Rubedo

Introduction

Rubedo is a personal finance management application that helps you track spending, manage budgets, and understand your financial life. This Privacy Policy explains how we collect, use, store, and protect your information when you use our service.

Information We Collect

We collect the following types of information:

• Email address — used for magic link authentication via Supabase. No passwords are stored.
• Financial data via Plaid — account names, types, and balances; transaction history including merchant name, amount, date, and category; institution names; and optionally investment holdings and liabilities.
• Device and technical data collected by Plaid — when you connect a financial account, Plaid may collect your IP address, browser type, device information, and other technical identifiers as described in Plaid's End User Privacy Policy.
• User-generated content — budgets, categories, tags, recurring transaction rules, and notes you create within the app.
• Household membership data — information about household members you invite to share financial data.

Important: Rubedo never receives your bank login credentials. Plaid handles authentication directly with your financial institution.

How We Use Your Information

We use your information solely for the purpose of providing personal finance management services:

• Display account balances and transaction history
• Categorize and organize your spending
• Generate financial reports and insights
• Sync new transactions from your connected accounts
• Detect and manage recurring transactions
• Track budget progress

We do not use your financial data in anonymized or aggregate form for any purpose beyond operating the service for you.

Consent

By creating an account and using Rubedo, you consent to the collection, processing, and storage of your data as described in this policy. When you connect a financial account through Plaid, you additionally consent to Plaid accessing and processing your financial information in accordance with Plaid's End User Privacy Policy. You may withdraw consent at any time by disconnecting your accounts and deleting your data.

Data Storage & Security

• Data is stored in Supabase (PostgreSQL) with Row Level Security ensuring household-level data isolation.
• Plaid access tokens are stored server-side only and encrypted at rest — they are never exposed to the browser.
• All data is transmitted over HTTPS with TLS 1.2+ encryption.
• Data at rest is encrypted via Supabase's infrastructure encryption.
• Authentication uses magic links — no passwords are stored or transmitted.
• Access to production systems is restricted and monitored.

Plaid Integration

Rubedo uses Plaid Inc. as a third-party service provider to securely connect to your financial institutions for the purpose of personal finance management. When you link an account, Plaid collects your credentials directly and provides Rubedo with account and transaction data. Rubedo stores a Plaid access token to maintain the connection and sync new data.

Plaid may collect and process additional information as described in its privacy policy. By connecting an account through Plaid, you agree to Plaid's terms and privacy practices.

You can disconnect any linked account at any time via Settings > Connections, which revokes the Plaid access token and stops all data syncing for that institution.

For more information, see Plaid's End User Privacy Policy.

Data Sharing

We do not sell, rent, or share your personal or financial data with marketers or any other third parties for their own purposes. Your data is shared only with the following service providers as necessary to operate Rubedo:

• Supabase — database hosting and authentication
• Plaid — financial account connectivity and data aggregation
• Vercel — application hosting

If you are part of a household, other household members will be able to see shared financial data.

Data Retention & Deletion

We retain your data according to the following schedule:

• Active financial data — retained while your account is active.
• Soft-deleted records (transactions, accounts, categories) — permanently purged after 90 days.
• Audit log entries — purged after 12 months.
• Expired household invitations — purged 30 days after expiry.
• Disconnected Plaid connections — access token destroyed immediately on disconnect; connection record purged after 30 days.
• Synced data after disconnect — retained unless you explicitly delete it.
• Account deletion — immediate permanent deletion of all data (CASCADE).

Automated purge jobs run daily to enforce these retention periods. When you disconnect a financial account, the Plaid access token is destroyed immediately and syncing stops. When you delete your account, all household data is permanently and irreversibly deleted if you are the sole household member. You may also request data deletion by contacting us at the email below.

Your Rights

You have the right to:

• Access your data within the app at any time
• Disconnect linked bank accounts via Settings > Connections
• Export your data via Settings > Export
• Request correction of inaccurate data
• Delete your account and all associated data
• Withdraw consent for data processing

For California residents (CCPA): You have the right to know what personal information we collect, request deletion of your personal information, and opt out of any sale of personal information. We do not sell personal information. To exercise these rights, contact us using the information below.

Cookies & Local Storage

• Auth session cookies — managed by Supabase for authentication.
• Local storage — optionally stores a user-provided AI API key for receipt OCR scanning. This key never leaves your browser.
• We do not use third-party tracking cookies or analytics.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be communicated within the app. Continued use of Rubedo after changes constitutes acceptance of the updated policy.

Contact

If you have questions about this Privacy Policy, your data, or wish to exercise any of your rights, please contact us at privacy@rubedo.app.