Privacy policy
Version 2026-11-draft.
DRAFT — pending review by qualified counsel. This draft describes how the software is built today. It is not final and has not been reviewed for compliance with GLBA / FTC Safeguards Rule, FCRA, state privacy laws or other requirements. Not in effect: registration, accounts and purchasing are not open yet.
What we collect
- Account: name, email, a password hash (never your password), sign-in session records.
- Information you choose to enter: income, debts, expenses, savings, goals, loan offers, and self-reported credit scores with their dates, models and sources.
- Documents you upload: loan estimates, dealer worksheets and similar files.
- Interest sign-ups: name and email from the homepage form, with your consent.
- Payments: handled by Stripe. We receive payment status and receipt details, not your full card number.
- Security logs: hashed IP addresses and activity records used for fraud prevention and auditing.
What we do not collect
- Social Security numbers. Do not enter them anywhere; our forms reject SSN-like values.
- Full credit reports, live credit pulls or live bank connections — none exist at launch.
How we protect it
- Encryption in transit (HTTPS) and at rest; sensitive profile fields and reports are additionally encrypted by the application.
- Documents are stored privately with no public links and are only retrievable by authorized, signed-in users.
- Every request is checked against your household role and your sharing choices.
Sharing
- Household members see your scores, income, debts, savings or documents only if you explicitly share that category with them. You can revoke sharing at any time.
- Banks and credit unions that provide your license see only license status (issued / activated). They cannot see your financial data without your separate, explicit authorization — a feature that is not enabled at launch.
- Service providers (hosting, payments, email delivery) process data on our behalf.
- We do not sell personal information.
Your choices
- Export all your data and delete your account from portal settings.
- Withdraw marketing consent at any time.
- Questions: see Contact.
Retention
Uploaded documents are retained until you delete them or your account, subject to a retention limit shown in the portal. Payment and license records are kept as required for accounting and legal obligations, minimized to what is necessary.