My AI Fin App is the budgeting and debt-payoff app at https://myaifin.app and in the My AI Fin App apps for iPhone and Android (together, the Services). The Services are operated by Kind of Good Apps, LLC ("Kind of Good Apps", "we", "us" or "our"). Kind of Good Apps, LLC is responsible for the personal information described in this policy and decides how it is used.

This policy explains what the app collects, who else touches it, and what you can ask us to do about it. Everything below describes the app as it is built today, not a template of what a finance app usually does.

At a glance:

• No ads. There is no advertising in the app or on the site, no advertising network, and no tracking pixel — the site's content security policy names every host the browser may contact, so a tracking pixel would simply be blocked.
• We do not sell your personal information, and we do not share it for cross-context behavioural advertising. The app is meant to be paid for by Pro subscriptions, which are free during early access.
• No marketing email. The only email that is sent without you asking is transactional: address verification, password resets, security alerts and household invitations. Everything else — the spending alerts and the digest — is yours to switch off in Settings, and every one of those messages carries a one-click unsubscribe.
• Payments go through the store you buy in. On iPhone, Apple charges your Apple ID; on the website, Stripe takes your card. A full card number never reaches this app.
• We collect what the app needs to work: your account details, what you enter, what your bank sends through Plaid or Apple Wallet shares on your iPhone if you connect them, and enough about your devices to show you a sign-in history and keep the account safe.
• Everyone else who touches your data is named in section 4.
• AI assistants only see your data if you connect one, and then only what you can see — section 2.5.
• You can get your data out and delete the account yourself — section 9; the buttons are in Settings, and myaifin.app/delete-account works without signing in.

1. Scope

This policy applies to personal information collected through the Services and through related contact with us (for example when you write in through the contact form). It does not apply to information collected by parties we do not control, such as your bank or card issuer. The Services are aimed at people in the United States.

2. What is collected

2.1 What you give us

• Your account. An email address and a password, or the email address on your Google or Apple account if you sign in with one of those. Optionally a first and last name, a display name and a profile picture.
• Passkeys, if you add one. A passkey lets you sign in with Face ID, Touch ID, Windows Hello or your device PIN instead of a password. The private half of the key never leaves your device or your password manager (such as iCloud Keychain); the database keeps only the public half, the name you give the passkey, which kind of authenticator made it (for example iCloud Keychain or a security key) and whether it syncs between your devices, and when it was added and last used. Your face, fingerprint or PIN is checked by your device and never reaches us. You can rename or remove passkeys in Settings → Security.
• What you put in the app. Debts, accounts, assets, transactions, budgets, goals, categories, rules, notes and anything else you type. If you are in a household, the members of that household can see the household's data — that is the point of a household.
• Optional profile details. Settings has a short optional form (date of birth, household size, income range, homeownership, marital status, country). You can leave it empty and the app works the same.
• Messages you send us. The contact form passes on your name, email address, optional phone number and message.

2.2 What your bank or Apple Wallet sends, if you connect one

Bank connections are optional and go through Plaid. You sign in on Plaid's screen, so your bank username and password never reach this app's servers and are not stored anywhere in it. Plaid then sends account names and types, balances, transaction history, and card and loan details such as statement balances, minimum payments and APRs. The access token Plaid issues is encrypted with a key held only on the server. Disconnecting a bank in Settings removes the connection at Plaid as well, not just here.

Apple Card, Apple Cash and Apple Savings can be connected in the iPhone app, through Apple's FinanceKit. Nothing is read until you tap Connect Apple Wallet and allow it on Apple's own screen, where you choose which accounts to share. The app then reads, on your phone, those accounts' names, balances, and for Apple Card the credit limit, minimum payment, due date and any overdue amount, plus their transactions (amount, date, merchant name and description, merchant category and whether it is pending). It uploads that to our servers whenever you open the app, and from then on it is stored and protected like the rest of your account data, including household sharing. Apple does not send us your card number or your Apple Account password. Wallet data is used only to show you your own finances: it is never used for advertising, never sold, and goes to no one outside section 4. Disconnecting in Settings stops the sync, and you can also withdraw access at any time in the iPhone Settings app; what was already synced stays in your account until you delete it or the account.

2.3 What is collected automatically

• Device and log information. IP address, browser and operating system, a device identifier to recognise the device, and the time of the request. The identifier is a one-way hash of the browser, operating system, device model and number of processor cores, worked out on the device each time rather than stored on it, so clearing your browser's storage does not change it. This is what makes "sign-in history" and "sign out of other devices" possible, and what lets the app tell you when the account is signed into from a device it has not seen. If you choose to remember a device so that it is not asked for a sign-in code each time, the server also keeps a record of that device (its browser and operating system, when it was verified and when it was last used) and a one-way hash of the token stored on it. You can see and remove remembered devices in Settings → Security.
• Approximate location. An approximate city derived from your IP address, shown next to each sign-in so you can spot one that is not yours. The app never asks for your device's location: the site sends a permissions policy that switches the browser's geolocation feature off entirely.
• Sign-in, session and security records. Each sign-in, each active session and each security event — a password change, two-factor turned on, a session revoked — is recorded so that you can review them in Settings. Switching activity tracking off in Settings → Privacy stops new records being written; the database, not the app code, enforces that. Separately, a short server-side log of attempts backs the rate limits on sign-in, password reset and account deletion, and it is deleted after two days.
• Error reports and performance. When the app fails, the error is reported to Sentry with your user id attached, never your email address. Sentry also gets page-load timings and, for some sessions, a replay with all text, inputs and images blanked out. See section 4.
• Page counts. Vercel Web Analytics counts page views without cookies and without identifying individual visitors.

2.4 The iPhone and Android apps

The apps are the same Services in a native shell. They collect what the website collects, as described above, and nothing more. Specifically:

• Apple Wallet, only if you connect it. On iPhone you can choose to share Apple Card, Apple Cash and Apple Savings with the app; what is read and how it is used is in section 2.2.
• Face ID, Touch ID and fingerprint unlock. If you switch on the app lock, your phone checks your face or fingerprint itself and tells the app only whether the check passed. If you also use Face ID or Touch ID to sign in on an iPhone, the app keeps a random sign-in key in the iPhone's Keychain that only your face or fingerprint can unlock; our database stores a one-way hash of that key, the device type, and when it was added and last used. The key stops working if you turn Face ID off in the app, sign out everywhere, reset your password (changing it signs out Face ID on your other phones), or change the faces enrolled on the phone, and it expires after 90 days without use. Your biometric data never reaches the app, our servers or anyone in section 4.
• Push notifications, only if you turn them on. The app asks only when you tap "Turn on notifications" in Settings. It then stores your phone's push token so alerts you have chosen can reach it, and deletes it when you sign out of that phone or remove it under Settings, Notifications. Alerts stop reaching a phone the moment it is signed out from anywhere.
• No access to your location, contacts, photo library or microphone. Choosing a profile picture uses the system picker, which hands over only the one image you pick. The camera is used only if you choose "Take Photo" there, iOS asks your permission first, and the photo becomes your profile picture and nothing else.
• No advertising identifier and no tracking. The apps do not read your device's advertising identifier and do not track you across other companies' apps or websites.
• What is stored on the phone is the same list as in section 7, kept in the app's own private storage instead of a browser's.

2.5 AI assistants you connect

You can connect an AI assistant such as Claude, ChatGPT or Cursor to your account, so it can answer questions about your finances. This is off until you set it up yourself, either by approving a connection request (for example adding the My AI Fin App connector in Claude) or by creating an access token in Settings → Assistants.

• What an assistant can see. The same data your own sign-in can read, and nothing more: your accounts, balances, transactions, budgets, goals, debts and subscriptions, including shared household data. Every request runs as you, under the same database rules that protect your data in the app. It never sees your password or your bank sign-in, and it cannot use your bank connection: the Plaid access token is stored only in encrypted form, and the key that unlocks it is held on the server and never sent anywhere.
• What an assistant can change. A connection approved through a connector is read-only. An access token you create with read-and-write access can also re-categorise transactions, save a rule that categorises a merchant automatically in future, exclude transactions from spending, add notes and set category budgets. It cannot delete anything, move money, or connect or disconnect a bank.
• What the assistant's company receives. The answers the app sends to your assistant go to the company that runs it (for example Anthropic for Claude) as part of your conversation, and are handled under that company's privacy policy. You choose that company; it is not a processor of this app, which is why it is not in section 4.
• What is logged here. For each request the app records which tool was called, when, which assistant made it, whether it worked, how long it took and how many rows came back. Your question and the assistant's answer are not recorded. Of what the assistant sent, only dates, option choices (such as "group by month") and, for a database query, the names of the tables it read are kept; amounts, names and other text are reduced to "was set". If a request fails, its error message also goes to the server's error log, which the hosting provider keeps only for a short time. The most recent entries are shown in Settings → Assistants, and the log is deleted after 90 days.
• Gap reports. An earlier optional setting let an assistant record a one-sentence description, with amounts and names removed, of something you asked for that it could not do. That feature is paused and nothing new is recorded. Anything saved before is listed in Settings → Assistants, where you can delete it; otherwise it is deleted after a year, or with your account.
• Disconnecting. Disconnect an assistant or revoke a token at any time in Settings → Assistants; it stops working immediately. The assistant is not told straight away, so it may still show as connected until the next time it tries to use the connection, which is then refused. Removing the connector inside the assistant makes the assistant forget it; disconnecting here is what cuts it off on this side. Deleting your account removes every connection and log entry.

3. How the information is used

• To run the app. Create and manage your account, fetch and display your financial data, categorise transactions, calculate payoff plans and budgets, and send the alerts you have turned on.
• To keep the account safe. Detect a sign-in from an unfamiliar device, rate-limit abuse, and let you review and end sessions.
• To answer you. Reply to what you send, and send administrative notices such as a change to this policy or to the terms.
• To fix and improve the app. Diagnose errors and see which features are used, from error reports and aggregate page counts.
• To comply with the law. Meet legal obligations and respond to lawful requests, and enforce the terms of service.

The information is not used to build an advertising profile, to target ads anywhere, or to score you for anyone else.

4. Who processes your data

These are every outside service in the data path. Each one is here because the app cannot do the job without it, and each gets only what that job needs.

The browser is only allowed to contact the hosts in that table: the site's content security policy names them one by one and blocks everything else, so a service that is not listed here cannot quietly be added to the page. If a new processor is added, this table changes before it goes live.

5. When information is shared

1. The processors in section 4, for the purposes described there and nothing else.
2. Your household. If you join or create a household, the people in it see the household's financial data. You control who is invited, and members can be removed.
3. Legal and safety. If the law requires it, or in response to a valid subpoena, court order or government request. Also where it is necessary to investigate or act on fraud, a threat to someone's safety, or a breach of the terms of service.
4. A change of ownership. If the app is ever sold or transferred, your information would go with it, subject to this policy. If that would mean a material change in how it is handled, you get notice first (section 14).
5. With your consent, for anything else, at the time you ask for it.

Your personal information is not sold, is not rented, and is not shared with anyone for their own advertising or marketing.

6. Payments

Pro is sold as a subscription with a 3-month free trial. In the iPhone app it is an Apple in-app purchase, billed to your Apple ID; Apple handles payment, renewals, cancellation and refunds. On the website it is billed by card through Stripe, run by RevenueCat. We store only what is needed to know whether your household has Pro: the plan, price, status, renewal and end dates, whether it is cancelled, and the store's subscription reference, plus a log of the billing events the stores send us. We never receive or store a full card number. Deleting your account cancels a website subscription automatically; an Apple subscription must be cancelled in your Apple ID settings, and we tell you how.

7. Cookies and what is stored in your browser

The app sets no advertising or tracking cookies, and there is no third-party analytics script and no tracking pixel. What it does use is your browser's own local storage, on your device (in the iPhone and Android apps, the app's own private storage):

• Your sign-in session, so that you stay signed in and the app can refresh the session without asking for your password again, with a note that this sign-in has already been checked on this device, so that reloading the page does not ask for a code twice. The phone apps also keep the time they first ran a version that makes that check, so that a sign-in from before an app update is not asked for a code out of nowhere.
• Your preferences: light or dark theme, language, the hide-balances toggle, and small layout choices such as whether the sidebar is collapsed or which chart range you last looked at.
• The inactivity clock: the time of your last activity, shared between tabs so that an idle tab does not sign out the one you are using. While the app is locked after 30 minutes without activity, a flag saying so is kept as well, so that reloading the page does not unlock it.
• A device identifier: a random value that lets the app recognise this browser in your sign-in history, and a short-lived value while a bank connection is being set up.
• A remembered-device token: if you tick "Remember this device" when you enter a sign-in code, a random value that lets this device skip that code next time. Our servers keep only a one-way hash of it. It stops working 90 days after the device was last used, and a year after it was verified at the latest, and you can remove it in Settings → Security. It survives signing out, so that signing back in on the same device does not ask again.
• A passkey marker: a flag noting that this device has been used with a passkey, so the sign-in page can offer it first, and one noting which account used it, so that only that account is offered a passkey to unlock the app. They survive signing out, because that is when they are needed, and hold nothing secret.

You can clear or block this storage from your browser's settings at any time. Clearing it signs you out and resets those preferences; nothing else is lost. Vercel Web Analytics, the only analytics in use, sets no cookie at all.

8. Email you receive

There is no marketing mailing list and no promotional email.

• Transactional email — verifying an address, resetting a password, a security alert such as a sign-in from a new device, and household invitations. These are part of holding an account and are not switchable, because an attacker who reached your inbox must not be able to silence the next warning by flipping a setting.
• Alerts and digests — a bank connection that has stopped working, a large transaction, a low balance, a category over budget, a bill coming due, and the spending digest. These start switched on. Every one of them can be switched off individually, or all at once, in Settings → Notifications, and every one of these messages carries a one-click unsubscribe link that works without signing in.

9. Your choices and rights

9.1 Access, correction and deletion

You can review, correct and change your account information at any time in Settings. You can delete your account yourself from Settings → Security, on the website or in the app: it removes your rows from the database, deletes your profile picture, and revokes any bank connections at Plaid first, so nothing is left connected. If you signed in with Apple and delete the account in the iPhone app, Apple asks you to confirm once more, and the app's access to your Apple account is then revoked at Apple as well. If you delete from the website, which cannot do that, you can remove the app yourself under Sign in with Apple in your Apple account settings. If you cannot sign in, the Delete your account page deletes it once you enter a code sent to the account's email address; an account with two-factor authentication has to be signed into instead, so that an email inbox alone cannot remove it. Deleting the account also cancels a Pro plan paid on the website. A subscription bought through the App Store or Google Play is billed by Apple or Google, which do not let anyone else cancel it, so you cancel it in your phone's subscription settings; the deletion screen and the confirmation email remind you. You can also ask for a copy of your personal data, or ask us to correct or delete it, by writing to support@myaifin.app. We will respond within a reasonable time and in accordance with applicable law. Some information may be kept where the law requires it or where it is needed to resolve a dispute or enforce an agreement.

You can also withdraw a consent you gave earlier: disconnect a bank in Settings → Institutions and the connection is removed at Plaid as well as here, and no further data comes in.

9.2 Getting your data out

Settings → Security has an export that downloads your debts, accounts, transactions, goals and settings as a JSON file, plus a CSV for debts, accounts, transactions and goals. It does not yet cover everything the app stores — budgets, categorisation rules, tags, comments and net-worth history are not in it. Ask at support@myaifin.app and we will get you the rest.

9.3 Email preferences

You can switch off every alert and digest in Settings → Notifications, or unsubscribe with one click from any of those messages. Security and account email — verification, password resets, sign-in alerts, changes to this policy — will still reach you, because they exist to protect the account.

9.4 Browser storage choices

Your browser lets you clear or block the local storage described in section 7. Blocking it will sign you out and may stop parts of the app from working, since that is where your session lives.

9.5 California privacy rights (CCPA/CPRA)

If you live in California, you have the right to:

• Know and access. Request the categories and specific pieces of personal information collected about you, where it came from, why it was collected or shared, and the categories of third parties it was shared with — which are listed in section 4 already.
• Correct. Request that inaccurate personal information about you be corrected.
• Delete. Request deletion of the personal information collected about you, subject to the usual exceptions (for example where it is needed to provide the Services, to detect security incidents, or to comply with a legal obligation).
• Opt out of sale or sharing. Your personal information is not sold and is not shared for cross-context behavioural advertising, so there is nothing to opt out of. If that ever changes, this policy changes first and an opt-out will be provided.
• Limit the use of sensitive personal information. Your financial account information is used only to provide the Services you asked for, which is a use that does not require this right to be exercised.
• Non-discrimination. Exercising any of these rights will not get you worse service or a worse price.

Send a request, yourself or through an authorised agent, to support@myaifin.app. We will verify who you are before acting on it.

9.6 Other state privacy rights

Residents of other US states with comprehensive privacy laws (Colorado, Connecticut, Virginia, Utah, Texas and others) have comparable rights to access, correct, delete and obtain a portable copy of their personal information, and to appeal a refusal. Use the same address and the same process; we do not intend to treat anyone differently based on where they live.

9.7 Nevada privacy rights

Nevada law lets you opt out of the sale of certain "covered information". As above, personal information is not sold. Questions go to support@myaifin.app.

10. Data retention

Your data is kept for as long as your account exists. Delete the account and the rows go with it, including your sign-in and device records, the notifications sent to you, the messages Plaid sent us about your bank connections and the billing events the app stores sent us about your subscription. Some records may be kept afterwards where the law requires it, or to resolve a dispute or enforce an agreement.

Accounts nobody uses are deleted. An account that nobody in its household has used for two years is deleted, and so is an account with nothing in it that has not been used for 90 days. "Used" means signing in, opening the app or the website while signed in, or an assistant you connected reading your data. Before anything is deleted we email the account's address twice, 30 days and 7 days ahead; signing in at any point cancels it, and Settings, Security lets you download your data first. An account that has ever had a paid subscription is never deleted this way, only when you ask. We keep a record that the account was deleted for inactivity, and when, but nothing else from it. Deleted data can remain in our database provider's backups for a short time before those expire.

Operational records are deleted on a schedule rather than kept indefinitely, whether or not you delete the account:

• After 12 months: sign-in history and security events shown in Settings, each sign-in and session record (counted from the last time the session was used), records of which notifications were sent, and finished two-factor recovery requests. A device not used to sign in for 12 months is forgotten, so signing in from it again counts as a new device.
• After 90 days: the activity log, the queue behind security alerts, the log of assistant requests, the messages Plaid sends about bank connections, and the cache that turns an IP address into an approximate location. That cache is kept by address, not by account, so an address can stay in it for up to 90 days after an account is deleted. The temporary tokens Plaid includes in messages about connecting a bank are removed before the message is stored.
• After two days: the log of attempts behind the rate limits.

11. Security

Data is stored in Postgres on Supabase, encrypted in transit and at rest, with row-level security policies in the database itself so that one household's rows cannot be read by anyone outside it whatever the app code does. Bank access tokens are encrypted with a key held only on the server. Two-factor authentication is available, and when it is switched on the database itself requires it, not just the sign-in screen. The full list of what is and is not in place, including what has not been done, is on the security page. No system is completely secure, and we would rather point you at specifics than promise you absolutes.

If you think you have found a security problem, please write to support@myaifin.app. What to include and what we promise in return is on the security page.

12. Children's privacy

You must be 18 or older to use the Services, on the web or in the apps, and personal information is not knowingly collected from anyone under 18. If we learn that an account belongs to someone under 18, we will close it and delete its data. If you are a parent or guardian and believe your child has an account, write to support@myaifin.app.

13. International users

The Services are aimed at people in the United States. If you use the app from elsewhere, your information may be transferred to, stored in and processed in the United States or in another country where one of the providers in section 4 keeps facilities, and the data-protection rules there may differ from those in your own country. Transfers will be handled in line with applicable law.

14. Changes to this policy

This policy will change as the app does. The updated version is posted here with a new "last updated" date. If a change is material — a new processor, a new category of data, anything that would make a reasonable person read it again — you will be told through the app or by email before or when it takes effect, not quietly.

15. Contact

Questions, requests and complaints about this policy or about how your data is handled go to Kind of Good Apps, LLC: