Privacy Policy

This policy explains what information PennyBot collects when you use the service, how it is used, and who it is shared with.

By using PennyBot you agree to the practices described here. If you do not agree, please do not use the service.

Account information. Your name, email address, and sign-in identifiers, handled through our identity provider. We never receive or store your password.

Financial information. When you link a bank account, our bank connectivity provider (Plaid) retrieves balances, account details, and transaction history on your behalf. Your banking credentials are entered directly with Plaid and are never seen or stored by PennyBot.

Content you provide. Goals, budgets, and the messages you send to the PennyBot assistant.

Usage data. Log data such as IP address, browser type, pages viewed, and timestamps, used to operate and secure the service. We also keep the date you last used PennyBot, updated at most once a day, to understand how the service is used. It is deleted with your account.

Your information is used to operate PennyBot: to show balances, calculate Safe-to-Spend and forecasts, categorize transactions, detect recurring charges, track goals, and answer your questions in chat.

It is also used to sign you in, prevent fraud and abuse, diagnose errors, and send messages about your account.

We do not sell your personal information, and we do not use your financial data for advertising.

PennyBot uses third-party large language model providers to power the assistant. When you send a message, relevant context — which may include transaction descriptions, amounts, balances, and goal details — is sent to that provider to generate a response.

We use these providers under agreements that prohibit training their models on our data. Responses are generated automatically and may be incomplete or inaccurate; see our Terms of Service regarding financial advice.

We share information only with the service providers that make PennyBot work:

• Bank connectivity (Plaid).
• Authentication and identity management.
• Cloud hosting, database, and infrastructure providers.
• AI model providers, as described above.
• Product analytics providers (PostHog), which receive page views and feature-usage events tied to your account id. They do not receive your balances, transactions, account numbers, or the contents of your chats.

We may also disclose information when required by law, to enforce our agreements, or to protect the rights and safety of our users. If PennyBot is involved in a merger, acquisition, or asset sale, your information may be transferred, and we will notify you before it becomes subject to a different privacy policy.

We use encryption in transit, encrypt bank access tokens before storing them, and restrict access to your data to your own account. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We retain your information for as long as your account is active. You may disconnect any linked bank at any time from Settings, which revokes our access to that bank’s data going forward.

You may delete your account at any time from Settings → Delete account. That revokes our access to every linked bank and permanently deletes your transactions, balances, goals, insights, and chat history. Deletion is immediate and cannot be undone.

Where retention is required for legal, accounting, or fraud-prevention purposes, we retain only what that requires.

Depending on where you live, you may have the right to access, export, or delete your personal information. All three are self-serve from Settings — no request to us is required. Residents of California and other U.S. states with comprehensive privacy laws may also have the right to opt out of the sale or sharing of personal information — we do not sell or share personal information as those terms are defined.

PennyBot is not directed to anyone under 18, and we do not knowingly collect personal information from them.

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide additional notice within the application.