Privacy Policy

• Account details. Your email address, your display name if you set one, and a password. The password is hashed by our authentication provider; we never see or store it in a readable form.
• The financial information you enter. Budget categories and limits, transactions (amount, date, note, category), income sources and entries, bills, savings goals, accounts and their balances, tags, and any notes you attach to them.
• Your phone number — only if you turn on SMS notifications, which is optional and Premium-only. It is encrypted with AES-256 before it is stored, and we return only the last four digits to the application.
• Support messages. What you write to us, and what we write back.
• Preferences. Theme, language, timezone, notification settings, and your saved dashboard and ledger layouts.
• Reviews and feedback you choose to submit.

Bank connections are optional and available on Premium. If you connect one through Stripe Financial Connections, we receive the institution name, the account type, the last four digits of the account number, balances, and transactions (amount, date, and description).

We never receive your bank username, password, security questions, or multi-factor codes. That exchange happens between you, Stripe, and your bank. You can disconnect a bank at any time from the application.

• Subscription status and a Stripe customer identifier, so we know which plan you are on. We do not store your card number.
• Application logs for diagnosing errors and detecting abuse. These are deliberately built to carry identifiers and status codes only — a sanitizer strips amounts, notes, balances, account names, institutions, email addresses, and phone numbers before anything is written.
• Usage records while you are signed in: which pages you open, how long each one is in front of you while you are using it, which buttons, links and other controls you click, and how quickly each page loads and responds, with the time, your account, the plan you are on, and whether you are on a phone, tablet or computer. A control is recorded by the name our developers gave it, never by what it said, and nothing you type or see on screen is recorded: no amounts, notes or names. We use these records only to understand how the app is used and to improve it, including noticing when someone has stopped using it so we can check in. We keep them for one year and never sell or share them. They are part of running the service and cannot be switched off.
• Notification records showing that a message was attempted, which template it used, which channel it went through, and whether it was delivered. These never contain the message text, your email address, or your phone number.
• Security and administrative audit records — sign-in events, permission changes, and actions taken by our staff on an account. When you sign in, or change your password or two-factor settings, these record the country and region the request came from and a scrambled tag derived from its IP address, which changes every month, so we can recognise repeated attacks. When a sign-in fails, they also record a scrambled tag derived from the email address that was typed and, if that address belongs to an account, which account, so we can tell one person mistyping from someone trying many accounts. They never record the IP address or the email address itself. We keep these sign-in details for about 180 days.
• Technical request data. Your IP address and browser user agent reach our servers with every request, as they do with any website. We use the IP address to limit abuse. Our own rate limits count requests from each address for about a minute, then forget it; where a limit is shared between our servers, Upstash keeps that count under a scrambled tag of the address, never the address itself. Whenever our servers ask our sign-in provider, Supabase, about your account, we pass it the address, so its limits apply to you rather than to our servers. That is most requests while you are signed in, because each one checks your session, as well as signing in, up or out, checking a two-factor code, renewing your session and changing your password. Supabase records it with your sessions, your two-factor checks and its sign-in audit log (sign-ins, sign-outs and account changes), and briefly in its own request logs.

• Your Social Security number, government ID, or date of birth.
• Your precise geolocation.
• Biometric data.
• Your card number, CVV, or bank credentials.
• Anything from advertising networks, data brokers, or credit bureaus.

• Your data is not used to train models. Our agreement with Anthropic prohibits it.
• We do not retain AI conversations. Conversations with the coach and with chat live in your browser, not on our servers, and are removed when you close the tab or sign out. What we do keep is a per-day message count, so we can enforce usage limits.
• The coach’s long-term memory is deliberately non-specific. It stores qualitative themes — what you are working toward, what tone you prefer — and not amounts, merchants, or account details.
• AI output can be wrong. It is informational, it is not financial, investment, tax, or legal advice, and it is not a substitute for a licensed professional. See the Terms for the full disclaimer.
• You can avoid it. The AI features are optional; the budgeting, tracking, and reporting features work without them.

• When you ask us to — for example, exporting your data or connecting a bank.
• When the law requires it — a valid subpoena, court order, or legal process. We review every request, disclose no more than it compels, and will notify you unless we are legally prohibited from doing so.
• To protect people — where we reasonably believe disclosure is necessary to prevent fraud, a security incident, or physical harm.
• In a business transfer — if the company is acquired or merges, your information may transfer with it. Any acquirer would be bound by this policy for information collected before the transfer, and we will notify you before your information becomes subject to a materially different policy.

You can request deletion in Settings. We email you to confirm it is really you, then wait seven days — during which you can cancel — and then delete. Deletion removes your financial data, preferences, and stored files, and cancels any active subscription.

The rows in the table above marked as retained after deletion are the exceptions, and they are narrow: de-identified support content, security audit records, and the payment and consent records we are legally obliged to keep. We do not keep a shadow copy of your budget.

Most rights are exercised directly in the app, immediately and without asking us. If you would rather write to us, email support@hemisphere.money or use the in-app support page. We will respond within 45 days, and will tell you if we need a permitted extension.

We will need to verify that the request is really yours before we act on it, usually by confirming control of the email address on the account. For a deletion request we require confirmation from that address. We cannot fulfil a request we cannot verify.

You may use an authorized agent. We will ask for written proof of their authority and for you to verify your own identity directly.

If we decline your request, we will tell you why. You may appeal that decision by emailing support@hemisphere.money with “Privacy Appeal” in the subject line. A different person will review it, and we will respond in writing within 45 days with our decision and the reasoning behind it. If we deny the appeal, we will give you a way to complain to your state Attorney General.

In the twelve months before this policy’s effective date we collected the following categories of personal information under the CCPA/CPRA, for the business purposes in section 5, from the sources in section 4, and disclosed them for a business purpose only to the service providers in section 7:

• Identifiers — name, email address, account identifier, IP address.
• Customer records (Cal. Civ. Code §1798.80) — phone number, and the financial information you enter or sync.
• Commercial information — your subscription and purchase history.
• Internet or network activity — how you use the application, and error logs.
• Geolocation — approximate only: the country and region a sign-in or security event came from, derived from its IP address. Never your precise location.
• Sensitive personal information — your financial account information and account log-in credentials. Used only to provide the service, as described in section 8.
• Inferences — budget suggestions and spending patterns the app computes from your own data, and shows only to you.

We did not sell or share any category for cross-context behavioral advertising. California residents have the rights listed in section 11 and may designate an authorized agent.

Under California Civil Code §1789.3, you may also contact the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs in writing at 1625 North Market Blvd., Suite N 112, Sacramento, CA 95834, or by telephone at (800) 952-5210.

You have the rights in section 11, including the right to appeal a denial, described there. Some of these laws exempt information handled by a financial institution subject to the Gramm-Leach-Bliley Act. Rather than rely on that exemption, we extend these rights to everyone.

Nevada residents may direct us not to sell certain personal information. We do not sell it, but you may submit a verified request to support@hemisphere.money.

The nonpublic personal information described in section 3: what you give us on applications and forms, information about your transactions with us, and — if you connect a bank — information from that institution.

We do not disclose your nonpublic personal information to anyone except as permitted by law: to the service providers in section 7 who perform services for us under contract, to complete a transaction you requested, with your consent, and as required by legal process.

We do not disclose your nonpublic personal information to nonaffiliated third parties for their own marketing purposes. Because we do not, there is no opt-out for you to exercise — but you may still contact us with any question about this notice.

We have no affiliates with whom information could be shared. If that changes, we will update this notice and give you any opt-out the law then requires before sharing anything.

If you close your account, we continue to apply this notice to the limited records described in section 10.

We maintain the safeguards described in section 9, and restrict access to employees and contractors who need it to provide the service to you.

Some features keep information in your browser’s local or session storage rather than in a cookie. It is not sent to us. It is of two kinds:

• Choices about this device, kept until you clear them: light or dark appearance, how lists, panels and the ledger are laid out, and which notices you have closed.
• Information about your account, removed when you sign out: your recent conversations with the coach and with chat (which also go when you close the tab), figures the coach charted for you, previews of support replies for the notification bell, the categories you used most recently, and similar working state.

We count page views with Vercel Web Analytics, from our hosting provider. It sets no cookie and stores nothing in your browser. For each page view it receives the page’s address without anything after a “?” or “#”, the site that linked you there, and the browser, operating system, device type, and country it works out from the request, and it tells visitors apart with a scrambled tag that changes every day. Our staff and support tools are never counted, and nothing is counted while your browser sends Global Privacy Control or Do Not Track.

When you are signed in, the app records the pages you open, how long each is in front of you while you are active, the controls you click, and how quickly pages load and respond, as described in section 3. These records are kept in our own database with your account, set no cookie, store nothing in your browser, and are deleted after one year. Our staff can see one person’s records only in our admin tools, and each time they do, it is recorded.

There is no cross-site tracking, no sale of personal information, and no targeted advertising here to opt out of. When your browser sends either signal, Vercel’s page counts skip it. The app’s own usage records do not change: they stay in our database, are used only to run and improve Hemisphere, and are never sold or shared.