your bank, never through this website.

7. Your rights

Depending on where you live, you may have the right to ask what personal data an organisation holds about you, and to have it corrected or deleted. This website holds no personal data about you, so there is nothing for us to provide or delete. For data held by Cloudflare or your bank, contact them directly. If you have a question about this, get in touch as described below. You may also have the right to complain to your local data protection authority.

8. Changes to this policy

If the way this site works changes, we'll update this page and the date at the top. Every past version is kept in the project's public change history.

9. Contact

For questions about this policy or your data, email info@mifos.org. You can also reach our Data Protection Officer using the details in section 15 of the Mifos Initiative privacy notice, or write to us at:

The Mifos Initiative
4505 Pacific Hwy E, Ste C-2
Fife, WA 98424
United States

To report a security issue, email security-disclosure@mifos.org.