Privacy Policy

1. Who this covers

This policy applies to Lamp & Ledger (the “Service”), operated by Lamp & Ledger, LLC (“we,” “us”), including the website at lampandledger.com and any installed version of the app. It applies to people who create an account and to visitors who only browse the marketing pages.

It does not cover the practices of third parties we link to or integrate with, including your bank and Plaid. Their handling of your information is governed by their own policies.

It also applies to a person you invite to share your account through Family Sharing, from the moment you give us their email address — before they have an account of their own.

2. Information we collect

Information you give us

• Account details. Your first and last name, email address, phone number, and a password. Passwords are handled by our authentication provider and stored only as a salted hash — we never see or store your password in a readable form.
• Profile settings. Your timezone, your light/dark theme preference, and an optional profile photo you choose to upload.
• Financial information you enter yourself. Manual accounts, debts, budget amounts, income sources, savings goals, categories, rules, transaction notes, and anything else you type into the app.
• Receipts you attach. Photos or PDFs you choose to attach to a transaction. They are stored as files and are never scanned, indexed, or analyzed — no automated process reads what is on them, and nothing in the app extracts a merchant or an amount from them. The owner of this company can open them, which is described in Section 8 and on our Security page. Deleting the transaction deletes the receipt with it, and deleting your account deletes every receipt you have ever attached.
• Family Sharing. If you invite your Spouse, the email address you enter for them, the access level you chose, and a record of the invitation and of the resulting membership: who shares which account, with what access, and since when. If you are the person invited, your email address reaches us with the invitation, before you have an account.
• Correspondence. Messages you send us for support, and the email address you send them from.

Information we receive from your bank, through Plaid

• Account names, types, subtypes, masked account numbers, and balances.
• Transaction history, including dates, amounts, merchant names, and the categories your bank or Plaid assigns.
• For credit cards and loans, liability details such as interest rates, minimum payments, statement balances, and due dates.
• The name of the financial institution and the status of the connection.

Information collected automatically

• Usage and device data. Pages visited, approximate location derived from IP address, browser and device type, and timestamps. This is collected across the site, including after you sign in, and we use it to understand how the Service is used and to keep it working.
• Log data. Our hosting provider records requests to the Service, including IP address and error information, for reliability and abuse prevention.

Categories, in the terms the statutes use

California and several other states require this described by category rather than in plain prose. In the twelve months before the date above we collected, and disclosed to the service providers named in section 5 for the business purposes named in section 4, the following:

• Identifiers — name, email address, phone number, account identifier, IP address, and the email address of anyone you invite to share your account.
• Personal information under Cal. Civ. Code §1798.80(e) — name, phone number, and financial account information.
• Commercial information — transaction records, balances, and the debts, budgets and goals you create.
• Internet or network activity — pages viewed and interactions with the Service.
• Geolocation data — approximate location inferred from IP address. We do not collect precise geolocation.
• Inferences — spending categories, recurring-payment detection, and the projections the Service produces from your data.
• Sensitive personal information — the access credential Plaid issues us for your financial accounts, and masked account numbers.

We use sensitive personal information only to provide the Service you asked for and for the other purposes permitted without a right to limit under California regulations. We do not use or disclose it to infer characteristics about you, so no “Limit the Use of My Sensitive Personal Information” link is required or offered.

We have not sold or shared any category of personal information, and we do not use any category for cross-context behavioral advertising or for profiling in furtherance of decisions that produce legal or similarly significant effects.

3. Bank connections and Plaid

We use Plaid Inc. to connect to your financial institutions. When you link an account, Plaid collects your banking credentials directly — we never see, receive, or store your bank username or password. Plaid returns an access token to us, which we store encrypted and use to request your account and transaction data.

By linking an account, you also agree to Plaid’s End User Privacy Policy. Plaid processes your information as an independent controller for some purposes; their policy governs that processing.

We request read-only access. The Service cannot move money, initiate payments or transfers, open or close accounts, or change anything at your bank. It can only read.

You can disconnect any institution at any time from Settings → Bank Connections. Disconnecting revokes our access token with Plaid and stops future data collection from that institution.

4. How we use information

• To provide the Service: showing your accounts, transactions, budget, and payoff plan.
• To categorize transactions, detect recurring payments and transfers, and project balances.
• To create and maintain your account, and to authenticate you when you sign in.
• To send transactional email such as password resets and account confirmations.
• To let a person you invite through Family Sharing see your account and, if you choose, change it — and to tell each of you when that sharing starts, changes, or ends.
• To respond to your support requests.
• To monitor reliability, debug problems, and prevent fraud and abuse.
• To measure how the marketing site performs in aggregate.
• To comply with legal obligations.

We do not use your financial data to build advertising profiles, and we do not use it to market third-party products to you.

Email we send you. Two kinds, and the difference matters. Account email — confirming your address, a single welcome when you do, resetting your password, telling you your security settings changed — is part of signing in, and cannot be turned off while your account exists. Everything else is optional and switchable off from Settings at any time. Three optional messages start on: a short congratulations when a debt you track reaches zero, a summary of how each month finished, sent on the first of the next month, and — once you have used budgets — a reminder to plan the coming month, sent a few days before it begins. Each carries a one-click unsubscribe link. Every other optional email stays off until you switch it on. Optional email may name transactions, amounts and the accounts they belong to; it never contains an account balance or an account number. Family Sharing sends a short notice when an invitation is sent, accepted, changed, or ended — to the person it concerns — and nothing else; those notices are part of sharing an account and stop when the sharing does.

5. How we share information

We share personal information only in these situations:

• Service providers. Companies that run parts of the Service on our behalf, under contract, and only for that purpose. Each is bound to protect your information to a standard at least equal to the one described in this policy, and none is permitted to use it for its own purposes. Today these are: Plaid (bank connectivity), Supabase (database, authentication, and file storage), Vercel (hosting and analytics), and Resend (email delivery). Resend receives the address we send to and the contents of the message, and retains a copy for 30 days so that delivery problems can be diagnosed. If we add payment processing, the processor will be added here.
• Legal requirements. When we believe disclosure is required by law, subpoena, or other legal process, or is necessary to protect the rights, property, or safety of you, us, or others.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, your information may transfer as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.
• With the people you share with. If you invite your Spouse through Family Sharing and they accept, they can see everything in your account — every account, balance, transaction, receipt, budget, and goal — and, if you gave them Full Edit, change it. They cannot add or remove bank connections or account alerts, whatever their access. You can change their access or remove them at any time from Settings → Family Sharing, and they can leave at any time. A Spouse’s own sign-in, two-factor, theme, and timezone are theirs and are not shared with you. We tell the other person by email when sharing starts, changes, or ends.
• With your direction. When you ask us to share something.

6. We do not sell your information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law. We have not done so in the preceding twelve months.

7. How long we keep it

Disconnecting a bank deletes that bank’s data. When you disconnect an institution from Settings → Bank Connections, we release the connection at Plaid and permanently delete the accounts, transaction history, and imported debts that came from it. The app asks you to confirm first, and it cannot be undone.

Otherwise we keep your information for as long as your account is open. When you delete your account, we remove your uploaded photo and any receipts you attached, release every bank connection at Plaid, and then delete your profile, accounts, transactions, debts, budget, goals, categories, rules and recurring series from our database. The Plaid step runs before the database deletion on purpose: the keys that release those connections are stored on the rows being deleted.

How we decide how long to keep things. Account and financial records are kept for as long as your account is open, because the Service cannot show you your own history without them, and are deleted when you delete the account. Encrypted database backups are retained on a rolling basis by our database provider and expire automatically, currently within 30 days. Server logs are retained for a short operational period, currently no more than 30 days, for debugging and abuse prevention. We may retain records for longer where the law requires it. Family Sharing records — invitations and memberships, including ones that have ended — are kept for the life of the account they belong to and deleted with it; a pending invitation expires after 14 days.

One precondition on deletion. You cannot delete your account while a Spouse is attached to it or an invitation is pending, because deleting it would take away another person’s access without a word to them. Remove them, or cancel the invitation, from Settings → Family Sharing — one click — and then delete. A Spouse who deletes their own login leaves the shared account first, automatically, and the account’s Owner is told by email.

One exception we would rather state than hide: if the stored key for a bank connection cannot be decrypted at deletion time, we log the failure and continue deleting your account rather than refusing to delete it. That connection may remain registered at Plaid even though we can no longer read it. You can avoid this entirely by disconnecting your institutions before deleting your account.

8. How we protect it

Security measures are described in plain terms on our Security page. In summary: traffic is encrypted in transit, data is encrypted at rest by our database provider, Plaid access tokens are additionally encrypted by us before they are stored, and database access rules scope every row of your financial data to the account that owns it — and, if you have invited your Spouse, to their sign-in while it has satisfied two-factor authentication, with the access you chose enforced by the same rules. Once you turn on two-factor authentication, those same rules admit only a sign-in that has entered the code — a password alone reads nothing, even through the database’s own interface. A profile photo you upload is stored in private file storage: it is not reachable at a public address, and the app creates a temporary link for it, valid for under an hour, when you load a page that shows your photo. Receipts you attach are stored the same way — a private bucket with no public address, and a temporary link created when you open the transaction that holds them.

Two deliberate exceptions apply to the owner of this company, and to nobody else. Running the service requires them, so we state them rather than leave them to be inferred. The owner holds the key that decrypts the token connecting your bank, and can open the profile photos and receipt images stored for any account — a capability added so that deleting an account can remove the files that go with it. No employee, contractor, or other administrator has either, because there are none; our support tools show no balances, amounts, or transactions to anyone.

No service can promise perfect security. You are responsible for keeping your password confidential and for using a password you do not reuse elsewhere.

9. Your rights and choices

• Access and correct. Your profile is editable at Settings → Profile. Most of your financial data is editable directly in the app.
• Delete. You can delete your account and its data yourself at Settings → Security. This is permanent.
• Disconnect a bank. At Settings → Bank Connections, at any time.
• Email. Transactional email is part of the Service and cannot be turned off while your account is open. We do not currently send marketing email.
• Family Sharing. Change your Spouse’s access, or remove them, at Settings → Family Sharing. If you are the Spouse, you can leave from the same page. If you were invited and do not want to be, ignore the email; the invitation expires on its own and nothing is created.

• Targeted advertising. You have the right to opt out of processing for targeted advertising. We do not do it, so there is nothing to opt out of.
• Profiling. You have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. The Service produces projections for your own planning; it makes no decision about you, and we do not profile you in that sense.
• If you cannot sign in. Email info@lampandledger.com from the address on your account and ask us to delete it. This is the deletion channel for anyone who cannot reach Settings → Security, including people who no longer have the app installed.

To make any other request, email info@lampandledger.com. We may need to verify your identity before acting, and we will not discriminate against you for exercising a privacy right.

10. U.S. state privacy rights

Depending on where you live, you may have the right to know what personal information we collect and how we use it, to request a copy in a portable format, to correct inaccuracies, to request deletion, and to appeal a decision we make about your request. Residents of California, Colorado, Connecticut, Tennessee, Virginia, Utah and other states with comprehensive privacy laws have some or all of these rights.

We will confirm receipt and respond within 45 days. If we need more time we will tell you why and may extend once, by up to 45 additional days. If we deny your request you may appeal by replying to our response; we will answer the appeal in writing within 45 days, and if we deny the appeal we will give you a way to contact your state Attorney General to submit a complaint.

Submit a request by emailing info@lampandledger.com. We operate entirely online and deal with you directly, so email is our designated request method. You may use an authorized agent.

Some financial information is regulated under federal law, including the Gramm-Leach-Bliley Act, which interacts with state privacy statutes in ways that depend on how a business is classified. We do not rely on that interaction to withhold any right described above: whatever the classification turns out to be, we handle your information as this policy describes and we honor the requests listed here.

11. Cookies and analytics

We use cookies that are strictly necessary to run the Service — principally to keep you signed in. These cannot be turned off without breaking sign-in.

We use a cookieless product analytics service to count page views and understand which pages people read. It runs across the whole site, including pages you see after signing in. It does not set cookies, does not build an advertising profile, and does not follow you to other websites.

We do not use advertising cookies or third-party advertising trackers anywhere. Plaid’s software runs on signed-in pages so that bank connections work; it is a functional component of the Service, not an advertising tracker.

Do Not Track and Global Privacy Control. Browsers can send a “Do Not Track” signal, and there is no common standard for how sites should answer it, so we do not respond to it. It makes no practical difference here: we do not track you across other websites, and we do not allow anyone else to do so through the Service. Because we neither sell nor share personal information, a Global Privacy Control signal has nothing to opt you out of.

12. Children’s privacy

The Service is not directed to children under 18, and we do not knowingly collect personal information from them. If you believe a child has given us information, email info@lampandledger.com and we will delete it.

13. Where your data is processed

The Service is operated in the United States and is intended for users in the United States. Bank connections are limited to U.S. financial institutions. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

14. Changes to this policy

We may update this policy. When we do, we will change the “Last updated” date at the top. If the changes are material, we will give you notice — by email or in the app — before they take effect. Continuing to use the Service after a change means you accept the updated policy.

15. How to contact us

Lamp & Ledger, LLC
Privacy requests and everything else: info@lampandledger.com