This Privacy Policy describes how Terris Zhu(“we,” “us,” or “our”) accesses, collects, stores, uses, and shares your personal information when you use Taffy (the “Services”) — including when you download and use our mobile app (Taffy: Spending), create an account, connect a bank, or contact us.
Taffy is a personal-finance mobile app that securely connects to your bank through Plaid and helps you categorize your transactions into spending buckets. It does not move money or give financial advice.
If you have questions or concerns, contact us at support@taffybuckets.com. If you do not agree with this policy, please do not use the Services.
1. What information we collect
Information you provide directly
- Email address — when you sign up with email.
- Password — when you create an email account. Your password is handled and hashed by our authentication provider (Supabase) and is never stored in plaintext or accessible to us.
- Apple ID information — if you use Sign in with Apple, we receive the email address Apple provides, which may be a private @privaterelay.appleid.com relay address.
- Things you create in the app — the spending categories you make and the auto-tag rules learned from how you sort.
Financial information we receive through Plaid
When you connect a bank account, we receive the following from Plaid, our bank-data provider:
- Bank and account names
- Account mask (the last four digits of the account)
- Account balances
- Transaction details — amount, date, and merchant
Your bank login credentials are never collected by us and never touch our servers. You enter them directly with your bank through Plaid’s secure flow.
Information collected automatically
- Push notification token — an Apple Push Notification (APNs) device token, used only to notify you about new transactions. You can turn notifications off in your device settings at any time.
Subscription information
If you purchase Taffy+, our optional subscription, we receive your subscription status and related purchase details — such as whether you are on a trial, active, or expired plan, the product you purchased, and Apple transaction identifiers — from Apple and our subscription provider, RevenueCat. We never receive your full payment-card or bank-card details — payment is processed by Apple.
2. How we use your information
We use your information to:
- Create and manage your account and authenticate you;
- Provide the Services — connect your bank, categorize transactions, and sync your data across your devices;
- Send administrative information, such as transaction notifications and changes to our terms;
- Respond to your inquiries and provide support;
- Manage your Taffy+ subscription — including trials, renewals, and access to paid features;
- Request feedback;
- Protect the Services, including fraud monitoring and prevention;
- Evaluate and improve the Services and your experience; and
- Comply with our legal obligations.
We do not use your information for third-party advertising, and we do not use third-party analytics, advertising, or cross-app tracking SDKs.
3. Legal bases for processing (Canada / PIPEDA)
We are based in Canada and process personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA). We process your information only when we have a valid legal reason to do so — primarily with your consent, to provide the Services you have requested, to comply with law, or for our legitimate business interests such as security and service improvement. You can withdraw your consent at any time by contacting us.
4. When and with whom we share your information
We do not sell or rent your personal information. We share it only with the service providers (sub-processors) we use to operate Taffy, and only as needed to provide the Services:
- Plaid Inc. — connects your bank accounts and provides account and transaction data. See plaid.com/legal.
- Supabase — provides our database, authentication, and hosting (running on Amazon Web Services). See supabase.com/privacy.
- Apple — provides Sign in with Apple, push notifications (APNs), App Store distribution, and processes in-app purchases (Taffy+ payments). See apple.com/legal/privacy.
- RevenueCat, Inc. — manages and validates Taffy+ subscription purchases and entitlements. See revenuecat.com/privacy.
We may also share information in connection with a business transfer (such as a merger, acquisition, or sale of assets), or where required by law.
5. How long we keep your information
We keep your personal information for as long as you have an account with us. When you delete your account, we revoke our access to your bank data through Plaid and permanently delete your data — accounts, transactions, categories, rules, and device tokens — from our active databases, except where we are required to retain limited information by law.
6. How we keep your information safe
- Plaid access tokens are encrypted at rest.
- Your data is isolated on a per-user basis using PostgreSQL Row-Level Security, so one user can never access another’s data.
- Data is encrypted in transit using TLS.
No method of transmission or storage is 100% secure, so while we work hard to protect your information, we cannot guarantee absolute security.
7. Children
Taffy is not directed at children. We do not knowingly collect information from anyone under 18 years of age (or the equivalent age of majority in your jurisdiction). If you believe a minor has provided us information, contact us at support@taffybuckets.com and we will delete it.
8. Your privacy rights
Depending on where you live, you may have the right to access, correct, delete, or restrict the processing of your personal information, to data portability, and to withdraw consent. You can review or update your account information in the app, and you can delete your account and all its data at any time from Settings → Delete Account. To exercise any other right, contact us at support@taffybuckets.com.
United States & California residents
If you are a resident of the United States, including California, you have the right to know what personal information we collect (described in Section 1), to access or delete it, and to not be discriminated against for exercising these rights. We do not sell or share your personal information, and we do not use it for cross-context behavioral advertising. You can delete your account and all of its data at any time from Settings → Delete Account, or contact us at support@taffybuckets.com to exercise any of these rights.
9. Controls for Do-Not-Track features
Most browsers and some mobile operating systems offer a Do-Not-Track (“DNT”) setting. There is no finalized industry standard for responding to DNT signals, so we do not currently respond to them. If a standard is adopted, we will update this policy.
10. Updates to this policy
We may update this Privacy Policy from time to time. The updated version will be indicated by a revised “Last updated” date at the top of this page. For material changes, we may notify you in the app or by email.
11. How to contact us
If you have questions or comments about this policy, email us at support@taffybuckets.com.