Privacy Policy

Overview

Superfin ("we", "us") helps you understand your finances by analyzing your bank transactions. This policy explains what we collect, how we use it, and the choices you have.

Information we collect

• Account data you provide: email and authentication credentials.
• Financial data accessed with your permission through our data provider, Plaid: account balances, transactions, and account metadata.
• Usage data: how you interact with the app, for reliability and product improvement.

How we connect to your bank (Plaid)

We use Plaid Inc. to securely connect to your financial institution. You enter your bank credentials directly with Plaid — we never see or store your bank login credentials. Plaid's handling of your data is governed by the Plaid End User Privacy Policy.

AI-powered features

Superfin uses two AI providers. Each one receives only the data needed for the task. Neither one receives your bank login credentials.

• OpenAI powers the in-app assistant chat, Siri answers in the Superfin iPhone app, chat titles, and AI budget insights. When you ask a question, we send OpenAI your question and the transaction and account data needed to answer it (for example, merchant names, amounts, dates, categories, and balances).
• Anthropic (the maker of Claude) cleans up merchant and subscription names. For this task we send Anthropic the raw merchant text from a transaction and related charge details (such as amounts, dates, and how often the charge repeats). Anthropic can use web search to identify the merchant. Anthropic also powers the "Ask Superfin" help chat on our website, which receives the messages you type into it.

Both providers process this data under their API terms to generate a response for us. Each provider states that, by default, it does not use data sent through its API to train its models (see theOpenAI API data controlsandAnthropic's policy for commercial products).

When you ask a question by voice in the iPhone app, speech-to-text runs on your device. No audio is sent to Superfin; only the transcribed text is sent, and it is handled like a typed question.

How we use your information

• To provide the core product: spending insights, subscription detection, and savings recommendations.
• To answer your questions about your finances within the app.
• To secure, maintain, and improve the service.

We do not sell your personal or financial data.

Service providers we work with

We share data with vendors only as needed to run Superfin, under agreements that limit their use of it:

• Plaid — secure bank connectivity.
• OpenAI — the AI that powers the in-app assistant, Siri answers, chat titles, and budget insights (see above).
• Anthropic — the AI that cleans up merchant and subscription names and powers the website help chat (see above).
• Stripe — payment processing for subscriptions. Your full card number is handled by Stripe and never reaches us.
• Supabase — authentication and secure data hosting.
• Apple and RevenueCat — in-app subscription purchases in the iPhone app. Apple processes the payment; RevenueCat tells us your subscription status.
• Google Firebase Cloud Messaging — delivery of push notifications to the app.
• Vercel and Railway — hosting for our website and servers.
• PostHog and Google — analytics (with your consent; see below).

Cookies & analytics

With your consent, we use cookies and similar technologies to measure traffic and understand how Superfin is used so we can improve it. We rely on:

• PostHog — product analytics (which features are used, where people get stuck). We do not send your bank balances, transaction amounts, or account details to it.
• Google Analytics & Google Ads — to measure marketing and understand how visitors find us. We use Google Consent Mode, so no advertising or analytics cookies are set until you accept.

Essential cookies needed to sign in and keep the app working are always on. Analytics and advertising cookies are off by default and load only after you accept. You can change your choice anytime: Manage cookie preferences.

Data retention & deletion

We retain your data while your account is active. You can disconnect a linked institution at any time, and you may request deletion of your account and associated data by contacting us. Upon deletion we remove your data from active systems within a reasonable period, subject to legal retention requirements.

Your rights

Depending on where you live (e.g., under GDPR or CCPA), you may have rights to access, correct, delete, or port your data, and to object to certain processing. Contact us to exercise these rights.

Security

We use industry-standard safeguards including encryption in transit and access controls. No method of transmission or storage is 100% secure, but we work to protect your information.

Children's privacy

Superfin is not directed to children. You must be at least 18 years old to use it, and we do not knowingly collect data from anyone under 18.

Changes to this policy

We may update this policy from time to time. We'll revise the effective date above and, for material changes, provide additional notice. Continued use after an update constitutes acceptance.

Contact

Questions about this policy? Email support@superfinapp.com.