Privacy Policy | Your Money Plan

1. Introduction

Welcome to Your Money Plan ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy in accordance with global data protection regulations including GDPR, CCPA, and emerging AI governance frameworks. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered financial management application.

2. Information We Collect

We collect information that you provide directly to us, including:

Account information (email address, name, encrypted password)
Financial data (expenses, income, budget allocations, account balances)
Receipt images, voice notes, and extracted data processed by AI
WhatsApp phone numbers and message content (for the logging, coaching, and conversation-history features you use)
Usage patterns, preferences, and interaction data
Device information, IP address, and browser type
Profile location (city or region), ZIP or postal code, household size, and optional Community Data research preferences such as household makeup, housing situation, transportation pattern, and cost priorities
Your optional gender answer and separate Nexus call-voice preference; a Female or Male onboarding answer initializes the corresponding voice preference, which you can change later
Community research context (such as general, Jewish, Orthodox Jewish, or young Jewish family) only when you explicitly select it before starting local research

3. AI Data Processing & Machine Learning

Your Money Plan uses artificial intelligence to enhance your experience. Here's how:

Receipt & Expense Parsing: Images, voice notes, and text messages may be sent to Google Gemini AI to extract financial data. Provider retention depends on the Gemini service and features used; it is not accurate to describe every Gemini request as zero-retention.
Financial Coaching: Our AI coach analyzes your spending patterns to provide personalized insights. All analysis happens within your secure account context.
Categorization: AI automatically categorizes expenses based on merchant names and item descriptions.
Local Community Data Research: This optional feature sends your saved city, region, or ZIP/postal code, household size, optional household makeup, housing situation, transportation pattern, cost priorities, and the research context you select to Gemini with Google Search grounding. It does not send your income, transaction amounts, descriptions, or notes in that request. Google states that Search-grounding prompts, contextual information, and generated output are stored for 30 days for grounded results, debugging, and testing, and that this storage cannot be disabled while using Search grounding.
Model Training: We do not train our own AI models on your personal financial data. Google states that prompts and responses submitted through its Paid Services are not used to improve its products; Google's applicable terms and feature-specific retention rules still govern its processing.
Review Before Acting: AI output can be incomplete or wrong. Source links and calculated ledger evidence are shown where available so you can verify important information.

See Google's Gemini data-retention documentation for the provider's current details.

4. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our services
Process and categorize your expenses using AI
Generate personalized financial insights and coaching
Convert currencies using real-time exchange rates
Send notifications, weekly summaries, and account alerts
Process WhatsApp messages for expense logging
Use your saved call-voice preference when Nexus speech is available
Respond to your comments and support requests
Detect and prevent fraud, abuse, and security threats
Comply with legal obligations

5. Data Storage & Security

Your data is stored securely using enterprise-grade infrastructure:

Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
Authentication: Secure Firebase Authentication with optional two-factor authentication
Access Control: Row-level security ensures you can only access your own data
Infrastructure: Google Cloud Platform with SOC 2 Type II certification
Regular Audits: Quarterly security assessments and penetration testing
Incident Response: 24-hour breach notification commitment

No method of transmission over the Internet is 100% secure. While we implement industry-leading security measures, we cannot guarantee absolute security.

6. Third-Party Services & Data Sharing

We use the following third-party services to provide our application:

Google Firebase: Authentication, database, and hosting
Google Gemini AI: Receipt parsing, categorization, coaching, and optional source-grounded local research; retention varies by feature, including the 30-day Search-grounding retention described above
Meta WhatsApp Business API: WhatsApp message routing and delivery under Meta's applicable terms and retention practices
Twilio: SMS and phone-call routing when you connect a phone number
xAI: Speech synthesis for supported Nexus phone calls; the text Nexus speaks and your selected voice are used to generate call audio
Exchange Rate API: Currency conversion (no personal data shared)
Vercel: Application hosting and edge computing

7. Aggregated & Anonymized Data

To improve our services and support financial research, we may create aggregated, de-identified datasets from user activity, including insights derived from the general location (city, region, or country) you choose to provide. This data:

Is fully anonymized and cannot be traced back to any individual user
Contains no personal identifiers, account numbers, email addresses, phone numbers, or other contact information
Reflects general spending trends, category patterns, and behavioral insights at a population level
May include location-based patterns — for example, spending, budgeting, or cost-of-living trends grouped by city, region, or country — derived from the profile location you provide

We reserve the right to share, license, or sellthese anonymized, aggregate insights — including location-based aggregate insights derived from the general location you provide — to third parties for research and commercial purposes, including research institutions, financial service providers, and analytics partners. This helps us sustain and improve the service while contributing to broader financial research. Where applicable law grants you the right to opt out of the “sale” or “sharing” of personal information (for example, under the CCPA/CPRA), you may do so by contacting us at hello@yourmoneyplan.app.

We never sell or share your personal financial data, your mobile phone number, your SMS opt-in information, or any other data in a form that identifies you. Only statistical summaries and trends derived from large user populations are ever shared or sold externally, and only in aggregated, de-identified form.

8. WhatsApp Integration Privacy

When you connect WhatsApp to Your Money Plan:

We process messages exchanged with our business number, including replies Nexus sends for the features you use
We never access your other WhatsApp conversations
Phone numbers are stored encrypted and used only for message routing
You can disconnect WhatsApp at any time, which removes your phone number from our system
Message content and related processing status may be stored in your account's WhatsApp conversation history so you can review the exchange and any logged expense

9. SMS & Voice Messaging (Text/Call)

Your Money Plan offers an optional SMS (text message) and voice call service that lets you log expenses and receive financial coaching by texting or calling our dedicated phone number. This section explains how that program handles your information:

Consent & Opt-In:In the app, you opt in by checking the optional SMS consent box before linking and verifying your mobile number (Settings → SMS & Phone Calls). You may also opt in by initiating the SMS signup flow from your mobile number. We may send account, onboarding, expense logging, reminder, coaching, and customer support messages. We do not send unsolicited marketing texts, and SMS consent is not a condition of purchase or account creation.
No Sharing or Selling of Mobile Information: We do not share, sell, rent, or disclose your mobile phone number or SMS opt-in information to any third parties or affiliates for their marketing or promotional purposes. Mobile opt-in data is used solely to operate the messaging service. No mobile information will be shared with third parties for marketing under any circumstances.
Message Frequency: Message frequency varies based on your interactions and the account reminders you enable.
Message & Data Rates:Message and data rates may apply. Your wireless carrier's standard messaging and data charges will apply to messages you send and receive.
Opt-Out: You can opt out at any time by replying STOP to any text message, or by removing your number in Settings. Reply HELP for assistance.
Message Content: Text and voice content is processed only to extract expense details and provide coaching responses, consistent with the AI processing described above.
Carriers: Mobile carriers are not liable for delayed or undelivered messages.

10. Cookies & Tracking

We use only essential cookies required for application functionality (authentication, session management, preferences). We do NOT use third-party advertising cookies, tracking pixels, or sell data to ad networks. You can control cookie settings through your browser preferences.

11. Your Privacy Rights

Depending on your location, you have the following rights:

Access: Request a copy of all personal data we hold about you
Rectification: Correct any inaccurate or incomplete data
Erasure: Request deletion of your data ("right to be forgotten")
Portability: Export your data in a machine-readable format (JSON/CSV)
Restriction: Limit how we process your data
Objection: Object to certain types of processing, including AI analysis
Withdraw Consent: Revoke consent for optional processing at any time
AI Explanation: Request human explanation of AI-driven decisions affecting your account

To exercise these rights, contact us at hello@yourmoneyplan.app or use the data management tools in your account Settings.

12. Data Deletion

You have the right to request complete deletion of your account and all associated personal data at any time. There are two ways to do this:

Self-service (immediate): Go to Settings → Danger Zone → Delete Account. Your account and data will be permanently removed within 30 days.
By request: Email hello@yourmoneyplan.app with subject line "Data Deletion Request" and your registered email address. We will confirm deletion within 72 hours and complete it within 30 days.

Note: Legal and compliance records required by law may be retained for up to 7 years in anonymized form. Backup systems purge deleted data within 90 days.

13. Data Retention

We retain your personal information for as long as your account is active. After account deletion:

Personal data is deleted within 30 days
Anonymized analytics data may be retained for product improvement
Legal/compliance records are retained as required by law (typically 7 years)
Backup systems purge deleted data within 90 days

14. Children's Privacy

Your Money Plan is not intended for users under 16 years of age. We do not knowingly collect personal information from children. If we discover that a child has provided us with personal information, we will delete it immediately.

15. International Data Transfers

Your data may be processed in the United States and other countries where our service providers operate. We ensure appropriate safeguards through Standard Contractual Clauses (SCCs) and adequacy decisions where applicable.

16. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes via email and/or in-app notification at least 14 days before they take effect. The "Last updated" date at the top indicates when this policy was last revised.

17. Contact Us

For all privacy-related questions, data requests, deletion requests, or to exercise your rights under GDPR/CCPA:

All inquiries: hello@yourmoneyplan.app

Data deletion requests: hello@yourmoneyplan.app (subject: "Data Deletion Request")

Response time: Within 72 hours acknowledgment, 30 days resolution (GDPR compliant)

Self-service: Settings → Danger Zone → Delete Account