Privacy and security

Summary of our practices. The full privacy policy and terms are published after legal review.

What we store

• Your parent's first name only.
• Account nickname, bank name and the last 4 digits of each account.
• The transactions we read from the statements you upload.
• Your notes and receipts.
• The edit log.
• Your name and email address, and those of family members you invite.
• Comments family members leave.
• Salted, one-way hashes of IP addresses and email addresses, used only to limit sign-in and Statement Check attempts (deleted within 3 days).
• While email delivery is off, emails we could not send (address, subject and text), until that person deletes their account.

What we never ask for or store

• Bank logins.
• Social Security numbers.
• Dates of birth.
• Full account numbers. For PDFs with a text layer, we mask the account numbers we can detect before the statement is read, and check again afterward. For photos and scans, our AI provider may see the full number printed on the page. Either way, we never store more than the last 4 digits.

How long

• Source statement files are deleted automatically after 90 days by default. You can choose 30, 90 or 365 days.
• The ledger and reports stay until you delete them.
• Free Statement Check files and their results are deleted within 2 hours.

Export and delete

• “Export your data” gives you a ZIP of the ledger (CSV), your reports (PDF), receipts and the edit log. Original statement files and comments are not included.
• “Delete this family” deletes the family's records and files after a 7-day undo window. Encrypted nightly backups that still hold them are deleted within 30 days after that.
• You can delete your account.

Security

• Two-factor sign-in is required for whoever manages the accounts.
• Family members see only what you share. They can't see source statements unless you turn that on.
• Every change to the record is written to a tamper-evident, hash-chained log your family can read.
• Our policy is not to look at your data. If you ask for help, you can grant time-limited access, and that access is logged.

Who processes data for us

• Supabase (database, file storage and sign-in emails; United States)
• Netlify (hosting; United States)
• GitHub (encrypted nightly database backups, kept 30 days; GitHub cannot read them)
• Anthropic (reads statements)
• Stripe (payments; we never see your card)
• Resend (email, once it is turned on; until then sign-in emails come from Supabase)
• Sentry (error reports, with personal data removed)
• PostHog (website analytics on the home page only, not inside the app)