| Category | What it is | Why we collect it |
|---|---|---|
| Account information | Email address, password (stored as a secure hash, never in plain text) | To create and secure your account |
| Usage/technical data | IP address, browser/device type, timestamps | Security, fraud prevention, troubleshooting |
| Support communications | Anything you send us directly | To help you |
We do not collect, receive, or store the contents of the PDF statements you upload, or the transactions/categories parsed from them — that data is processed and stored entirely within your own browser (IndexedDB), on your device. There are three narrow, deliberate exceptions, described in Sections 1b, 1c and 1d below: a file you choose to attach to a bug report, an encrypted backup you choose to create, and — for business accounts that opt in — anonymized categorization votes.
Your statement and transaction data is encrypted at rest on your device (AES-256) using a key derived from your account password. That key is generated and used entirely in your browser — it is never sent to us or to anyone else, and we have no way to decrypt your data even if we wanted to. A random value (a "salt") used in generating that key is stored on our servers so that, once you're signed in on a new device, the app can rebuild the same key from your password — this salt is not secret and reveals nothing about your data or your password.
Because there is no separate recovery key, this comes with a tradeoff you should know about: if you reset your password, a new device key is created, and any data saved under the old key — on this device or in a Cloud Backup — can no longer be unlocked. The app will warn you about this before you reset your password. Using the same, unchanged password is what keeps your data accessible over time.
When you report a bug through the in-app feedback form, you may optionally attach a screenshot or a copy of a PDF statement to help us reproduce and fix the issue — for example, a parsing problem specific to your bank's statement format. If you choose to attach a file, that file is uploaded to a private, access-restricted storage location, viewable only by our support team, and used only to diagnose and fix the reported issue.
Attaching a file is always optional and requires an action from you — it never happens automatically. We recommend redacting or blacking out account numbers before attaching a statement. You can decline to attach anything and still submit a bug report with a written description.
Cloud Backup is off unless you turn it on yourself, from the "Cloud Backup" button in the app. When you choose to back up, everything in your local browser storage is bundled together and encrypted, in your browser, using the same key described in Section 1a — then that single encrypted file is uploaded to a private, access-restricted storage location tied to your account. We only ever receive ciphertext we cannot read; we have no way to decrypt it, the same as everything else described in Section 1a.
There is only ever one backup per account — creating a new one replaces the previous one. Restoring a backup (on this device or a new one) requires your account password, downloads and decrypts that file locally in your browser, and replaces whatever is currently on that device. You can delete your cloud backup at any time from the same panel, which removes it from our servers; it does not affect the data already on any device.
Business accounts can opt in to Community Categorization at sign-up or at any time from the Categories tab. It is off unless you turn it on. When it's on and you correct how a transaction is categorized, the app sends a small "vote" so that, once enough businesses agree, everyone's future imports are categorized correctly automatically.
| Sent with each vote | Never sent |
|---|---|
| The merchant words from the transaction description, with every number removed and any trailing city/state removed (e.g. "home depot") The category and subcategory you chose Your business industry (e.g. Event Rentals) A one-way scrambled identifier, so each account counts once — not your email or account ID |
Amounts, dates, balances, or account/card numbers Your name, your business name, or any description containing either Payment-app transfers to people (Zelle, Venmo, Cash App, PayPal, Apple Cash) Bare labels like "Debit" or "ACH" Custom categories you created yourself |
Votes are stored in a private table that no user can read. The app only receives aggregated rules — a merchant becomes a shared rule once at least three different businesses have categorized it and at least 60% of them agree. Every business account can benefit from these shared rules; only accounts that opt in contribute. Turning sharing off deletes every vote your account has made.
Depending on where you live, you may have the right to access, correct, delete, or export the personal information we hold about you (which, per Section 1, is limited to your account and usage data — your financial data isn't something we hold at all). To exercise these rights, contact us at privacy@stackedpilot.com. You can also delete your account data directly from within the app at any time.
We use only the cookies/local storage necessary to keep you logged in and the app functional.
Account information is retained for as long as your account is active. If you close your account, your account information is deleted within a reasonable period afterward. Your statement and transaction data lives only in your browser and is under your control at all times — clearing it, or your browser's storage, removes it completely. If you've used the optional Cloud Backup feature (Section 1c), your encrypted backup is deleted whenever you choose to delete it yourself, or within a reasonable period after your account is closed.
| Provider | Purpose | What they can access |
|---|---|---|
| Supabase | Account authentication | Email address, password hash |
| Supabase | Storing bug report attachments (only if you choose to attach one) | The file you attached, and your account ID |
| Supabase | Storing the random salt used to rebuild your local encryption key on a new device (Section 1a) | A random value tied to your account ID — not your password or your data |
| Supabase | Storing your Cloud Backup (only if you turn it on — Section 1c) | One encrypted file per account, which Supabase cannot decrypt |
| Supabase | Storing Community Categorization votes (business accounts that opt in — Section 1d) | Scrubbed merchant words, the chosen category, your industry, and a scrambled account identifier |
Supabase's infrastructure runs on Amazon Web Services (AWS).
The Service is not directed to, and we do not knowingly collect personal information from, anyone under 18.
We'll update this Policy as the Service evolves and post the new effective date here.
Questions or requests regarding this Policy: privacy@stackedpilot.com — Stacked Pilot Co LLC, 4822 S 119th Dr, Avondale, AZ 85323.