Privacy Policy

We wrote this in plain English. If something is unclear, email us at [email protected].

What we collect

• Account info: Your email address, saved preferences and sign-in records. Passwords are stored as bcrypt hashes, not plain text. Optional two-step verification and passkeys add the records needed to verify your sign-in.
• Financial data: Transactions, balances and institution details from accounts you connect through Plaid, plus manual entries, categories, rules, budgets, goals, notes and files you choose to import.
• Usage data: Service and security logs, such as request failures and sign-in/session records, help us operate the app and investigate problems. Effortless does not use advertising trackers.

What we don't collect

• Your bank login credentials are handled by Plaid or your bank, not stored by Effortless.
• The app has no subscription checkout and does not collect a payment card for membership.
• The app does not request your contacts or precise device location. Bank transaction records can include merchant locations; Plaid may process device and network information during bank connection as described below.

How we use your data

We use your data to show your accounts, organize transactions, calculate budgets and reports, track goals, remember your choices, manage sign-in and respond to support requests. Files you import are used for the import or restore you request.

We do not sell your data

We do not sell or rent your personal or financial data or use it for targeted advertising. The service providers below process information needed to deliver their part of the service.

Third-party services

• Plaid: Provides the bank-connection flow and account data you authorize. Plaid may receive device, network and connection information. See Plaid's End User Privacy Policy for its own practices.
• Resend: Delivers account verification, password resets, requested exports and enabled account notifications. Delivery requires the recipient address and the message content; requested export emails may include your financial records.

Data security

• All traffic is encrypted over HTTPS with HSTS enforced.
• Plaid access tokens are encrypted in the database; production database encryption and access controls protect stored financial data in the database.
• Passwords are hashed with bcrypt; we cannot recover your password.
• Browser sign-in uses expiring signed cookies. Mobile sign-in uses revocable sessions, with the refresh token stored in the device’s protected storage. Connected financial views stay in app memory; sample-space edits are saved locally.
• MFA (TOTP) is available and encouraged.
• Security headers are set on every response: CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy.

Data retention

Your data is retained while your account is active. You can delete your account and its associated records from the live service using the account deletion page. Bank connections are removed as part of deletion. Previously downloaded files and emails remain with their recipients. Recovery backups rotate under a policy of 14 daily and 8 weekly copies. A minimal record of the deleted account ID and creation time is kept separately so a restored backup cannot silently reactivate the account. Deleted account records are removed before a recovered database returns to service. If deletion cannot finish, the account screen explains the next step.

Your rights

You can view and edit your records in the app, export them from Data, and delete your account from Profile or the account deletion page. Contact us if you need help with access, correction, export or deletion.

Changes to this policy

If we make meaningful changes, we'll notify active users by email before the changes take effect.

Contact

Questions? Email [email protected].