The thing we will never build
There is no bank connection. No login, no aggregator, no read access to any account you hold, on any plan, at any point.This is architectural rather than a setting. There is no facility to connect
a bank, so there is nothing to enable, nothing to misconfigure and nothing to
breach. A product that never asked for your banking credentials cannot leak
them.
Three layers
Privacy here is enforced in three independent layers, so that it never rests on a policy statement alone.1
Architecture: the capability does not exist
No bank integration, no aggregator relationship, no credential storage.
The first layer is the one that cannot fail, because there is nothing there
to fail.
2
The database: every row is scoped to its owner
Access rules are enforced by the database itself rather than by application
code remembering to filter. A query that forgot a condition returns
nothing, not somebody else’s book.
3
Policy: what we commit to in writing
The Privacy Policy states what is
collected, why, and for how long. It is the third layer because it is the
weakest one: a promise is only as good as the two mechanisms under it.
Document parsing
Parsing a document is the one place your data is read by a system we do not operate, so the boundary is worth stating exactly. Text-based documents are stripped before anything is sent. A sanitisation step runs on our own servers first and removes email addresses, phone numbers, card and account numbers, and your name wherever a document labels it as the account holder. What the model receives is amounts, dates, descriptions and currencies, with no identity attached and no indication of whose document it is. A vendor name is data and stays. “Adobe” on a subscription invoice is exactly what the extraction has to read, so counterparties are never removed. The line is drawn at you, not at the document. Nothing reaches your book until you approve the extracted fields, and the uploaded file is deleted the moment you approve or dismiss it. The Privacy Policy names every provider involved and states what each one receives.What this means in practice
You choose what is recorded
Every entry is one you made or one you confirmed. Nothing arrives on its
own from an account we can see.
No session recording
We do not record your screen or replay your sessions.
Your IP is not stored
Product analytics runs without retaining it.
Deletion is real
No soft delete, no archived copy kept behind the scenes.
Next: what we collect
A plain-language inventory of every category of data.