Privacy Policy

Depending on how you use Denareon, we may collect:

• Account information: Name, email, authentication method (email/password or OAuth from Apple or Google), profile preferences, subscription status, and security settings such as two-factor authentication.
• Financial information: With your authorization, read-only data via Plaid, Stripe, Teller, TrueLayer, Belvo, or SnapTrade — account names, balances, transactions, holdings, and metadata. We do not store banking login credentials; provider tokens are encrypted at rest.
• User-provided records: Budgets, goals, properties, debts, manual transactions, imports, and other data you enter.
• Device and technical data: Browser or app type, OS, push notification tokens, IP address, and diagnostic logs for performance, fraud prevention, rate limiting, and sign-in risk classification.
• Marketing analytics: See Analytics in plain English — Umami on public pages only.
• Product activation metrics: See Analytics in plain English — scrubbed first-party events in the signed-in product.
• Biometric data: Processed locally on your device if you enable Face ID or Touch ID; we do not transmit or store raw templates.
• AI feature context: When you use AI features, relevant financial context may be sent to Google Gemini and/or xAI Grok to generate a response. You initiate these requests; we do not use them for advertising profiles.

How we collect: Directly from you (registration, settings, data entry, support); through financial integrations you authorize; automatically via server logs, session cookies, push tokens, and security monitoring; through cookieless Umami on public pages; and through email delivery webhooks from our provider.

Before a connected-account flow, we record your consent to collect and store the financial data needed for that connection. You can disconnect linked accounts anytime in Settings.

We use collected information to:

• Provide, maintain, and personalize dashboard, budgeting, net worth, and planning features.
• Sync, categorize, and display linked account and transaction data you authorize.
• Process subscriptions and billing through payment partners.
• Send transactional communications (verification, password reset, security alerts) and, where permitted, service-related updates.
• Detect fraud, abuse, and unauthorized access; enforce rate limits; protect platform integrity.
• Measure marketing effectiveness and product activation using the methods described in Analytics.
• Improve reliability, debug issues, and develop new features.
• Comply with legal obligations and respond to lawful requests.

Where applicable law requires a legal basis (for example, under the GDPR), we rely on:

• Contract: Processing necessary to provide the service you signed up for.
• Legitimate interests: Security monitoring, fraud prevention, product improvement, and aggregated marketing measurement — balanced against your rights.
• Consent: Connecting financial accounts, enabling optional notifications, and other flows where we ask for explicit permission.
• Legal obligation: Retention or disclosure required by law.

This section is provided for transparency and is not legal advice. Consult qualified counsel for jurisdiction-specific obligations.

We do not rent, sell, or trade your personal information. Information is shared only when:

• Service providers: See Who helps us run the service for our current subprocessors, subject to contractual confidentiality and security obligations.
• Legal obligations: When required by subpoena, court order, or applicable law.
• Business transfers: In connection with a merger, acquisition, or asset sale, subject to continued protection of your information.
• With your direction: When you explicitly authorize an integration or export.

We implement organizational, technical, and physical safeguards appropriate to financial data. Sensitive stored data, including banking access tokens, is encrypted at rest using AES-256-GCM. Data in transit is protected with TLS.

No method of transmission or storage is completely secure. For a deeper technical overview, visit our Security Architecture page or email [email protected].

We retain personal and financial information while your account is active and as needed to provide the service, resolve disputes, enforce agreements, and meet legal requirements.

When you delete your account in Settings → Account, we begin removing personal identifiers, financial connection tokens, and user-generated records. Most data is purged within 30 days, unless a longer period is required by law (for example, billing records or fraud-prevention logs).

Aggregated or de-identified analytics that cannot reasonably be linked back to you may be retained for product measurement.

Depending on where you live, you may have rights to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion, subject to legal and operational limits.
• Object to or restrict certain processing.
• Withdraw consent where processing is consent-based.
• Portability of data you provided, where applicable.

Financial apps must balance privacy rights with fraud prevention, regulatory record-keeping, and active subscription obligations. We may verify your identity before fulfilling a request and may decline requests that are excessive, unfounded, or incompatible with secure service delivery.

Email [email protected] or use your in-app controls to disconnect integrations and delete your account.

If you are a California resident, the CCPA (as amended) may provide additional rights including the right to know what personal information we collect, delete certain information, and correct inaccurate information.

We do not sell or share personal information for cross-context behavioral advertising. We do not discriminate against you for exercising privacy rights.

Submit requests to [email protected]. We will verify your request in line with applicable law. This section is a summary for convenience and is not legal advice.

Denareon is not directed to children under 13 (or under 16 where applicable law sets a higher age threshold), and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will take steps to delete it.

Denareon is operated from the United States. If you access the service from outside the US, your information may be processed in the United States and other countries where our service providers operate. Those countries may have data protection laws that differ from your jurisdiction.

Where required, we implement appropriate safeguards (such as standard contractual clauses) for cross-border transfers. Contact us for more information about transfer mechanisms relevant to your region.

We may update this Privacy Policy as our product, providers, or legal requirements evolve. When we make material changes, we will update the "Last Updated" date and, where appropriate, provide additional notice (such as email or in-app notification). Continued use after changes take effect constitutes acceptance of the revised policy.

Questions, concerns, or privacy requests: