Privacy Policy

1. Introduction

STACK APP provides tools to help users understand their finances, track income, manage taxes, and automate savings. This Privacy Policy explains how we collect, use, store, and protect your information when you use our application and services. By using STACK APP, you agree to the practices described in this policy.

2. Information We Collect

3. How We Use Your Information

STACK APP uses your information only to:

• Deliver financial insights, tax calculations, and budgeting tools
• Sync financial data from Plaid
• Display your account balances and transactions
• Analyze spending and income patterns
• Provide customer support
• Maintain and improve the application
• Ensure security and prevent fraud

We do not use your financial data for advertising.

4. How We Share Your Information

STACK APP does not sell your personal or financial information. We share information only with the service providers who operate the platform:

• Plaid — bank connections (balances, transactions, account names and types). We never receive your bank password.
• Stripe — subscription payments. We never see or store your full card number.
• Supabase — database, authentication, and file storage (receipts, paystubs).
• Vercel — application hosting and scheduled jobs.
• Sentry — error monitoring.
• PostHog — product analytics (page views and a small set of funnel events).
• Upstash — rate-limiting counters (typically an IP address).
• Backblaze — off-platform copies of uploaded files for disaster recovery.
• Resend — transactional email (account, billing, and support messages).
• GitHub Actions — runs our automated tests and nightly backup jobs. It does not host your financial records as a product database.

These providers may process your information only to provide services to STACK APP. They are not permitted to use it for their own advertising.

5. Data Storage and Security

• All data is encrypted in transit using TLS 1.2 or higher.
• Database disks and file storage are encrypted at rest by our hosting providers.
• Access to production systems is restricted.
• Bank login passwords are never stored. You authenticate with your bank inside Plaid.
• Plaid access tokens (used only to sync transactions and balances) are stored in our database and protected by row-level security so one user's token cannot be read as another user's. They are not application-encrypted at rest today. API keys and other environment secrets live in Vercel's production vault, are never committed to git, and are never sent to the browser.

Despite strong safeguards, no method of transmission or storage is completely secure. STACK APP takes reasonable steps to protect your information.

6. Your Rights and Choices

You may, at any time:

• Access your data within the application
• Request a copy of the personal information we hold by emailing privacy@jamesmarinofinance.com from the email address on your account. An in-app bulk export is not available yet.
• Disconnect your financial accounts from the Settings page
• Update or correct your personal information
• Request deletion of your account and data using the “Delete my account” control in Settings. When you do:
  • All connected bank accounts are disconnected immediately.
  • Any active subscription is canceled immediately.
  • Your account enters a 30-day grace period during which you may sign in and restore it. After 30 days, your data is permanently deleted and cannot be recovered.

You may also email requests to: privacy@jamesmarinofinance.com

7. Data Retention

We retain your data only as long as needed to provide the service, meet legal and tax-record obligations, and protect against fraud. Specifically:

• Active accounts: Financial data (transactions, budgets, tax records, paystubs, receipts) is retained for as long as your account is active so the application can provide historical insights.
• Deletion requests: When you request deletion, your data is preserved for a 30-day grace period so you can restore if needed. After 30 days it is permanently erased from our systems.
• Bank connection tokens: Removed immediately when you unlink the last account at a bank, or when you request account deletion. If you unlink one account while other accounts at the same bank stay connected, we keep that bank login so those remaining accounts can keep syncing. The unlinked account is not imported again unless you Relink it.
• Backups: For disaster recovery, encrypted backups of your data are retained in isolated systems for up to 7 days (database) and 30 days (uploaded files such as receipts, paystubs, and tax documents). Backups are used solely to restore service after a failure and are overwritten on a rolling schedule.
• Billing records: Payment transaction records are retained by Stripe for as long as required by applicable financial and tax law, independent of your STACK APP account.
• Deletion audit log: We keep a minimal record (user id, email, timestamps) confirming that a deletion request was fulfilled, for accountability and fraud investigation. This log does not contain financial data.

8. Payment Processing

Subscription payments are processed by Stripe, Inc. When you subscribe, Stripe receives your email address, billing country, and payment method details in order to process the transaction. STACK APP never sees or stores your full payment card number. Stripe's privacy practices are available at: https://stripe.com/privacy

9. Analytics and Error Monitoring

10. California Residents (CCPA / CPRA)

If you are a California resident, you have the following rights regarding your personal information:

• Right to know what personal information we collect, use, disclose, and retain.
• Right to delete personal information we hold about you (see Section 6).
• Right to correct inaccurate personal information.
• Right to opt outof “sale” or “sharing” of personal information. STACK APP does not sell or share your personal information for cross-context behavioral advertising, so there is nothing to opt out of.
• Right to non-discrimination for exercising these rights.

To exercise any of these rights, email privacy@jamesmarinofinance.com from the email address on your account. We will respond within 45 days as required by law. You may also designate an authorized agent to make a request on your behalf; we may require written proof of the authorization.

11. Children's Privacy

STACK APP does not knowingly collect information from children under 13. If we discover that information has been collected from a child, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy as our services evolve. If significant changes occur, we will notify users by email or in the application.

13. Contact Information

For privacy related questions or requests, contact:

If email delivery fails, use the in-app Help & Support page after signing in.