Privacy Policy

Stepforth Wealth (“Stepforth,” “we,” “us”) helps you understand and grow your finances. This policy explains what we collect, how we use it, who we share it with, and the controls you have. Our guiding principle is simple: your data is yours — we use it only to serve you, and we never sell it.

Information we collect

• Account information — your name, email address, and optionally a phone number for notifications.
• Authentication data — login credentials managed by our auth provider, and (if you enable it) multi-factor authentication.
• Financial data via Plaid — when you connect a financial institution, we receive read-only data such as account balances, transactions, liabilities, investment holdings, and account/institution names.
• Documents you upload — statements and paystubs you choose to add, which we process to extract account and transaction details.
• Content you create — goals, budgets, manual entries, and messages to the AI advisor.
• Usage & security logs — authentication events and service-usage records used to operate and secure the product.

How we use your information

We use your information to provide and improve the service: to display your accounts and net worth, categorize transactions, generate insights and AI guidance, send notifications you've opted into, secure your account, and meet legal obligations. We do not sell your personal or financial data, and we never use one user's data to serve another.

Who at Stepforth can see your data

Access is limited to what's needed to run and support the service. Administrators can see operational records — for example, that a notification of a given type was sent to your account and whether delivery succeeded — but these records don't include your balances, transactions, merchants, amounts, or the content of your alerts. We don't browse your financial data; if we ever need to look at it to resolve an issue you've raised, we do so only for that purpose.

Bank connections via Plaid

We use Plaid Inc. to securely connect your financial accounts. When you link an institution, you authenticate directly with Plaid; we receive read-only financial data, not your bank login credentials. Plaid's handling of your information is governed by the Plaid End User Privacy Policy. You can disconnect any institution at any time from within the app, which revokes our access.

How we share information

We share data only with service providers (sub-processors) that help us run the product, under their terms, and only as needed:

• Plaid — account connections (read-only financial data).
• Supabase (on AWS) — database, authentication, and file storage.
• Vercel — application hosting.
• Anthropic (Claude) — AI insights; only the minimum financial context needed to generate your own insight is sent, and it is not used to train models beyond the provider's standard API terms.
• Resend — transactional email.
• Cloudflare — DNS, bot protection, and email routing.
• Twilio (optional) — text-message alerts, if you turn them on. Twilio receives only your phone number and the alert text.

We may also disclose information if required by law, or to protect the rights, safety, and security of our users and service.

Text messages

If you turn on text alerts, we use your verified mobile number only to send you account alerts you agreed to receive. We do not sell, rent or share your mobile number or text-message opt-in with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent are never shared with any third party, except the providers that deliver the messages. Reply STOP to any text to opt out, or turn texts off in Settings.

Data security

We protect your data with encryption in transit (TLS) and at rest (AES-256), database-level row-level security so you can access only your own records, restricted server-side access to secrets, optional multi-factor authentication, and an authentication audit log. No system is perfectly secure, but security is a core priority — see our practices summarized in our Information Security Policy.

Data retention & deletion

We retain your data while your account is active. You can export all of your data and permanently delete your account at any time from within the app; deletion revokes your Plaid connections and removes your data from our systems, after which it expires from routine backups on a rolling cycle. Security and usage logs are retained for a limited period (up to 12 months) and then purged. See our Data Retention & Disposal Policy for details.

Your rights & choices

• Access and export your data.
• Correct or update your information in-app.
• Delete your account and associated data.
• Disconnect linked institutions at any time, revoking Plaid access.
• Manage notification preferences.

To exercise a right not available in-app, contact us at the address below.

Cookies & similar technologies

We use only the cookies necessary to keep you signed in and to operate security features (such as bot protection). We do not use advertising or cross-site tracking cookies.

Children's privacy

Stepforth is not directed to children, and we do not knowingly collect data from anyone under 18.

Changes to this policy

We may update this policy as the product evolves. We'll revise the “Last updated” date above and, for material changes, provide additional notice where appropriate.

Contact us

Questions or requests regarding your privacy? Email support@stepforth.app.