Privacy Policy

1. Information We Collect

Information you provide directly

• Account information: Your name, email address, and a password (stored as a one-way hash, never in plain text) when you create an account, as well as optional Google sign-in credentials.
• Financial information you enter: Income sources, budget categories and amounts, debts, savings goals, giving goals, investment account details, annual and seasonal expense plans, and household/family member information you choose to add.
• Family Plan data: When you use the Family Plan, we store the first name, last name, and date of birth of household members you add (including children), so we can calculate age-based plan tiers and transitions.
• Contact messages: Your name, email address, and message content when you contact us through the in-app Contact form.
• Display and notification preferences: Your chosen text size, accessibility settings, sidebar width, and whether you have enabled devotional or financial email reminders.

Information collected through integrations

• Bank and transaction data (via Plaid): When you connect a financial institution through Plaid, we retrieve account names, balances, and transaction history (merchant, amount, date, and category). Sapphira never stores your bank login credentials — Plaid handles authentication and provides us with a secure, read-only access token.
• Investment and holdings data (via Plaid): For linked investment accounts, we retrieve account balances, holdings, ticker symbols, quantities, cost basis, and unrealized gains or losses.
• Subscription and payment data (via Stripe): When you subscribe to a paid plan, Stripe processes your payment. We receive your subscription status, plan type, billing history summary, and Stripe identifiers — but never your full card number or raw payment details.
• Push notification tokens: If you enable Web Push notifications, we store your device's push subscription endpoint and public keys so we can deliver devotional and reminder notifications to your device.
• Email reminder data (via Resend): To send daily devotional and weekly financial check-in emails you have opted into, we pass your email address and the reminder content to our email delivery provider, Resend.

Information collected automatically

• Usage and device data: We log basic technical information such as device type, browser version, operating system, and app interaction events (e.g., button taps, page views) through our analytics provider to understand how the Service is used and to improve it.
• Service logs: We retain runtime logs that may include timestamps, request metadata, and error messages to monitor performance and troubleshoot issues.

2. How We Use Your Information

• To create and manage your account and authenticate your sessions.
• To display your budgets, transactions, debts, goals, and stewardship summaries.
• To sync and update your bank and investment data through Plaid on an ongoing basis.
• To process subscription payments and manage your plan tier through Stripe.
• To send you daily devotional and weekly financial check-in email reminders you have enabled.
• To deliver Web Push notifications for devotionals and reminders you have opted into.
• To allow shared household access on the Family Plan (between you, your spouse, and your children's plans).
• To provide AI-assisted insights, categorization suggestions, and coaching features, which may process your financial context through our cloud and large-language-model providers.
• To respond to your support and contact requests.
• To analyze and improve the Service, fix bugs, and develop new features.
• To comply with legal obligations and enforce our terms of service.

3. How We Share Your Information

We do not sell your personal information. We share your information only with the following categories of service providers and only as necessary to operate the Service:

• Plaid — connects to your financial institutions and retrieves account and transaction data on your behalf.
• Stripe — processes subscription payments and manages billing.
• Google — provides optional Google sign-in and supports AI/LLM features we use.
• Resend — delivers transactional and reminder emails on our behalf.
• Cloud and infrastructure providers — host the Service, store your data, and run the platform the app is built on.
• AI / large-language-model providers — power optional features such as categorization suggestions, coaching, and insights; these providers may process your financial context to generate responses.
• Analytics providers — help us understand aggregate usage patterns to improve the Service.

We may also disclose information when required by law, to protect our rights, or to respond to a legal process. In the event of a merger, acquisition, or asset sale, user information may be transferred as part of that transaction.

4. Data Retention

We retain your account and financial data for as long as your account is active. If you delete your account, we will remove or de-identify your personal data from our active systems within a reasonable period, except where we are legally required to retain records (such as billing records). Cached or residual copies in backups may persist until they are aged out according to our backup schedule.

5. Security

We take reasonable measures to protect your information using industry-standard practices, including encryption in transit (TLS) and at rest, hashed passwords, and access controls. Bank connections are made through Plaid's secure infrastructure, and we never store your bank login credentials. Payment details are handled exclusively by Stripe. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Children's Data

Sapphira does not knowingly collect personal information directly from children. On the Family Plan, a parent or guardian may add a child's first name, last name, and date of birth to enable age-based stewardship plans and transitions. This information is provided and managed by the parent or guardian, who consents to its use. Children do not create their own accounts or interact with the Service independently. If you believe a child has provided information without parental consent, please contact us and we will remove it.

7. Your Rights and Choices

Depending on your location, you may have the right to access, correct, export, or delete the personal information we hold about you. You can exercise most of these rights directly within the app (for example, by editing your profile, disconnecting a bank account, or changing your notification preferences).

To request full deletion of your account and all associated data, visit our Request Account Deletion page. From there, signed-in users can delete their account and data immediately, and visitors who are not signed in can submit a request through our Contact page. We will respond to verified requests within a reasonable timeframe and in accordance with applicable law.

You can opt out of devotional and financial email reminders at any time in Settings, and you can disable push notifications in your device settings.

8. International Users

Sapphira is available to users worldwide. Your information may be processed and stored in countries other than your own that may have different data protection laws. By using the Service, you consent to the transfer and processing of your information in these locations. We aim to provide the same protections regardless of where your data is processed.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will notify you through the app or by email. We encourage you to review this policy periodically.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please reach out through our Contact page. We are committed to responding promptly and helping you exercise your privacy rights.