Privacy Policy

Last updated: May 20, 2026 · Effective date: May 20, 2026

1. Information we collect

1.1 Information you provide

• Account information: email address, password (stored only as a bcrypt hash — we never see or store your plaintext password), and an optional name.
• Financial data you enter directly: transactions (via CSV upload, manual entry, or photo of a receipt for Pro subscribers); investment holdings (ticker symbol, shares, cost basis); and retirement assumptions (current age, retirement age, savings, contribution rate, expected return, etc.).
• Receipt images (Pro): when you use the receipt scanner, the image is uploaded to our server only to be forwarded to Anthropic’s vision API for text extraction. We do not persistently store receipt images; only the extracted transaction fields (date, merchant, amount, category) are saved.
• Conversations with the AI advisor (Pro): messages you send to the AI advisor, along with a snapshot of your account data sent as context, are transmitted to Anthropic for processing. We do not log the conversation contents on our servers beyond the duration of the request.

1.2 Information from connected services

• Bank transactions via Plaid (Pro): when you connect a bank account through Plaid Link, Plaid issues us a read-only access token. We use this token to retrieve your historical and ongoing bank transactions on your behalf. We do not receive or store your bank login credentials at any time — they are entered directly into Plaid’s secure interface. We may also receive: institution name and ID, account names and types, transaction details (date, amount, merchant, category), and the access token itself. Plaid’s use of this data is governed by Plaid’s End User Privacy Policy.
• Google sign-in: if you sign in with Google, we receive your Google email address, name, and profile picture URL. We do not request access to your Gmail, Drive, or any other Google services.
• Payment information via Stripe: when you subscribe to Pro, payment details are handled directly by Stripe. We never see or store your credit card number, CVV, or bank account details. We receive only your Stripe customer ID, subscription ID, subscription status, and renewal date.
• Market data: when you add a holding, we query a third-party market data provider (Finnhub) using only the ticker symbol you entered. No personally identifying information is sent.

1.3 Information we collect automatically

• Session cookies used for authentication. These are signed JSON Web Tokens that allow us to identify you across requests. They do not contain plaintext personal information.
• Server logs containing IP addresses, user-agent strings, and request paths, retained for operational and security purposes. These are not used for analytics or advertising.

We do not use third-party analytics, advertising, or tracking pixels (no Google Analytics, no Meta pixel, no advertising SDKs).

2. How we use your information

We use the information described above only to:

• Provide, maintain, and improve the Service.
• Display your transactions, portfolio, retirement projections, and AI-generated advice in your own dashboard.
• Authenticate you and protect your account.
• Process subscription payments and manage your billing.
• Send transactional emails directly tied to your use of the Service (e.g., password reset, receipt of payment). We do not currently send marketing emails.
• Comply with legal obligations and respond to lawful requests from public authorities.

We do not sell your personal information. We do not share your data with advertisers. We do not use your data to train AI models.

3. Who we share information with

We share information only with the third-party service providers below, each of which is contractually obligated to protect your data:

• Plaid Inc. — bank account linking and transaction retrieval. Their privacy policy: plaid.com/legal.
• Stripe, Inc. — payment processing and subscription management. Their privacy policy: stripe.com/privacy.
• Anthropic, PBC — AI advisor responses and receipt OCR (Pro features). Their privacy policy: anthropic.com/legal/privacy. Anthropic states that data submitted via the API is not used to train their models.
• Google LLC — Sign-in with Google (optional). Their privacy policy: policies.google.com/privacy.
• Finnhub.io — market data lookups. No personal information is sent; only ticker symbols.
• DigitalOcean, LLC — application hosting and managed database. Their privacy policy: digitalocean.com/legal/privacy-policy.

We may disclose information if required by law, regulation, valid legal process, or to protect the safety, rights, or property of Bode, our users, or others.

If Bode is involved in a merger, acquisition, or asset sale, your information may be transferred to the acquiring entity. We will notify you before your information becomes subject to a different privacy policy.

4. How we store and protect your information

• All data is transmitted to and from Bode over TLS (HTTPS).
• Data is stored in a managed PostgreSQL database hosted by DigitalOcean, encrypted at rest, with daily automated backups.
• Passwords are hashed with bcrypt (work factor 10). Plaintext passwords are never stored.
• Plaid access tokens are encrypted at rest in production environments and accessible only to the Bode application process.
• Database queries are scoped by user identifier at the data-access layer, preventing cross-user data access through application code paths.
• Production server access is restricted to authorized administrators using key-based SSH; database access is firewall-restricted to the application server.

No security system is impenetrable. While we use industry-standard practices to protect your information, we cannot guarantee absolute security.

5. Your rights and choices

You have the following rights with respect to your personal information:

• Access: request a copy of the personal information we hold about you.
• Correction: correct inaccurate or incomplete information directly in your dashboard, or by emailing us.
• Deletion: delete your account at any time from Settings → Danger zone. The deletion flow requires you to confirm by re-typing your email address. When you confirm, every linked Plaid bank is disconnected on Plaid’s side, any active Pro subscription is canceled immediately on Stripe, and all your data — transactions, holdings, retirement profiles, Plaid items, OAuth links, and sessions — is permanently removed from our active database. Backups containing your data are purged on the standard backup retention schedule (typically within 7 days). We may retain minimal payment records (Stripe invoice IDs) for as long as required by tax or fraud-prevention laws.
• Disconnect Plaid: at any time you can disconnect a bank account from the Transactions page. This calls Plaid’s /item/remove endpoint and revokes Bode’s access. Previously imported transactions remain in your dashboard unless you also delete your account.
• Withdraw consent: revoke any consent you previously gave by disconnecting the relevant integration (Plaid, Google) or deleting your account.

5.1 California residents (CCPA / CPRA)

If you reside in California, you have the right to know what categories of personal information we collect, to request access to or deletion of that information, to opt out of any sale or sharing of personal information (Bode does not sell or share personal information for cross-context behavioral advertising), and to be free from discrimination for exercising these rights. To submit a request, contact us at [email protected].

5.2 EU / UK residents (GDPR / UK GDPR)

If you reside in the European Economic Area, United Kingdom, or Switzerland, you have additional rights under GDPR / UK GDPR, including the right to access, rectify, erase, restrict processing of, object to processing of, and obtain a portable copy of your personal data. Our legal basis for processing is (a) performance of a contract with you (your use of the Service), (b) your consent (for optional integrations like Plaid), and (c) our legitimate interests in operating and securing the Service.

You may also lodge a complaint with your local data protection authority. Contact us at [email protected] to exercise these rights.

6. Data retention

We retain your personal information for as long as your account is active. When you delete your account, your data is removed from our active database immediately, and purged from backups on the standard retention schedule (typically 7 days). We may retain limited records (e.g., payment receipts) for as long as required by tax, accounting, or fraud-prevention laws.

7. Children’s privacy

Bode is not directed to individuals under 18, and we do not knowingly collect personal information from children under 13 (or the applicable age of consent in your jurisdiction). If you believe we have collected such information, contact us and we will delete it.

8. International users

Bode is operated from the United States. If you access the Service from outside the U.S., your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

9. Cookies

We use a single category of cookies: an authentication session cookie that holds a signed JWT identifying your logged-in session. We do not use marketing, analytics, or third-party tracking cookies. You can clear this cookie at any time by signing out or clearing your browser data.

10. Changes to this policy

We may update this policy from time to time. We will post the updated policy at this URL with a new “Last updated” date. For material changes, we will provide additional notice (such as an in-app banner or email). Continued use of the Service after the effective date of an updated policy constitutes your acceptance of the changes.

11. Contact us

For privacy questions, data-rights requests, or any other concerns, contact us at:

Kelvin Hu
Email: [email protected]