Your financial data stays under your control.

What we collect

• Account information: your email address, optional display name, internal user ID, and authentication records.
• Financial information you authorize: institution and account identifiers, account type and mask, balances, transactions, merchant and category information, connection status, and synchronization history. We never receive your bank password.
• Your content: the questions you ask, your conversations, the answers generated for you, and any support message you send us.
• Operational data: request and audit identifiers, security events, provider event identifiers, error details, and limited server logs such as IP address when needed to operate, secure, and troubleshoot the service.

How it is used

We receive account information directly from you. We receive financial records from Stripe Financial Connections only after you complete its authorization flow. We use this data to sign you in, connect and synchronize the accounts you authorized, show balances and analysis, generate the answers you request, prevent fraud and abuse, keep the service reliable, and provide support.

We do not sell personal data, we do not serve targeted advertising, and we do not track you across other apps or websites.

Who receives it

• Stripe: provides the bank-connection and financial-data access flow. Stripe receives the information required to create and maintain the connection, under its own privacy terms.
• Contracted AI provider: only after you allow AI analysis, we send your question and the financial records needed to answer it to the configured AI inference provider. That data is used to deliver the feature you asked for, not advertising or cross-service tracking.
• Infrastructure and security providers: may process encrypted application data, logs, or error information solely to host, secure, and operate the service.

These providers are required to protect data consistently with this policy and applicable law. We may also disclose information where legally required, or to protect users and the service.

Keeping and deleting

Account and financial data is retained while your account is active. Connection records stop updating as soon as you disconnect an institution.

In the app, open More → Delete account to permanently delete your account together with its financial records, transactions, conversations, and access tokens. Limited security or legal records may be retained only where the law requires it or where it is necessary to prevent abuse, and are separated from the deleted account wherever possible.

Your choices

You choose which institutions to connect, and you can disconnect any of them from Accounts. You can withdraw AI data-sharing permission in More, after which no new AI request will run until you grant it again. You can delete your account at any time. System permissions such as notifications can be changed in iOS Settings.

Security and children

We use transport encryption, access controls, user-scoped data access, and strict separation of provider secrets from the browser and the app. No system is completely secure, and we will tell you promptly if an incident affects your data.

Sprout AI is not directed to children under 13, and we do not knowingly collect their personal data.

Changes

If this policy changes in a way that materially affects you, we will update the effective date above and notify you in the app before the change takes effect.

Contact

Privacy questions and requests: [email protected]. You can also reach us from the contact page.