Privacy Policy

This policy applies to people who visit our marketing site, create or use a SageFin account (web or mobile), connect financial institutions, or contact us for support. SageFin is currently offered as a private / invite-only beta.

• Authenticate you and manage invite-only access
• Sync and display balances, transactions, and connected accounts
• Categorize spending, normalize merchants, track budgets, and surface insights or alerts
• Power conversational AI features that query your household data
• Provide CSV export and account connection management tools
• Secure, debug, and improve reliability of the service
• Respond to support requests

We do not sell your personal information. We share data with processors that help us provide SageFin:

• Clerk — authentication and account identity (including login emails / one-time codes)
• Plaid — bank linking, account/transaction sync, and related webhooks
• Apple — FinanceKit / Wallet access on your iPhone (with your consent), and the silent notifications that ask your iPhone to sync it
• AI providers— currently Amazon Bedrock, running xAI's Grok model with Bedrock's data retention turned off, for categorization, chat and reading receipts; xAI directly, only for a question you ask or a report you draft while Bedrock is unavailable; and OpenAI, which checks text you type to the assistant for abuse. If your household sets up its own AI provider in Settings, that household's requests go to the provider it chose instead
• Mastercard Open Finance — bank linking and account/transaction sync for institutions connected through it
• Resend — delivering the email SageFin sends you, such as notification digests
• Google— the mailbox that receives receipts you forward to SageFin. A message is removed from it once its receipt is filed, or once it has been turned away and you have been told why: at once, or at the latest 30 days later, when Google empties the mailbox's trash
• Sentry — crash and error reports from the mobile app
• Amazon / Walmart — when you sync them with SageFin Desktop, the app on your computer contacts the retailer directly. SageFin's servers do not
• Market and fund data services — investment prices, and what a fund holds. They are told which investments are held
• Brandfetch and Plaid — merchant logos. Your browser or phone loads each logo from them directly, so they learn which merchants' logos it shows
• Hosting and edge — application and database hosting (currently Amazon Web Services, in the United States) and Cloudflare for DNS / secure edge access
• Observability — operational telemetry via OpenTelemetry to Grafana Cloud (currently in the United States)

To improve categorization quality, SageFin may reuse high-confidence merchant-to-category mappings derived from transaction enrichment across users. Those mappings are about merchants/categories, not a dump of your full transaction history.

If you use SageFin's iOS companion with FinanceKit enabled, Apple requires that we explain Wallet financial data use clearly. With your permission, SageFin reads eligible account, balance, and transaction information from FinanceKit on your device and transmits it to SageFin's servers so we can store it with your household, show it in the app, categorize it, and include it in budgets, alerts, and AI-assisted insights—just like other linked accounts. You control which accounts and time ranges Apple lets the app access. You can disconnect Apple Card / Wallet sync in the product; you can also revoke access in iOS Settings.

You can connect an AI app of your own, such as Claude, to SageFin, either by signing it in or by giving it an API token you create. It is off until you do. Such an app reads the data its requests return, from your household only, and a token only what its permissions allow; neither can read what your notes say. It can change anything only if you have given it write permission and your household allows apps to make changes, and it cannot move money. If your household is private, an app can read it only for an hour you approve on your iPhone. You can disconnect an app, or revoke a token, at any time in Settings → Integrations, and it stops at once.

An app you connect is not one of our processors: you choose it, and it receives your data at your direction. Once data reaches that app, it is handled under that provider's policy and your settings with them, not under this policy, and we cannot see what it does with it. Connecting an AI app to your data explains the permissions in full.

For each request such an app makes, we record which tool it called, whether that was answered, refused or failed, and which token or connected app made it, in your household's audit log and in our operational logs. The log line also says how many results came back, but neither record contains the merchants, amounts, descriptions or other financial details the app sent or received. For an app you sign in, we also keep which app it is, when it first connected and was last used, whether it may make changes, and whether you disconnected it. The audit log entries and that record are kept while your household exists and are deleted with it; operational logs are kept for a short period, as described under Retention.

Each household's financial data is stored in a file of its own on our servers, separate from every other household's. Account, membership and connection records are stored in PostgreSQL. Both are operated as part of our hosted environment (currently in the United States, as are our backups of them). Secrets such as bank connection tokens and the key for an AI provider your household sets up itself are protected with application-level encryption (ASP.NET Data Protection). Plaid access tokens and similar connection credentials are stored server-side and are not exposed to browsers or mobile clients. Access to household financial APIs is scoped to authenticated members of that household. No security measure is perfect; if we become aware of a breach that affects you, we will take appropriate steps and notify you where required.

Your household's file is encrypted as a whole, so everything in it is encrypted where it is stored: your accounts and transactions, receipt images and the text read from them, your chat history with the assistant, and the notes you write. Your profile photo and your date of birth are kept with your account record and are encrypted there individually.

For a standard household, we hold the key, so this does not mean we cannot read your data. We can, and the product depends on being able to. What it protects against is someone obtaining a copy of your household's file, or of our database, on its own: the file cannot be opened without its key, and that key is kept apart from the file and is itself encrypted. While SageFin is working with your data, it is decrypted in memory on our servers so the app can sort, total and group it for you.

Private mode. If your household is private, we do not hold its key: your data is encrypted with a key only you hold, and we can't read it while you're signed out. While it is unlocked, it is decrypted in memory on our servers as described above, and we can read it. When your household locks, the keys our servers were given are erased at once. Pieces of data the server had already decoded are normally overwritten within about a minute. We can't guarantee that, and the longest they can remain is until we next update SageFin's servers. Our backups from before a household went private remain readable to us for about eight days. Whether or not your household is private, we keep and can read: who you are and how you sign in; your household's name and the names you give your devices and retailer accounts; which banks you have connected, whether each works, when it last synced, and whether it has new activity waiting; when your household's data last changed and when it was last backed up (the times, not what changed); which browsers and phones have unlocked it, and when; your notification settings; your subscription; what you write to support; and a record of activity without its content. Plaid, which connects your banks, can give us back a bank's access if we ask its support, for example to end a connection after a household is deleted. With it we could, in principle, fetch that bank's data again. It does not open anything else in your household.

We keep account, household, and connected financial data for as long as your account remains active and the data is needed to provide SageFin. You can disconnect linked institutions (which removes the associated synced transactions for that connection) and delete eligible manual accounts. Transaction CSV export is available in the product.

A receipt you forward by email is kept in your household with your other receipts. The email itself is removed from our receipts mailbox at Google once it has been dealt with, at the latest 30 days later; what we keep is a note that it was handled (its message ID, the sender's domain, the date and the outcome), not its contents.

SageFin holds no sign-in for a retail account (Amazon, Walmart, Costco), so there is none of ours to delete: SageFin Desktop keeps your retailer sign-ins on your own computer. Disconnecting that computer from SageFin stops it sending orders, and the retail orders help page explains how the app works.

You can delete your account yourself. In the app, go to Settings → Security → Delete account and confirm with your email address. This permanently deletes your SageFin data — accounts, transactions, budgets, goals, rules, receipts and the rest — without contacting us. If you share a household with other members and you own it, transfer ownership or remove them first; if you are not the owner, deleting your account leaves the household and the remaining members keep their data. If your household is private, you delete it from your iPhone, in Settings → Security → Delete this household. If you can no longer unlock it, you can ask us to delete it anyway; that waits 72 hours, and unlocking it in that time cancels it.

Your sign-in identity goes too. It is held by Clerk, our authentication provider, and deleting your account asks Clerk to remove it — so there is nothing left to sign in with.

One thing outlives that deletion, and we would rather say so than imply otherwise. Encrypted backups of our database may hold a copy of your account records for up to 60 days before they expire on their own; if we ever restore from a backup, we re-apply deletions. Operational logs may also retain limited records for a short period. You can still write to [email protected] about any of this — you just do not have to in order to delete your account.

• Connect or disconnect banks, retail accounts, and Apple Card sync
• Disconnect AI apps you connected, or revoke API tokens, in Settings → Integrations
• Delete a bank connection in Settings → Institutions on the web or in Institutions on the phone, and choose whether to keep the accounts and transactions it imported ("Connection only") or delete them too ("Connection, accounts, and transactions"); either way SageFin ends the connection at the provider, such as Plaid
• Override categories and manage budgets, rules, and preferences
• Export transactions (CSV) where the product provides export
• Leave a household (subject to household ownership rules)
• Delete your account and its data yourself, in Settings → Security
• Contact us to correct information
• For FinanceKit, manage or revoke iOS permission in system settings

SageFin is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

We may update this policy as the product or our practices change. We will post the updated policy here and revise the "Last updated" date. Material changes may also be communicated in the product or by email when appropriate.

Questions about privacy or this policy: [email protected].

Operator: SageFin / Bytefoo — domain sagefin.app.