Privacy Policy

1. What we collect

• Ask Fable beta / OpenAI — if you opt in, your question text is sent to OpenAI to identify its topic. We do not send your account balances or transaction history for this feature, but anything you include in a question is shared. Answers are calculated by Fable. We do not save chat history. OpenAI may retain requests for abuse monitoring; disabling response storage does not mean zero retention. Consent lasts for the current visit and can be withdrawn in Ask Fable. Usage counters are stored to enforce limits.
• Account data: name, email, password hash, display preferences (theme, timezone), MFA enrollment secrets/status, and security events such as login and password-reset activity. For new accounts, we record your confirmation that you are a U.S. resident age 18 or older, its time, and the signup-requirement version. We do not request a birth date or identity documents for this confirmation.
• Billing data: Stripe customer and subscription identifiers, Apple and Google Play purchase and account-binding identifiers, plan, paid-through dates, and checkout metadata. Card numbers are handled by Stripe, Apple or Google Play, not stored on our servers.
• Financial workspace data: linked institutions and accounts (via Plaid), transactions, categories, budgets, goals, rules, household membership, forecast inputs and saved estimates, and settings you enter.
• Communications: emails we send (verification, password reset, MFA-related, support) and messages you send to support.
• Technical data: IP address, user agent, approximate request metadata, and rate-limit / abuse-prevention signals. We may use cookies or similar storage for session/auth.

2. How we use information

• Provide, secure, and improve the product (including sync, categorization, and insights).
• Authenticate you, enforce MFA where enabled, and prevent abuse.
• Process and verify membership payments, renewals, refunds, and disputes through Stripe or Apple.
• Send transactional email (not marketing spam). You can contact us to adjust non-essential mail.
• Comply with law, enforce Terms, and protect users and the service.

3. Sharing

We do not sell your personal information. We share data with processors who help run the service:

• Plaid — bank linking and account/transaction retrieval under your authorization, including investment and loan information when you authorize those accounts. Plaid processes your information as described in its End User Privacy Policy.
• Stripe — payments, customer portal, webhooks, and tax calculation/collection where enabled.
• Apple — iPhone subscription purchases, renewal, refund processing, and signed transaction verification.
• Google Play — Android subscription purchases, renewal, refunds, and purchase verification.
• Resend (or similar) — transactional email delivery.
• Hosting / infrastructure — e.g. Vercel for application hosting; database and Redis/rate-limit providers we configure for production.
• Household members — people you invite can see shared household data according to roles you set.
• Legal / safety — when required by law or to protect rights, safety, and integrity of the service.

Processors act under their own policies for their platforms. Review Plaid, Stripe, Apple, and Google Play privacy notices for bank and payment data handling.

4. Retention

We keep account and financial workspace data while your account is active. After you delete your account, we remove stored personal and linked financial data from our primary systems as described in the product deletion flow, except records we must keep for legal, tax, accounting, dispute, or security reasons (for example limited billing history or audit logs). Encrypted server database backups use a 30-day expiration policy and are checked hourly. Independent recovery copies are access-restricted and require operator review and retirement; copies on offline devices may remain longer. Restoring a backup requires reapplying subsequent account deletions before customer access resumes.

5. Security

We use industry-standard measures such as encrypted transport (HTTPS), hashed passwords, MFA, access controls, and rate limiting. No method of transmission or storage is 100% secure. Protect your password and MFA device. Report suspected compromise to support@financefable.com promptly.

6. Your choices

• Update profile and security settings in the app (including MFA).
• Disconnect bank links or leave a household where the product allows.
• Manage web billing through Stripe, or Apple subscriptions through the in-app Apple subscription management sheet.
• Request account deletion in Settings after confirming the deletion.
• Email support@financefable.com for access, correction, or deletion requests we cannot complete in-product. We may need to verify you own the account.

7. Children

The service is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child provided data, contact us and we will delete it.

8. International users

New accounts are available to U.S. residents age 18 and older. We operate primarily from the United States. If you access the service while elsewhere, you understand your information may be processed in the U.S. and other countries where our providers run.

9. U.S. state privacy notices

Depending on where you live, you may have rights to know, access, correct, delete, or opt out of certain processing. We do not sell personal information or share it for cross-context behavioral advertising as those terms are commonly defined. To exercise rights, email support@financefable.com. We will not discriminate against you for exercising privacy rights. If an authorized agent contacts us, we may require proof of authority and identity verification.

10. Changes

We may update this Policy. The Effective date will change when we do. Continued use after posting means you accept the updated Policy. For material changes we will try to provide reasonable notice.

11. Contact

Privacy questions: support@financefable.com.