How we protect your data

All traffic is served over HTTPS/TLS. The database is encrypted at rest. Plaid bank access tokens are encrypted with AES-256-GCM using a unique random IV per token. Encryption keys live in server environment variables — never in code, and never in the database in plaintext.

Your bank username and password never touch our servers. Login happens inside Plaid's hosted flow. We store only the encrypted access token needed to refresh balances and transactions you authorized.

Card payments are processed by Stripe. We never see or store full card numbers — only Stripe customer and subscription identifiers.

Every database table enforces row-level security so you can only ever see your own data. Authentication is via Supabase Auth with session cookies.

The application is hosted on Vercel. Database and auth run on Supabase. Secrets live in managed environment variables, never in the repository.

We don't sell your data. We don't run third-party ad trackers.

Disconnect bank and marketplace links anytime — that purges the stored tokens. Export your data, or request full account deletion.

Found a security issue? Email [email protected] — we take reports seriously.

We're a small team following industry-standard practices. No system is perfectly secure, and we'll disclose incidents that affect user data.

See also Privacy policy and Terms of use.