Data Retention and Disposal Policy

This policy defines what data our application (Finance Crystal Ball) collects, how long it is kept, and how it is securely disposed of. Our guiding principle is data minimization: we collect only what is needed to provide the service, keep it only as long as it is needed, and delete it promptly when it is no longer needed or when the user asks.

1. Categories of data

• Account information: the user's email address and a hashed (never plaintext) password, or a Google account identifier for Google Sign-In.
• Budget and forecast data: income, bills, spending plans, and cash-flow projections the user enters.
• Plaid connection data: a Plaid access token representing the user's read-only link to their bank (obtained through Plaid Link).
• Financial data read through Plaid: account balances and recent transactions.
• Optional security data: a TOTP secret if the user enables two-factor authentication.

2. Retention periods

• Account, budget, and forecast data are retained for the life of the user's account so the service remains useful across devices and over time.
• The Plaid access token is retained only while the bank connection is active. When the user disconnects the bank, the token is deleted immediately.
• Balances and transactions read through Plaid are used to display current figures and forecasts and are not warehoused; they are fetched to render the view and are not accumulated into a long-term store.
• The TOTP secret is retained only while two-factor authentication is enabled; disabling it deletes the secret.

3. Disposal and deletion

• Disconnecting a bank deletes the stored Plaid access token, ending our access.
• Disabling two-factor authentication deletes the stored TOTP secret.
• Deleting an account permanently removes all of that user's data, including their budget and business data, Plaid access token, and any TOTP secret. The deletion cascades so that no orphaned records remain.
• On the local application, clearing the app's data removes locally stored budget information and the encrypted token.
• Decommissioned storage media are wiped or destroyed before disposal, and backups are purged on the same schedule so deleted data does not persist in backups beyond the backup retention window.

4. Backups

Operational backups exist to protect against data loss and are access-controlled the same way as production data. Backups are retained only as long as needed for recovery and are rotated so that data deleted at the user's request does not persist indefinitely.

5. Third parties

Plaid processes bank connections on our behalf; Plaid's own retention and security practices are described at plaid.com/legal. We do not share financial data with any other third party.

6. User rights

Users can disconnect a linked bank, disable two-factor authentication, or delete their account and all associated data at any time from within the application. Requests can also be made to mattmontneyjr@gmail.com.

7. Review

This policy is reviewed at least annually and updated as practices change.