Privacy Policy

Last updated: June 8, 2026

Stepforth Wealth (“Stepforth,” “we,” “us”) helps you understand and grow your finances. This policy explains what we collect, how we use it, who we share it with, and the controls you have. Our guiding principle is simple: your data is yours — we use it only to serve you, and we never sell it.

Information we collect

• Account information — your name, email address, and optionally a phone number for notifications.
• Authentication data — login credentials managed by our auth provider, and (if you enable it) multi-factor authentication.
• Financial data via Plaid — when you connect a financial institution, we receive read-only data such as account balances, transactions, liabilities, investment holdings, and account/institution names.
• Documents you upload — statements and paystubs you choose to add, which we process to extract account and transaction details.
• Content you create — goals, budgets, manual entries, and messages to the AI advisor.
• Usage & security logs — authentication events and service-usage records used to operate and secure the product.

How we use your information

We use your information to provide and improve the service: to display your accounts and net worth, categorize transactions, generate insights and AI guidance, send notifications you've opted into, secure your account, and meet legal obligations. We do not sell your personal or financial data, and we never use one user's data to serve another.

Bank connections via Plaid

We use Plaid Inc. to securely connect your financial accounts. When you link an institution, you authenticate directly with Plaid; we receive read-only financial data, not your bank login credentials. Plaid's handling of your information is governed by the Plaid End User Privacy Policy. You can disconnect any institution at any time from within the app, which revokes our access.

How we share information

We share data only with service providers (sub-processors) that help us run the product, under their terms, and only as needed:

• Plaid — account connections (read-only financial data).
• Supabase (on AWS) — database, authentication, and file storage.
• Vercel — application hosting.
• Anthropic (Claude) — AI insights; only the minimum financial context needed to generate your own insight is sent, and it is not used to train models beyond the provider's standard API terms.
• Resend — transactional email.
• Cloudflare — DNS, bot protection, and email routing.
• Twilio (optional) — SMS notifications, if you enable them.

We may also disclose information if required by law, or to protect the rights, safety, and security of our users and service.

Data security

We protect your data with encryption in transit (TLS) and at rest (AES-256), database-level row-level security so you can access only your own records, restricted server-side access to secrets, optional multi-factor authentication, and an authentication audit log. No system is perfectly secure, but security is a core priority — see our practices summarized in our Information Security Policy.

Data retention & deletion

We retain your data while your account is active. You can export all of your data and permanently delete your account at any time from within the app; deletion revokes your Plaid connections and removes your data from our systems, after which it expires from routine backups on a rolling cycle. Security and usage logs are retained for a limited period (up to 12 months) and then purged. See our Data Retention & Disposal Policy for details.

Your rights & choices

• Access and export your data.
• Correct or update your information in-app.
• Delete your account and associated data.
• Disconnect linked institutions at any time, revoking Plaid access.
• Manage notification preferences.

To exercise a right not available in-app, contact us at the address below.

Cookies & similar technologies

We use only the cookies necessary to keep you signed in and to operate security features (such as bot protection). We do not use advertising or cross-site tracking cookies.

Children's privacy

Stepforth is not directed to children, and we do not knowingly collect data from anyone under 18.

Changes to this policy

We may update this policy as the product evolves. We'll revise the “Last updated” date above and, for material changes, provide additional notice where appropriate.

Contact us

Questions or requests regarding your privacy? Email security@stepforth.app.