Privacy Policy

When you create an account, we collect:

• Email address
• First and last name
• Password (stored as a one-way bcrypt hash — we never store your plain-text password)
• Third-party sign-in identifiers if you use Apple Sign-In or Google Sign-In (Apple ID or Google ID only — we do not receive your Apple or Google password)

When you connect bank accounts or use the app, we collect:

• Bank account details: account name, institution name, account type, last 4 digits of your card number, IBAN, and current/available balances
• Transaction history: amounts, dates, merchant names, categories, merchant category codes (MCC), and payment channels
• Budget information: monthly income, fixed expenses, and variable expenses you set up during onboarding
• Savings goals ("Jars"): goal names, target amounts, current progress, and contribution history
• Receipt images: photos of receipts you upload for expense tracking, along with extracted merchant name, items, and totals
• Bank access tokens: encrypted credentials used to sync your accounts (encrypted with AES-256-CBC — see Security section)

If you turn on Clario AI and use it, we also process:

• Your chats with the AI assistant: the messages you send, the assistant's replies, and a rolling summary of each chat's older messages. They are stored with the chat so the assistant can answer follow-up questions, and you can delete a chat at any time.
• AI memory: short facts you share about yourself that the assistant saves to personalise future answers, for example the shops you use, your household size, or a diet or allergy. You can view, delete and switch off memory in Settings → AI memory (see section 4).
• Voice recordings: when you add a transaction by voice, the short recording is sent to OpenAI to be transcribed. We do not store the recording; only the transaction you confirm is saved.

We also collect:

• IP address and user agent string, used for security, rate limiting and abuse prevention. They appear in our server logs, which are kept for 30 days.
• Country and language preferences you set in the app
• Device push notification tokens, so we can send the notifications you turn on
• App usage and crash data: pseudonymous events such as screens opened, app version, device model and crash reports (via Google Firebase Analytics and Crashlytics). These never include your balances or transactions.
• Advertising attribution events: app install, app open and purchase events sent to Meta through its App Events SDK, so we can tell which ads bring new users. On iOS, your advertising identifier is used only if you allow tracking.
• Website analytics: Google Analytics, only if you choose "Allow analytics" in the cookie banner, and Vercel Web Analytics, which counts page views without cookies.

Clario AI features stay off until you give explicit consent in the app, and our server refuses AI requests from accounts that have not consented. When you use the AI Financial Assistant or receive AI-generated insights, we send the financial context the request needs to OpenAI's API. This can include account balances, recent transactions (amounts, categories, merchant names), budget information and savings goals. For receipt scanning, we send the receipt image to OpenAI's Vision API. OpenAI processes this data to generate responses and does not use it to train its models (per its API data usage policy). We send the minimum data needed for each request, and you can withdraw your consent at any time in Settings. How we handle chat history, AI memory and voice input is described below.

Your chats are sent to OpenAI only after you give explicit AI consent in the app. To answer follow-up questions, each chat stores its conversation history and a rolling summary of its older messages, which is also written by an OpenAI model. Both are kept with the chat in our database until you delete the chat or your account, and the recent messages plus the summary are sent to OpenAI with each new message in that chat.

Long-term memory: the assistant may save short facts you share about yourself, such as the shops you use, your household size, or your diet or allergies, to personalise future answers, including in new chats. A diet or allergy can be health-related information, which the GDPR treats as a special category of personal data. To decide what to save, an OpenAI model also checks each message you send, and your saved facts are sent to OpenAI as part of your chat requests. The assistant is instructed not to save other health conditions, religion, political views, sexuality, or ID, card or account numbers. Memory keeps up to 30 facts; when it is full, the oldest are removed first.

Your controls: in Settings → AI memory you can see every saved fact, delete individual facts, clear them all, or switch memory off. Switching memory off stops new facts being saved and stops saved facts being sent with your chats; facts you already saved stay until you delete them. All memory facts are deleted with your account. The in-app data export does not include memory facts yet; you can request a copy at support@clarioapp.net.

Legal basis: we process your chats and memory facts on the basis of your consent. For health-related facts such as a diet or allergy, you give explicit consent by choosing to share them with the assistant while memory is on. You can withdraw it at any time by deleting those facts or switching memory off, and you can withdraw AI consent altogether in Settings. Withdrawing consent does not affect processing that took place before.

OpenAI does not use data sent through its API to train its models (per its API data usage policy).

Voice input requires your AI consent and microphone permission. When you add a transaction by voice, the app records a short clip from the moment you tap the microphone until you tap again, and sends it to our server, which passes it to OpenAI's speech-to-text API (Whisper) for transcription only. The resulting text is then sent to OpenAI to turn it into a draft transaction that you review before saving. We do not store the recording on our servers or in our logs; only the transaction you confirm is saved. OpenAI does not use the audio to train its models.

In the United States and Canada today, and in the United Kingdom and the European Union once bank sync launches there (coming soon), bank connections are made through Plaid: you sign in to your bank inside Plaid, and we receive a read-only access token plus your account, balance and transaction data. Plaid's service is provided by Plaid Inc. (United States), Plaid Financial Ltd. (United Kingdom) and Plaid B.V. (European Union). In Ukraine, we connect to Monobank's official API with a read-only token you provide. Before you connect a bank, we may ask you to confirm it's you with a one-time code sent to your email (see section 6). Access tokens are encrypted at rest with AES-256-CBC and are never stored in plain text. We never receive your bank username or password, and no connection can move money. Outside these regions no bank is connected; you enter data manually or import a statement.

Plaid's own handling of your data is described in the Plaid End User Privacy Policy.

If you sign in with Apple or Google, your account identifier is used for authentication only. Subscriptions and purchases are processed by the App Store or Google Play; we verify receipts with their servers to confirm your plan and store the transaction ID for subscription management. We never receive your card details.

The app uses Google Firebase Analytics and Crashlytics for product analytics and crash reports, and the Meta App Events SDK to attribute app installs and subscriptions to our ads. These services receive pseudonymous identifiers, device information and app events. They never receive your bank credentials, balances or transactions. On this website, Google Analytics (GA4) runs only if you choose "Allow analytics" in the cookie banner, and Vercel Web Analytics measures aggregate page views without cookies.

How to opt out: turn off Settings → Privacy → Share usage data in the app to stop Firebase Analytics and Crashlytics. On iOS, Meta can use your advertising identifier only if you tap "Allow" in Apple's App Tracking Transparency prompt; you can change this at any time in iOS Settings → Privacy & Security → Tracking. On Android, you can reset or delete your advertising ID in your device settings. On the website, choose "Essential only" in the cookie banner.

We send transactional emails (verification codes, password resets, account deletion confirmations) through an SMTP email provider, and waitlist emails through Resend. Your email address and the message content are the only personal data transmitted. We do not send marketing emails without your consent, and our transactional emails contain no tracking pixels or external resources.