Privacy Policy

• Account details. Your email address, your display name if you set one, and a password. The password is hashed by our authentication provider; we never see or store it in a readable form.
• The financial information you enter. Budget categories and limits, transactions (amount, date, note, category), income sources and entries, bills, savings goals, accounts and their balances, tags, and any notes you attach to them.
• Your phone number — only if you turn on SMS notifications, which is optional and Premium-only. It is encrypted with AES-256 before it is stored, and we return only the last four digits to the application.
• Support messages. What you write to us, and what we write back.
• Preferences. Theme, language, timezone, notification settings, and your saved dashboard and ledger layouts.
• Reviews and feedback you choose to submit.

Bank connections are optional and available on Premium. If you connect one through Stripe Financial Connections, we receive the institution name, the account type, the last four digits of the account number, balances, and transactions (amount, date, and description).

We never receive your bank username, password, security questions, or multi-factor codes. That exchange happens between you, Stripe, and your bank. You can disconnect a bank at any time from the application.

• Subscription status and a Stripe customer identifier, so we know which plan you are on. We do not store your card number.
• Application logs for diagnosing errors and detecting abuse. These are deliberately built to carry identifiers and status codes only — a sanitizer strips amounts, notes, balances, account names, institutions, email addresses, and phone numbers before anything is written.
• Notification records showing that a message was attempted, which template it used, which channel it went through, and whether it was delivered. These never contain the message text, your email address, or your phone number.
• Security and administrative audit records — sign-in events, permission changes, and actions taken by our staff on an account.
• Technical request data. Your IP address and browser user agent reach our servers with every request, as they do with any website. We use the IP address transiently to rate-limit abuse; it is held in memory for that purpose and is not written to our database alongside your account.

• Your Social Security number, government ID, or date of birth.
• Your precise geolocation.
• Biometric data.
• Your card number, CVV, or bank credentials.
• Anything from advertising networks, data brokers, or credit bureaus.

• Your data is not used to train models. Our agreement with Anthropic prohibits it.
• We do not retain AI conversations. Chat history with the coach lives in your browser, not on our servers. What we do keep is a per-day message count, so we can enforce usage limits.
• The coach’s long-term memory is deliberately non-specific. It stores qualitative themes — what you are working toward, what tone you prefer — and not amounts, merchants, or account details.
• AI output can be wrong. It is informational, it is not financial, investment, tax, or legal advice, and it is not a substitute for a licensed professional. See the Terms for the full disclaimer.
• You can avoid it. The AI features are optional; the budgeting, tracking, and reporting features work without them.

• When you ask us to — for example, exporting your data or connecting a bank.
• When the law requires it — a valid subpoena, court order, or legal process. We review every request, disclose no more than it compels, and will notify you unless we are legally prohibited from doing so.
• To protect people — where we reasonably believe disclosure is necessary to prevent fraud, a security incident, or physical harm.
• In a business transfer — if the company is acquired or merges, your information may transfer with it. Any acquirer would be bound by this policy for information collected before the transfer, and we will notify you before your information becomes subject to a materially different policy.

You can request deletion in Settings. We email you to confirm it is really you, then wait seven days — during which you can cancel — and then delete. Deletion removes your financial data, preferences, and stored files, and cancels any active subscription.

The rows in the table above marked as retained after deletion are the exceptions, and they are narrow: de-identified support content, security audit records, and the payment and consent records we are legally obliged to keep. We do not keep a shadow copy of your budget.

Most rights are exercised directly in the app, immediately and without asking us. If you would rather write to us, email support@hemisphere.money or use the in-app support page. We will respond within 45 days, and will tell you if we need a permitted extension.

We will need to verify that the request is really yours before we act on it, usually by confirming control of the email address on the account. For a deletion request we require confirmation from that address. We cannot fulfil a request we cannot verify.

You may use an authorized agent. We will ask for written proof of their authority and for you to verify your own identity directly.

If we decline your request, we will tell you why. You may appeal that decision by emailing support@hemisphere.money with “Privacy Appeal” in the subject line. A different person will review it, and we will respond in writing within 45 days with our decision and the reasoning behind it. If we deny the appeal, we will give you a way to complain to your state Attorney General.

In the twelve months before this policy’s effective date we collected the following categories of personal information under the CCPA/CPRA, for the business purposes in section 5, from the sources in section 4, and disclosed them for a business purpose only to the service providers in section 7:

• Identifiers — name, email address, account identifier, IP address.
• Customer records (Cal. Civ. Code §1798.80) — phone number, and the financial information you enter or sync.
• Commercial information — your subscription and purchase history.
• Internet or network activity — how you use the application, and error logs.
• Sensitive personal information — your financial account information and account log-in credentials. Used only to provide the service, as described in section 8.
• Inferences — budget suggestions and spending patterns the app computes from your own data, and shows only to you.

We did not sell or share any category for cross-context behavioral advertising. California residents have the rights listed in section 11 and may designate an authorized agent.

Under California Civil Code §1789.3, you may also contact the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs in writing at 1625 North Market Blvd., Suite N 112, Sacramento, CA 95834, or by telephone at (800) 952-5210.

You have the rights in section 11, including the right to appeal a denial, described there. Some of these laws exempt information handled by a financial institution subject to the Gramm-Leach-Bliley Act. Rather than rely on that exemption, we extend these rights to everyone.

Nevada residents may direct us not to sell certain personal information. We do not sell it, but you may submit a verified request to support@hemisphere.money.

The nonpublic personal information described in section 3: what you give us on applications and forms, information about your transactions with us, and — if you connect a bank — information from that institution.

We do not disclose your nonpublic personal information to anyone except as permitted by law: to the service providers in section 7 who perform services for us under contract, to complete a transaction you requested, with your consent, and as required by legal process.

We do not disclose your nonpublic personal information to nonaffiliated third parties for their own marketing purposes. Because we do not, there is no opt-out for you to exercise — but you may still contact us with any question about this notice.

We have no affiliates with whom information could be shared. If that changes, we will update this notice and give you any opt-out the law then requires before sharing anything.

If you close your account, we continue to apply this notice to the limited records described in section 10.

We maintain the safeguards described in section 9, and restrict access to employees and contractors who need it to provide the service to you.

We honour these signals by construction rather than by configuration: there is no cross-site tracking, no sale, and no targeted advertising here to opt out of. A Global Privacy Control or Do Not Track signal therefore does not change how the service behaves, because the behaviour it asks us to stop is behaviour we never had.