Privacy Policy

Accountrix ("we", "us", "our") provides a personal-finance tracking application (the "Service"). This Privacy Policy explains what we collect, why, how we use it, and the choices you have. By using Accountrix, you agree to the practices described here.

1. Information we collect

Account information

• Name and email address you provide at signup.
• Password, stored as a bcrypt hash — never in plaintext.
• Preferences such as currency, theme, notification settings.

Financial information you enter

• Transactions, budgets, savings goals, recurring rules, accounts and investment holdings you create in the app.
• Transactions imported via connected bank providers (see Section 3).

Automatically collected

• IP address (used for brute-force protection on login).
• Session cookies (httpOnly, Secure, SameSite=Lax) that authenticate you.
• Web-push subscription endpoints (only if you enable push notifications).

We do not collect device advertising IDs, precise geolocation, contacts, or biometric data. We do not use third-party advertising or analytics trackers.

2. How we use your information

• To provide the core features: budgets, analytics, insights, reports, notifications.
• To send transactional emails (password reset, budget alerts, weekly digest) via our email provider.
• To generate AI insights (see Section 4).
• To protect the Service — rate-limiting, fraud prevention, security incident response.

3. Bank integrations (Plaid & Mono)

If you connect a bank account, we use Plaid (US/EU) or Mono (Nigeria) as an intermediary. When you go through their consent flow, you authenticate directly with your bank — Accountrix never sees your online-banking credentials. Plaid and Mono then send us a scoped access token and your transaction data (amount, merchant, date, category). Their own privacy policies apply:

• Plaid End User Privacy Policy
• Mono Privacy Policy

You can unlink any bank at any time from Banks in the app; we call the provider's revoke endpoint and delete our stored access token.

4. AI features

When you tap "Generate insights" or receive an AI weekly digest, we send a summarised version of your data (totals per category, top spend, monthly totals) to our LLM provider (Anthropic Claude via the Emergent LLM Key). We do not send individual transaction notes, personal names, or bank account numbers. Prompts and responses are not used to train the model.

5. Third-party service providers

• Plaid, Mono — bank data aggregation.
• Anthropic — AI insight generation.
• Resend — transactional email delivery.
• CoinGecko, Yahoo Finance — public market prices for the investments page (no user data is sent).
• Emergent Cloud — application hosting.

6. Retention & deletion

Your data is retained while your account is active. If you request deletion, we erase your account and all associated financial records within 30 days. Automated backups may persist for up to 90 additional days before being overwritten. Demo accounts auto-delete after 24 hours.

7. Security

Passwords are stored using bcrypt; sessions use httpOnly cookies over HTTPS with server-side token revocation on logout and password change. Rate limits and login lockouts protect against automated attacks. No system is 100% secure — please use a strong, unique password and enable web-push alerts to spot unusual activity quickly.

8. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your data (GDPR, CCPA, NDPR). To exercise any of these, email us from the address on your account and we will respond within 30 days.

9. Children

Accountrix is not intended for people under 16. We do not knowingly collect data from children.

10. Changes to this policy

We may update this policy occasionally. Material changes will be announced by email or in-app notification at least 14 days before they take effect. Continued use of Accountrix after changes constitutes acceptance.

11. Contact

Questions or requests? Email us from the address associated with your Ledger account and we will respond within 30 days.