Privacy Policy

1. Introduction

Welcome to MoneySprout ("we," "us," or "our"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our personal finance application.

Please read this policy carefully. If you disagree with its terms, please discontinue use of our application.

2. Information We Collect

Account information: When you create an account, we collect your email address and a hashed password. We never store plaintext passwords.

Financial data: If you connect bank accounts or credit cards via Plaid, we receive read-only access tokens. We store account names, balances, and transaction records. We never receive or store your bank login credentials.

Usage data: We may collect information about how you interact with the app (pages visited, features used) in aggregate, anonymized form to improve the service.

Device information: Browser type, operating system, and IP address may be logged for security and debugging purposes.

3. How We Use Your Information

• To provide, operate, and maintain the MoneySprout application
• To display your financial data — budgets, goals, net worth, and transaction history
• To authenticate your identity and keep your account secure
• To send important service-related communications (e.g., email confirmations)
• To diagnose technical problems and improve service reliability

We do not sell your personal or financial data to any third party. Ever.

4. Data Storage and Security

Your data is stored securely using Supabase, a SOC 2-compliant database provider. We apply Row-Level Security (RLS) policies so that each user can only access their own data.

Standard mode (default): Transaction details are stored in our database and protected by access controls and encryption in transit. A database administrator could read this data if they accessed the database directly.

Zero-knowledge mode (optional): If you enable this in Settings → Privacy & encryption, transaction details are encrypted on your device before being stored. We only keep ciphertext — we cannot read your merchants, amounts, or notes. You must save a recovery phrase; losing it means permanent data loss if you forget your encryption password.

Financial account connections are handled by Plaid, a regulated financial data aggregator. When you connect a bank account, Plaid collects account and transaction data on our behalf. Plaid's End User Privacy Policy governs how Plaid processes that data. We store only access tokens, not your banking credentials.

Data shared via Plaid: account names, types, and balances; transaction history (dates, amounts, merchants, and categories); and your financial institution name. We use this data to display your finances, calculate budgets and net worth, and send optional alerts you enable. Access is read-only — we cannot move money on your behalf.

Before your first bank connection, we ask you to review a data-sharing disclosure and provide express consent. You can disconnect linked accounts at any time from Accounts, which revokes access through Plaid.

All data is transmitted over TLS-encrypted connections (HTTPS). Access tokens for third-party integrations are encrypted at rest using industry-standard AES-256 encryption.

5. Third-Party Services

We use the following third-party services:

• Supabase — database, authentication, and storage
• Plaid — bank account linking and transaction data
• Experian (optional) — VantageScore credit monitoring when you connect your score on the Credit page
• OpenAI (optional) — AI assistant, categorization, and property estimates when you enable AI features in Settings

When AI features are enabled, we send summarized financial context (such as account names, recent transactions, budgets, and goals) to our AI provider to answer your questions. This data is used only to serve your request and is not sold or used for advertising. You can disable AI features at any time in Settings → Preferences.

These providers have their own privacy policies and we encourage you to review them. We do not share your data with any advertising networks, data brokers, or analytics companies.

6. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal information and financial records within 30 days, except where required by law.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access a copy of your personal data
• Request correction of inaccurate data
• Request deletion of your account and data
• Object to or restrict processing of your data
• Data portability (export your data)

To exercise any of these rights, contact us at privacy@moneysprout.app.

8. Children's Privacy

MoneySprout is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by emailing the address on your account or by posting a prominent notice in the app. The "Last updated" date at the top of this page reflects the most recent revision.

10. Contact Us

If you have questions about this Privacy Policy, please contact us: