Privacy Policy

Summary

Footing keeps your financial records so you can budget and plan. We do not sell your data or use it for advertising. We send data to other companies only to run a feature you use, and each is listed below with what it receives.

What We Collect

Account details: your name, email, password (stored only as a one-way hash), two-factor and passkey records, and sign-in sessions with device and IP address.

Financial data you connect or enter: accounts and balances, transactions, categories, notes, budgets, goals, investment holdings and trades, home and vehicle details, plan inputs (ages, pay, retirement plans), paycheck details, paystubs, receipts and Social Security statements you upload.

Usage records: an audit log of changes in your household, job runs, and messages we sent you.

How We Use It

To run Footing for your household: syncing, categorizing, budgeting, reports, projections, alerts, and the emails or texts you choose. To keep it secure and fix problems. We look inside a household only when its owner turns on Support Access, for the time they choose; each look is recorded in the household's Audit Log.

Who Receives Data

Plaid (bank and brokerage connections): your bank sign-in happens in Plaid's window; Plaid sends us accounts, balances, transactions and holdings.

Anthropic (AI, only when your household turns AI on): merchant names and sample descriptions for categorizing; for Ask, the search results, totals and balances a question needs; documents you upload to be read. Anthropic does not train models on this data under our commercial terms.

Stripe (billing): your email and payment details. Card numbers go to Stripe directly and never reach us.

Resend and Twilio (email and texts you turn on): your email address or phone number and the message.

Google (Gmail, if you connect it): read-only access to find receipt emails; we keep only the receipts.

Intuit QuickBooks (if you connect it): your business transactions, sent once each.

Pinwheel (payroll, if you connect it): paystubs from your employer's payroll.

Tiingo (prices): fund and stock symbols only. RentCast (home values): the address you enter. VinAudit (vehicle values): the VIN you enter. mempool.space, Etherscan and CoinGecko (crypto): public wallet addresses and coin names.

Our hosting and database providers: [hosting provider], [database provider], who store data for us under contract.

Security

Each household's data is kept apart in the database by row-level security. Bank, payroll and email tokens are encrypted with a key per household. Owners must use two-factor sign-in; exports, deleting data and changing connections ask for your password again. Data is encrypted in transit and at rest by our hosting providers.

Keeping and Deleting

We keep your data while your account is open. Deleting your account deletes your sign-in at once; when you are the household's last member it deletes the household's data and removes bank connections at Plaid. Backups are kept for [30] days and then removed.

Your Rights

You can see, download, correct and delete your data in Footing at any time. California residents have the rights in the CCPA, as amended by the CPRA, to know, delete, correct, and limit use of sensitive personal information, and not to be discriminated against for using them; we do not sell or share personal information for cross-context advertising. To make a request we cannot handle in the app, write to [privacy email].

[Counsel to confirm obligations under the Gramm-Leach-Bliley Act and state privacy laws.]

Children

Footing is not for anyone under 18, and we do not knowingly collect their data.

Changes and Contact

We will email you before a material change to this policy. Questions: [privacy email], [address].