Privacy Policy

1. Scope and Roles

This Policy applies to personal information we collect through the Service. It does not apply to third-party websites, apps, or services that we do not control, including financial institutions and data aggregators such as Plaid.

For account-linking features, Plaid may act as a service provider or independent controller depending on the activity. Plaid's own privacy policy governs its collection and use of information you provide when linking accounts: https://plaid.com/legal.

Budgetnik is a read-only personal finance tool. We do not move money, initiate payments, or execute transactions on your behalf.

2. Information We Collect

Account information you provide: name, email address, phone number, and password (stored only as a cryptographic hash).

Verification and security data: email and phone verification status, session metadata (such as device user agent and IP address used for security logging), authentication tokens stored according to our security architecture, and delivery records for verification text messages (described in Section 6).

First-party product analytics: a small set of named events we store on our servers (for example, an allowlisted website path without its query string or fragment, which dashboard screen you opened, or that you started or finished linking a bank). Pre-login visits may include IP address, user-agent, coarse country, landing path, external referrer without its query string or fragment, and optional campaign parameters so we can measure who is interested in Budgetnik and who signs up. After you create an account, usage events are linked to your account and login session. We do not record transaction amounts, merchants, account numbers, form values, click maps, session replay, or precise device location in this log. We do not use third-party analytics, advertising, or tracking SDKs.

Financial information you choose to link: account names, masks, institution names, balances, credit limits, transaction details (amounts, dates, merchants, categories), recurring payment streams, and related metadata received from Plaid or your financial institutions. We do not receive or store your bank login credentials.

Subscription information: whether your account has a trial, complimentary grant, or paid plan, the store or web checkout that billed you (Apple, Google, or Stripe), a product identifier, and the current period start and end. We use your Budgetnik account id as the billing customer id. We do not receive or store your card number, bank account for payment, or full receipt.

Usage and technical information: app interactions, feature usage needed to operate the Service, and technical logs used for security, debugging, and reliability.

Communications: messages you send to us for support or privacy requests.

3. How We Collect Information

Directly from you when you register, verify contact information, link accounts, change settings, or contact us.

Automatically when you use the Service, including through cookies or similar technologies where applicable for authentication, session management, and first-party product analytics (including an HttpOnly visitor cookie on the website and a random visitor identifier stored on the mobile app).

From third parties you authorize, primarily Plaid and your financial institutions, to provide account and transaction data you request to view in Budgetnik.

4. How We Use Information

Provide, operate, maintain, and secure the Service, including authentication, account linking, transaction display, charts, and settings.

Understand how the Service is used (screens, acquisition funnel, and retention) using first-party events stored in our database. We do not sell this information or use it for cross-context advertising.

Verify your identity and contact information, prevent fraud and abuse, and enforce our Terms.

Respond to support and privacy requests and communicate service-related notices.

Improve reliability and fix errors using aggregated or de-identified insights where possible.

Comply with law, respond to lawful requests, and protect rights, safety, and security.

5. We Do Not Sell or Share Personal Information for Advertising

We do not sell your personal information.

We do not share your personal information for cross-context behavioral advertising.

We do not use third-party product analytics, advertising, or session-replay providers.

We do not rent your personal information to third parties for their own marketing.

We use personal information to provide the Service you request, not to build advertising profiles about you.

6. SMS and Text Messaging

Budgetnik SMS verification program: Coppernik LLC, doing business as Budgetnik ("Budgetnik"), sends one-time SMS verification codes for account security (for example, to confirm signup or a phone number change). These messages are transactional only; we do not send marketing or promotional text messages.

We obtain SMS consent only through a separate, unchecked SMS consent checkbox when you create a Budgetnik account or change your phone number. Providing a phone number alone is not SMS consent.

Message and data rates may apply. Message frequency: one SMS per verification attempt when you sign up or change your phone number, plus an additional message only if you request a new code using the resend option. Reply HELP for help, STOP to opt out. For support, email privacy@budgetnik.com or visit https://budgetnik.com.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. We do not share, sell, rent, or provide your mobile phone number or SMS opt-in or messaging consent data to third parties or affiliates for their marketing or promotional purposes.

We use SMS delivery service providers only to transmit messages we send to you on our behalf. Those providers process your phone number solely to deliver our verification texts and do not use your number or consent data for their own marketing.

Delivery records: to operate the program, prevent abuse, and troubleshoot failed texts, we keep a record of each verification text we attempt to send. The record contains the time, the reason for the text (signup, resend, or phone number change), whether our SMS provider accepted, rejected, or could not be reached for the message (including a provider error code and the provider's message identifier, and whether you opted out by replying STOP), and a one-way hash of the phone number. It does not contain your phone number in cleartext, the message text, or the verification code. Our SMS provider keeps its own delivery logs as part of providing its service.

7. When We Disclose Information

Service providers that help us run the Service under contractual confidentiality and security obligations, including hosting, database, email/SMS delivery, and Plaid for account connectivity.

Apple, Google, Stripe, and RevenueCat, so they can charge a subscription you start and tell us whether that subscription is active. We send them your Budgetnik account id. They do not receive your bank transactions through that billing connection.

Your financial institutions and Plaid, as necessary to establish and maintain connections you authorize.

Professional advisors (such as lawyers or accountants) under confidentiality obligations, when needed.

Law enforcement, regulators, or other parties when required by law, legal process, or to protect rights, safety, and security.

A successor entity in connection with a merger, acquisition, or asset sale, subject to this Policy or a successor policy with notice as required by law.

We do not disclose personal information to third parties for their independent marketing.

8. Data Retention

We retain personal information for as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements.

Financial data linked through Plaid is retained while your connection remains active. When you unlink a bank or use "Remove all financial data" in Settings, we delete the associated accounts, transactions, and related records from our systems, subject to backup retention for a limited period as described below.

Your sign-in profile (email, phone, name, password hash) is retained until you delete your account in Settings, request deletion by email, or we close your account.

When you delete your account, we remove your profile and financial data from active systems and revoke all sessions. We retain a minimal tombstone record for fraud prevention and audit purposes that does not include your name, email, or phone in cleartext. That record includes a one-way hash of contact identifiers (where applicable), your former internal user identifier, account creation and deletion timestamps, terms acceptance metadata, and optional security context (such as the IP address used for the deletion request). Tombstone records are kept for up to seven (7) years unless a longer period is required by law.

Subscription status is kept while your account exists and removed with the account, except the tombstone flag that records whether a trial was already used.

Security and audit logs may be retained for a limited period for fraud prevention and operations even after data removal.

First-party product analytics: we keep events tied to an account for up to thirteen (13) months. Visitor records for people who never create an account, and their events, are deleted after ninety (90) days of inactivity. Deleting your account also deletes your analytics events and visitor records.

Verification text delivery records are deleted after ninety (90) days, or when you delete your account if that happens first.

9. Security

We use administrative, technical, and organizational measures designed to protect personal information. Sensitive account fields—including your email address, phone number, and name—are stored encrypted at rest in our database. We also use encryption for Plaid access tokens, one-way hashing for passwords and verification codes, authenticated API access, and scoped data access per user.

No method of transmission or storage is completely secure. You are responsible for safeguarding your password and devices.

10. Your Choices and Rights

Account settings: update your profile information and manage linked banks in the Service.

Remove financial data: use Settings → "Remove all financial data" to delete all linked banks, accounts, transactions, and related financial records stored in Budgetnik while keeping your sign-in profile.

Delete account: use Settings → "Delete account" to permanently delete your profile, all financial data, and all active sessions. You may register again later with the same email address unless your account was closed for abuse or legal reasons.

Unlink one bank: remove a single institution and its data without deleting your entire financial history.

Revoke Plaid access: you may also revoke Budgetnik's access through your financial institution's connected-app settings.

Access, correction, and deletion requests: you may delete your account in Settings or email privacy@budgetnik.com from the address associated with your account. We will verify your request and respond as required by applicable law. You may also request access to personal information we hold or correction of inaccurate information.

Authorized agents: where required by law, you may designate an authorized agent to submit a request on your behalf with proof of authorization.

11. California Privacy Rights (CPRA)

If you are a California resident, you may have the right to know what personal information we collect, use, and disclose; to request deletion or correction; to limit use of sensitive personal information to what is necessary to provide the Service; and not to receive discriminatory treatment for exercising privacy rights.

We do not sell or share personal information as those terms are defined under California law.

Financial account and transaction information you link is treated as sensitive personal information and is used only to provide the Service you request.

To exercise California rights, email privacy@budgetnik.com with the subject line "California Privacy Request." We will verify your identity before fulfilling the request.

12. Other U.S. State Privacy Rights

Residents of other states with consumer privacy laws may have similar rights regarding access, deletion, correction, and opting out of certain processing. Contact privacy@budgetnik.com to exercise rights available in your state.

We will update this Policy as additional state requirements apply to our operations.

13. Children

The Service is not directed to individuals under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, contact privacy@budgetnik.com and we will take appropriate steps to delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated Policy, revise the version and effective date, and provide reasonable notice when practicable (for example, by email or in-app notice).

Your continued use of the Service after an updated Policy becomes effective constitutes acceptance of the updated Policy, subject to your rights under applicable law.

15. Contact Us

Coppernik LLC (d/b/a Budgetnik)

Florida, United States

Privacy requests and questions: privacy@budgetnik.com

Please include the email address associated with your Budgetnik account so we can verify your request.