Privacy Policy

1. Information We Collect

1.1 Account Information

When you create a Money Magnet account, we collect:

• Email address — used for authentication, password resets, and optional email-based multi-factor authentication (MFA).
• Password — hashed using bcrypt (12 rounds) before storage. We never store, log, or transmit your plaintext password.

1.2 Financial Data (via Plaid)

When you connect a bank account, we access your data through Plaid Technologies, Inc. We receive:

• Account names, types (checking, savings, credit card), and balances.
• Transaction history (descriptions, amounts, dates, categories).
• Recurring transaction patterns (subscriptions, recurring bills).
• Credit card liability details (APR, minimum payment, balance).

Important: Your bank credentials (username and password) are entered directly into Plaid's secure interface and are never seen or stored by Money Magnet. We only receive a secure access token. Money Magnet accesses your account information in read-only mode — we cannot initiate transfers, make payments, or modify your bank accounts in any way.

1.3 Subscription & Purchase Data

If you subscribe to Money Magnet Pro, we collect:

• Subscription tier (free or pro) — stored in our database to determine feature access.
• Subscription status (active, cancelled, expired, trial) — received from RevenueCat based on App Store or Google Play purchase events.

Important: We do not collect or store your payment method (credit card number, billing address, etc.). All payment processing is handled entirely by the Apple App Store or Google Play Store. We receive only purchase confirmation and subscription status updates through RevenueCat.

1.4 User-Created Data

• Budgets, budget categories, and budget rules
• Bills and bill reminders
• Savings goals and deposits
• AI chat conversations and message history
• Saved meals, grocery lists, recipes
• Saved travel searches, events, and restaurants
• Notification preferences and app settings

1.5 Device & Technical Data

• A unique device token for push notifications (via Firebase Cloud Messaging)
• Device platform (iOS/Android) for notification delivery
• Error and crash reports (via Sentry) for app stability
• Analytics events (via Mixpanel), only if you have granted analytics consent
• Advertising identifier (IDFA on iOS / GAID on Android) — used by Google AdMob to serve ads to free-tier users. On iOS, this requires your consent via the App Tracking Transparency (ATT) prompt. You may opt out at any time through your device settings.

1.6 Location Data (Optional)

If you grant location permission, we may use your coordinates to auto-fill your ZIP code or city for grocery deals and event searches. Location data is used transiently and is not stored on our servers.

2. How We Use Your Information

We use your data to:

• Provide core budgeting features: income tracking, budget management, bill reminders, savings goals.
• Manage your subscription status and determine access to premium features.
• Connect to your financial institutions via Plaid for transaction imports and balance tracking.
• Power the AI financial assistant (budget analysis, meal planning, travel recommendations, shopping suggestions, entertainment discovery).
• Send push notifications for budget alerts, bill reminders, goal milestones, and subscription warnings (configurable per type).
• Sync your data across sessions via our backend servers.
• Monitor app stability and fix crashes (Sentry).
• Analyze usage patterns to improve the app (Mixpanel — only with your consent).
• Authenticate your identity and secure your account via email/password and optional MFA.

We do not use your data to:

• Sell, rent, lease, or trade your personal or financial information to third parties.
• Make automated decisions that affect your financial standing (e.g., credit decisions).

Advertising: Free-tier users see ads served by Google AdMob. These ads may be personalized based on your device's advertising identifier (IDFA/GAID) if you have granted the App Tracking Transparency (ATT) permission on iOS, or based on Google's advertising settings on Android. We do not share your financial data, bank account information, or transaction history with Google AdMob for advertising purposes. Money Magnet Pro subscribers do not see ads. You can opt out of personalized ads at any time through your device's privacy/advertising settings.

3. Third-Party Services

Money Magnet integrates with the following third-party services. Each service receives only the data necessary for its function:

Plaid

Plaid's End User Privacy Policy is available at https://plaid.com/legal/#end-user-privacy-policy. You can revoke Plaid's access through their portal or by unlinking your bank account in Money Magnet's Profile settings.

Anthropic (AI Assistant)

The Money Magnet AI assistant is powered by Anthropic's Claude language model. When you use the AI chat feature:

• Your message and relevant financial context (balances, budgets, recent transactions) are sent to Anthropic's API for processing.
• Anthropic may process submitted data according to their data usage policies.
• Do not enter sensitive identifying information (SSN, full card numbers, bank passwords) into the AI chat.

For more information, see Anthropic's privacy policy at https://www.anthropic.com/privacy.

RevenueCat (Subscription Management)

Money Magnet uses RevenueCat to manage in-app subscriptions. RevenueCat receives your app user ID and purchase receipts from the Apple App Store or Google Play Store to validate and track your subscription status. RevenueCat does not receive your financial data, bank information, or personal details beyond what is necessary for subscription management.

For more information, see RevenueCat's privacy policy at https://www.revenuecat.com/privacy.

Google AdMob (Advertising)

Free-tier users see banner and native ads served by Google AdMob. AdMob may use your device's advertising identifier (IDFA on iOS, GAID on Android) to serve personalized ads based on your interests. On iOS, we request your permission before enabling personalized advertising via the App Tracking Transparency (ATT) prompt. If you decline, non-personalized ads are shown instead.

You can opt out of personalized ads at any time:

• iOS: Settings > Privacy & Security > Tracking — disable "Allow Apps to Request to Track" or toggle off Money Magnet specifically.
• Android: Settings > Google > Ads > Delete advertising ID or opt out of ads personalization.

For more information, see Google's privacy policy at https://policies.google.com/privacy. Money Magnet Pro subscribers do not see ads and their advertising identifier is not shared with AdMob.

Analytics (Mixpanel)

Analytics data is collected only with your explicit consent. You can manage consent for the following categories at any time:

• Analytics — app usage patterns and feature engagement
• Personalization — tailored recommendations
• Marketing — promotional communications

When consent is granted, analytics events may include subscription-related activity (e.g., paywall viewed, purchase completed, subscription tier) for product improvement purposes. If analytics consent is not granted, no usage events are sent to Mixpanel.

4. Data Storage & Security

4.1 Where Your Data Is Stored

• Locally on your device: Budgets, bills, goals, settings, saved items, and offline queue via React Native AsyncStorage. Local data is scoped per user account.
• On our servers: PostgreSQL database hosted via Supabase on AWS infrastructure. Data may be stored in the United States or other countries where Supabase operates.
• Sync strategy: Data is saved locally first, then synced to the backend. If you are offline, changes are queued and replayed automatically when connectivity is restored.

4.2 Encryption

• Plaid access tokens are encrypted using AES-256-GCM before storage in our database. Encryption keys are rotated on a 180-day cycle with a 14-day overlap window.
• Sensitive credentials (TOTP secrets, biometric sentinel tokens) are stored in the device's secure Keychain (iOS) or Keystore (Android).
• Passwords are hashed with bcrypt (12 rounds) and never stored in plaintext.
• All data in transit is protected via HTTPS/TLS.

4.3 Access Controls

• Database access is restricted to backend servers only — no direct client-to-database connections.
• API endpoints require valid JWT authentication tokens.
• Plaid access tokens are never sent to or visible on the client.

4.4 Security Limitations

No method of electronic storage or internet transmission is 100% secure. While we implement industry-standard safeguards, we cannot guarantee absolute security. In the event of a data breach, we will notify affected users promptly in accordance with applicable law.

5. Multi-Factor Authentication

Money Magnet offers optional multi-factor authentication to secure your account:

• SMS OTP — One-time passcode sent via SMS (powered by Firebase Authentication).
• Email OTP — One-time passcode sent to your registered email.
• TOTP / Authenticator App — Time-based one-time password compatible with apps like Google Authenticator and Authy.
• Biometric Authentication — Face ID, Touch ID, or fingerprint unlock.

Your phone number (if provided for SMS MFA) is shared with Firebase solely for OTP delivery and is not used for marketing or other purposes.

6. Your Rights

6.1 Access Your Data

You can view all data stored about you directly within the app (budgets, transactions, bills, goals, conversations, saved items, and settings).

6.2 Update Your Data

You can update your profile information, budgets, bills, subscriptions, and savings goals at any time within the app.

6.3 Delete Your Data

You can request deletion of your account and all associated data through the Delete Account option in the Profile screen, or by contacting us at the email below. Account deletion will:

• Revoke all Plaid access tokens on Plaid's servers.
• Permanently delete your user record and all associated data (budgets, bills, goals, transactions, conversations, saved items, device tokens, and audit logs).

Note: Deletion of your Money Magnet account will not affect transaction data stored at your financial institution or with Plaid — you must separately revoke Plaid's access through their portal.

6.4 Additional Rights

• Opt out of analytics: Manage your consent preferences at any time within the app. We do not sell personal information.
• GDPR (EEA residents): If you are located in the European Economic Area, you have additional rights including the right to object to processing, the right to restrict processing, and the right to lodge a complaint with a supervisory authority. Our legal basis for processing your data is your consent and our legitimate interest in providing the service.
• CCPA (California residents): You have the right to know what personal information is collected, request deletion, and opt out of the sale of personal information (we do not sell personal information).

7. Data Retention

• Account data (budgets, bills, goals, conversations) — retained until you delete your account or request data deletion.
• Subscription data — your subscription tier is retained while your account is active. Purchase receipts and subscription history are maintained by RevenueCat and the Apple App Store or Google Play Store according to their respective retention policies.
• Transaction data — retained as long as your bank account is linked and your account is active.
• Deleted data — soft-deleted (marked with a deletion timestamp) for auditability, then permanently purged according to our retention schedule.
• Crash reports (Sentry) — retained per Sentry's default retention policy.
• Analytics events (Mixpanel) — retained per Mixpanel's data retention settings.

8. Children's Privacy

Money Magnet is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will delete it immediately. If you believe a child under 13 has used our app, please contact us.

9. Disclosure of Information

We may disclose your information if:

• Required by law, court order, or legal process.
• Necessary to protect the rights, property, or safety of Money Magnet, our users, or the public.
• In connection with a merger, acquisition, or sale of assets — we will notify you before your data is subject to a different privacy policy.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last Updated" date at the top of this policy and, where appropriate, through an in-app notification. Your continued use of Money Magnet after changes constitutes acceptance of the updated policy.

11. Contact Us