Privacy Policy

Effective September 21, 2026 · Last updated September 26, 2026

This policy explains how Project Money (“we,” “us,” or “our”) handles information when you use projectmoney.app. Contact us about privacy or your data at wravager@gmail.com.

Information we collect

• Account and sign-in information: your identity provider’s account identifier, name, email address, email-verification status, and profile image if provided. We also store account links, sessions, and security information such as IP address, browser/device information, sign-in timestamps, and passkey public-key credentials. We do not receive your Google or Apple password, passkey private key, fingerprint, or face template.
• Information you enter: accounts, balances, transactions, recurring schedules, income, expenses, goals, financial assumptions, tax information, business records, collectibles, preferences, and documents you choose to upload.
• Connected financial information: if you authorize a Plaid connection, we receive data available for the accounts and features you select, such as institution and account details, masked account numbers, balances, transactions, holdings, and available liability information. Availability varies by institution. Bank authentication is handled by Plaid and/or your institution; Project Money does not ask you to submit bank passwords directly to us.
• Scan and search information: card images or selected camera frames, recognized card details, and catalog searches when you use scanning or collectible features.
• Technical information: service requests, error and security logs, session cookies, and local preferences needed to operate and protect the app. Hosting providers also process connection and network information.

How we use information

We use information to create and authenticate your account, maintain your private workspace, import data you authorize, calculate forecasts and estimates, provide notifications, identify collectibles, respond to support requests, prevent abuse, and maintain the service. Your account’s financial records are not made available to other users merely because they register.

Google account information

Google sign-in requests basic identity information: your account identifier, email address, and profile information. We use it for account creation, authentication, account display, recovery through your linked provider, and security. Google sign-in does not give Project Money access to your Gmail messages, Drive files, contacts, or Google financial information.

We do not sell Google user data, use it for advertising, or use it to train general-purpose AI models. Our use and transfer of information received from Google APIs follow the Google API Services User Data Policy, including applicable Limited Use requirements.

Service providers and sharing

We share information as needed to deliver the features you use:

• Cloudflare hosts the application, database, uploaded files, and related infrastructure. When cloud-assisted card scanning is used, selected card images are sent to Cloudflare Workers AI to identify visible card details. Project Money does not save these scan images; the local snapshot is discarded when you retake or close the scanner. Focus and framing checks run locally before automatic capture; card identification uses Cloudflare AI. Avoid including unrelated personal information in scan images.
• Google and Apple process their respective sign-in flows under their own privacy policies. Passkeys are managed by your device or credential provider.
• Plaid and financial institutions process authorized bank connections. See Plaid’s End User Privacy Policy.
• RevenueCat, Stripe, and app stores process paid subscriptions when you choose to purchase one. RevenueCat receives a dedicated account identifier and purchase information to synchronize your membership. Stripe handles web checkout, payment details, invoices, and subscription management; Apple or Google handles purchases made through their native app stores. We store your verified plan, expiration, and purchase provider. Project Money does not store full payment card numbers and does not send your bank ledger or collectible notes to these billing providers.
• Card catalog and pricing providers, such as TCGdex, Scryfall, YGOPRODeck, and PokeValues, receive card search terms or identifiers needed for lookups. For supported Pokémon cards without a catalog price, our server checks PokeValues’ public completed-sale records using the card name, set, and collector number. We keep dated comparable-sale references with the estimate; we do not send your purchase cost, private notes, bank ledger, or sign-in credentials. Loading provider-hosted card images or opening sale links may also disclose your network information to that provider.

Authorized service operators may access information when needed for support, maintenance, security, or legal obligations. We may disclose information when required by law or reasonably necessary to address fraud, protect rights, or respond to a security incident. We do not sell personal information or share it for targeted advertising.

Cookies and device storage

We use cookies to keep you signed in and protect authentication flows, and device storage for preferences such as scanner sound. Blocking necessary cookies can prevent sign-in. The app does not currently include advertising trackers. Your browser, identity provider, and connected services may maintain their own cookies and settings.

Storage and security

Information is stored in our hosted database and private file storage. Access is checked against your authenticated account. We use HTTPS, restricted access, and encryption for provider credentials and bank access tokens. The service must process financial records to provide its features; it is not end-to-end encrypted. No system can guarantee absolute security. Providers may process information in the United States or other countries where they operate.

Retention, controls, and deletion

We retain account and workspace records while needed to provide the service, maintain records you ask us to keep, address security and support issues, and meet applicable legal obligations. Disconnecting a bank stops its connection and removes its saved access token, but previously imported records can remain as archived financial history. Signing out, unlinking a sign-in method, or revoking Google access does not itself delete your Project Money records.

You can edit supported records, export available data, manage sessions and passkeys in Security, and disconnect banks in the app. You can also revoke Google access in your Google Account. To request access, correction, account closure, or deletion of records that cannot be removed in the app, email wravager@gmail.com from your account email. We will verify your identity before acting; do not email passwords, bank credentials, or full account numbers.

When handling deletion, we remove or de-identify information from active systems unless retention is required for a legitimate security, legal, or operational reason. Copies in backups, logs, or independent provider systems may remain for their applicable retention periods. We will explain material limitations when responding to your request. Depending on where you live, you may have additional privacy rights under applicable law.

Children

Project Money is intended for adults aged 18 or older. We do not knowingly collect information from children under 13. Contact us if you believe a child has provided personal information so we can investigate and address it.

Changes and contact

We will update the date on this page when this policy changes and provide additional notice of material changes where required. If a new use of Google user data requires consent, we will obtain that consent before using it for that purpose. Questions and privacy requests: wravager@gmail.com.