Effortless

Privacy Policy

Last updated: April 2026

We wrote this in plain English. If something is unclear, email us at [email protected].

What we collect

  • Account info: Your email address and a bcrypt-hashed password. We never store your password in plain text.
  • Financial data: Transaction history, account balances, and institution names pulled via Plaid on your request. This data is stored encrypted in our database.
  • Usage data: Basic logs (errors, API response times) to keep the service running. No behavioral tracking or ad targeting.

What we don't collect

  • Your bank login credentials — Plaid handles that directly, we never see them.
  • Payment or billing information — Effortless is free, no card on file.
  • Location data, contacts, or device identifiers.

How we use your data

Solely to provide the service. Your financial data is used to display your transactions, calculate budgets, track goals, and generate analytics — nothing else.

We do not sell your data

We do not sell, rent, share, or trade your personal or financial data with third parties for any commercial purpose. Full stop.

Third-party services

  • Plaid: Used to connect your bank accounts with read-only access. Plaid's own privacy policy governs your interaction with their authentication flow.
  • Email (SMTP): Used only to send password reset emails on your request.

Data security

  • All traffic is encrypted over HTTPS with HSTS enforced.
  • Plaid access tokens are encrypted in the database; production database encryption and access controls protect stored financial data in the database.
  • Passwords are hashed with bcrypt — we cannot recover your password.
  • Authentication uses signed JWT tokens with expiry.
  • MFA (TOTP) is available and encouraged.
  • Security headers are set on every response: CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy.

Data retention

Your data is retained as long as your account is active. You can request full deletion at any time by emailing [email protected]. We'll delete your account and all associated data within 48 hours.

Your rights

You have the right to access, correct, export, or delete your data at any time. Just email us.

Changes to this policy

If we make meaningful changes, we'll notify active users by email before the changes take effect.

Contact

Questions? Email [email protected].