Privacy Policy

1. Information We Collect

1.1 Personal Information

When you create an account with Finance Forecaster, we collect:

• Account Information: Name, email address, password (encrypted)
• Profile Information: Optional demographic information for personalized insights
• Communication Data: Messages you send us for customer support

1.2 Financial Information

Through our integration with Plaid Inc., we securely access:

• Account Data: Bank account numbers, account types, balances, and account holder information
• Transaction Data: Transaction history, amounts, dates, merchant information, and categories
• Institution Data: Names and information about your financial institutions
• Identity Information: Account holder names and addresses associated with your accounts

1.3 Technical Information

We automatically collect certain technical information:

• Device Information: IP address, browser type, operating system
• Usage Data: Pages visited, features used, time spent on the application
• Log Information: Server logs, error reports, and security events
• Local Storage: Authentication tokens (JWTs) and user preferences are stored in your browser's local storage or, on mobile, in the device's secure storage. We do not use our own tracking cookies.
• Advertising Cookies: Our public website uses the Google Ads tag and the Meta Pixel to measure whether our advertising brings people to the site and whether they sign up. These tools set third-party cookies and collect technical information such as your IP address, browser type, the pages you view, and the actions you take (for example, joining the waitlist). They never receive your financial data. See Section 9.8 for details and how to opt out.

2. How We Use Your Information

2.1 Primary Services

• Financial Forecasting: Analyze your financial data to provide spending predictions and budget recommendations
• AI-Powered Insights: Generate personalized financial advice using artificial intelligence
• Account Management: Maintain your user account and provide customer support
• Goal Tracking: Help you set and monitor progress toward financial goals

2.2 Service Improvement

• Analytics: Understand how users interact with our service to improve functionality
• Security: Detect and prevent fraud, abuse, and security threats

We do not train machine-learning models on your personal or financial data. AI-powered insights are generated on demand by calling Microsoft Azure OpenAI; see Section 9 for how your data is sanitized before any AI call.

2.3 Communications

• Service Communications: Send account updates, security alerts, and service notifications
• Customer Support: Respond to your inquiries and provide technical assistance
• Marketing Communications: Send promotional emails (with your consent, which you can withdraw)

3. Information Sharing and Disclosure

3.1 We DO NOT Sell Your Data

Finance Forecaster does not sell, rent, or trade your personal or financial information to third parties for marketing purposes.

3.2 Limited Sharing

We may share your information only in these specific circumstances:

• Service Providers: With trusted third-party vendors who help us operate our service:
  • Plaid Inc. for secure bank connections
  • Microsoft Azure for cloud hosting, Azure OpenAI for AI-generated insights, Azure Application Insights for application monitoring, and Azure Communication Services for transactional email delivery
  • MongoDB Atlas for secure database hosting
  • Apple Push Notification service (APNs) and Google Firebase Cloud Messaging for mobile push notifications
  • Google Custom Search API for location-based cost estimation queries
• Advertising Measurement Partners: Google (Google Ads) and Meta Platforms (Meta Pixel) receive technical information and conversion events from our public website so we can measure our advertising. They do not receive your financial information, account balances, transactions, or bank connections. See Section 9.8.
• Legal Requirements: When required by law, court order, or government regulation
• Safety and Security: To protect against fraud, abuse, or security threats
• Business Transfers: In connection with a merger, acquisition, or sale of assets (with user notification)

3.3 Aggregated Data

We may use and share aggregated, anonymized data that cannot identify individual users for:

• Industry research and insights
• Service improvement
• Statistical analysis

4. Data Security

4.1 Encryption and Protection

• Data in Transit: All traffic between your device and our servers is encrypted using TLS.
• Data at Rest: Sensitive fields (including personal identifiers and financial account data) are encrypted at the application layer using AES-256-GCM, in addition to the encryption provided by our cloud database provider.
• Authentication: Accounts are protected by password hashing (bcrypt) and short-lived JSON Web Tokens. Optional multi-factor authentication (MFA) and biometric unlock (Face ID / Touch ID on supported devices) are available.
• Monitoring: We log security-relevant events (sign-ins, failed authentication, privileged actions) and review them for suspicious activity.

4.2 Plaid Security

Your bank account credentials are handled exclusively by Plaid Inc., a trusted financial technology company. Finance Forecaster never stores or has access to your banking passwords or login credentials.

4.3 Data Retention

• Active Accounts: We retain your data while your account is active.
• Inactive Accounts: Accounts with no sign-in activity for 18 months are flagged for deletion. We send you an email notice, and unless you sign in within the 30-day grace period, the account and its data are deleted.
• Legal Retention: A limited set of records may be retained longer where required by law (e.g., for tax, anti-fraud, or regulatory recordkeeping).
• Backup Data: Encrypted backups are retained for disaster recovery (maximum 90 days).

5. Your Privacy Rights

5.1 Access and Control

You have the right to:

• Access: Request a copy of the personal information we have about you
• Correct: Update or correct inaccurate personal information
• Delete: Request deletion of your personal information
• Export: Download your data in a portable format
• Restrict: Limit how we process your personal information

5.2 Account Management

• Account Deletion: You can delete your account at any time from your account settings
• Data Disconnection: You can disconnect bank accounts through Plaid at any time
• Communication Preferences: You can opt out of marketing communications

5.3 California Privacy Rights (CCPA)

California residents have additional rights including:

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt out of the sale or sharing of personal information. We do not sell personal information. The advertising cookies described in Section 9.8 may be considered "sharing" for cross-context behavioral advertising under the CPRA; you can opt out using the methods in that section or by emailing [email protected] with the subject "Do Not Sell or Share".
• Right to non-discrimination for exercising privacy rights

6. International Data Transfers

Your information may be processed and stored in the United States and other countries where we or our service providers operate. We ensure appropriate safeguards are in place for international transfers in compliance with applicable privacy laws.

7. Children's Privacy

Finance Forecaster is a financial application intended solely for adults. Our Terms of Service require users to be at least 18 years of age. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a minor, we will delete that information and close the associated account.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on our website
• Sending you an email notification
• Providing an in-app notification

Your continued use of Finance Forecaster after any changes constitutes acceptance of the updated Privacy Policy.

9. Third-Party Services

9.1 Plaid Inc.

We use Plaid Inc. to securely connect to your financial institutions. Plaid's privacy policy governs their collection and use of your information. You can review Plaid's privacy policy at: https://plaid.com/privacy/

9.2 Microsoft Azure

Our application is hosted on Microsoft Azure. Microsoft's privacy practices are governed by their privacy statement, available at: https://privacy.microsoft.com/privacystatement

9.3 Microsoft Azure Application Insights

We use Microsoft Azure Application Insights for application performance monitoring and error tracking. Telemetry is correlated by an internal user identifier so we can diagnose issues specific to your session. We do not intentionally send email addresses, passwords, bank account numbers, or Plaid tokens to Application Insights; however, URLs, request metadata, and unhandled error messages are captured and may in rare cases contain incidental personal data.

9.4 Google Custom Search

We use the Google Custom Search API for local cost estimation queries. Your ZIP code and city may be included in search queries to provide location-relevant results. Google's privacy policy applies to data processed by this service.

9.5 AI Insights and PII Sanitization

AI-generated forecasts and insights are produced by calling Microsoft Azure OpenAI from our backend. Before any prompt is sent, we run an automated sanitization step that replaces personal identifiers — including names, street addresses, ZIP codes, and bank account numbers — with non-identifying tokens. The AI provider receives only the sanitized prompt. Responses are de-tokenized on our servers before they are shown to you. We do not permit the AI provider to use your data to train their models.

9.6 Push Notifications

If you enable push notifications in our mobile app, we register a device-specific push token with Apple (APNs) or Google (Firebase Cloud Messaging) and store it so we can deliver alerts (for example, buffer warnings, forecast shifts, and weekend budget reminders). You can disable push notifications at any time in your device settings or in the app.

9.7 Biometric Authentication

On supported mobile devices you can sign in using Face ID or Touch ID. Biometric matching happens entirely on your device, inside the operating system's secure enclave. Finance Forecaster never receives, transmits, or stores your fingerprint or face data — we only receive a pass/fail result from the operating system.

9.8 Advertising Measurement (Google Ads Tag and Meta Pixel)

We advertise Finance Forecaster on Google and Meta platforms (Facebook and Instagram). To understand whether those ads are working, our public website loads two measurement tools:

• Google Ads tag (gtag.js), provided by Google LLC, on our website pages, including the home page, waitlist page, and free calculators.
• Meta Pixel, provided by Meta Platforms, Inc., on our marketing pages only: the home page, waitlist page, and free calculators.

Neither tool is loaded inside our iOS or Android apps.

What they collect. These tools set cookies in your browser and send Google or Meta your IP address, browser and device information, the page you are viewing and the page that referred you, and the events we report: a page view, and a conversion when you join the waitlist or request a full calculator result. If you are signed in to a Google or Meta account, those companies may associate this activity with your account under their own privacy policies.

What they never receive. Our code does not send your name, email address, password, bank connections, account balances, transactions, forecasts, or any other financial information to Google or Meta. These tools simply never have access to that data.

How to opt out. You can:

• Block or delete third-party cookies in your browser settings, or use a browser extension that blocks advertising trackers. The website works normally without these cookies.
• Control how Google uses advertising data at adssettings.google.com and read Google's advertising policy at policies.google.com/technologies/ads.
• Control how Meta uses advertising data at facebook.com/ads/preferences and read Meta's privacy policy at facebook.com/privacy/policy.
• Email [email protected] with the subject "Do Not Sell or Share" and we will honor the request as described in Section 5.3.

10. SMS Messaging

10.1 SMS Assistant Opt-In

If you choose to use the Finance Forecaster SMS Assistant, you may opt in to receive automated text messages from us. Opt-in happens exclusively inside the Finance Forecaster mobile app: you enter your mobile number, tap "Send verification code," and confirm ownership of the number by entering a 6-digit code we send to it. Tapping "Send verification code" is your consent to receive SMS. We do not collect phone numbers for SMS through any other channel.

For a step-by-step walkthrough of the opt-in flow, see finance-forecaster.com/sms.html.

10.2 Message Content, Frequency, and Costs

• What we send: a one-time verification code at sign-up, then replies to your own user-initiated text messages with the assistant. We never send marketing or promotional SMS.
• Message frequency varies. Frequency depends on how often you choose to text the assistant; the system is capped at up to 30 messages per hour and 100 messages per day per user.
• Message and data rates may apply. Standard messaging rates from your wireless carrier apply to messages sent and received.

10.3 Opting Out and Getting Help

You can stop receiving SMS at any time by replying any of STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, or QUIT to any message from the toll-free number. We will send one final confirmation message and then stop. To re-enable SMS later, return to Settings → SMS Assistant in the app and re-verify your number.

You can request help at any time by replying HELP or INFO. We will reply with contact information and a reminder that you can opt out by replying STOP.

10.4 Phone Number Sharing

Your phone number and the contents of your SMS conversations with the assistant will not be shared with or sold to third parties for marketing or any other promotional purpose. We use the number solely to: (a) send the verification code at opt-in, (b) deliver replies to messages you send the assistant, and (c) honor STOP/HELP keyword requests as required by U.S. carrier regulations. Phone numbers are encrypted at rest using AES-256-GCM.

10.5 Carrier Disclaimer

Mobile carriers are not liable for delayed or undelivered messages.

11. Contact Us

12. Regulatory Compliance

Finance Forecaster is designed to meet its obligations under applicable U.S. privacy and financial regulations, including:

• GLBA: Gramm-Leach-Bliley Act (Financial Privacy Rule and Safeguards Rule)
• CCPA / CPRA: California Consumer Privacy Act, as amended

We extend CCPA-style access, deletion, correction, and portability rights to all users regardless of location. If you are located outside the United States, please be aware that your information will be processed in the United States, which may not provide the same level of data protection as your home jurisdiction.

---

Finance Forecaster - Secure, AI-Powered Financial Forecasting
© 2026 Finance Forecaster. All rights reserved.