Privacy

• Early-access list: your email, the role and bank you chose, which part of the site you signed up from, and the time.
• Connected bank data: account names and balances and the transaction history your bank’s API returns (the analysis uses the last twelve months), including vendor descriptions and the cardholder on each card charge. Runway only calls read endpoints. We never see or store your bank login.
• What you do in the app: findings you accept or dismiss, drafts you approve, and agent run summaries, so the app remembers your decisions.
• The free grader: nothing. Your CSV is read in your browser and never uploaded.

We don’t sell or rent your data, show ads, or use advertising or analytics trackers. The public site sets no cookies; the live demo keeps any category fixes you make in a cookie in your own browser, so nobody else sees them. Bank data is used only to produce your own analysis.

• Vercel hosts the app.
• Supabase stores the database (Postgres), in the region the deployment is configured for.
• OpenAI, only when AI features are switched on. It receives the transaction descriptions of unfamiliar vendors (to label them); when you ask Copilot a question, the computed figures and the individual transactions it looks up (date, amount, vendor, category and cardholder name); and the context needed to write drafts.
• Slack, only if you connect the Monday digest: it receives the digest text.

Early-access entries are kept until early access ends or you ask us to remove yours. Connected bank data is kept while your account is active and deleted when you disconnect and ask for deletion.

You can ask what we hold about you, ask for a copy, or ask for it to be deleted, at any time. Send a private message through GitHub’s private reporting form (only the maintainer can read it). Please don’t post personal details in a public issue.

If this policy changes in a way that matters, people on the list and connected customers hear about it before it takes effect.