Privacy Policy

1. Introduction

Financial Fitness Passport, Inc. ("we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, and protect your information when you use the Financial Fitness Passport App ("App").

By using our App, you agree to this Privacy Policy. If you do not agree, please do not use the App.

2. Information We Collect

Personal Information

We collect information that you provide directly to us, including:

• Account Information: Name, email address, password (encrypted), and account credentials
• Verification Data: Email verification status and verification timestamps
• Profile Information: User preferences, settings, and customization choices

Financial Information

You may choose to provide sensitive financial data, including:

• Income, savings, and emergency fund amounts
• Debt balances, interest rates, and repayment plans
• Investment account balances and contribution rates
• Insurance coverage details and estate planning status
• Cash flow data (income sources and expense categories)
• Tax information (filing status, deductions, state tax data)
• Employee benefits details (health plan elections, 401(k) match, HSA/FSA enrollment, equity compensation, and other employer-provided benefits)
• Real estate you own, including estimated values and related mortgage balances
• Business interests and their estimated values
• Other valuables you choose to record

AI Inputs & Outputs

When you use our AI-powered features — which include the Penny assistant, the AI Tax Planner, your personalized roadmap, progress interpretation, document and investment statement analysis, the employee benefits analyzer, and analysis of your cash flow, debts, goals and savings — we collect:

• Questions, prompts, and messages you submit to the AI
• The responses our AI features generate, which are general education, not personal recommendations
• Context data (your financial profile used to personalize AI outputs)
• Chat history and conversation logs
• If you have turned on Account Sync: data from your synced transactions — merchant names, amounts, dates, and the categories those transactions are assigned to — used to answer your questions about your spending
• Notes you write on individual transactions are included in what the AI assistant reads, so it can answer questions about them

Voice Calls with Penny

You can choose to talk with Penny by voice, in your browser or by having Penny call your phone. Voice calls are optional; nothing in this subsection happens unless you start one.

• An AI voice. Penny is an AI, and she speaks with an AI-generated voice. She shares general education, not personal financial, tax, or legal advice.
• Provider processing. Our voice provider, Retell AI, carries the call audio, converts what you say into text, and converts Penny's answers into speech. Penny's answers are generated with OpenAI, as in text chat. Our voice service runs on Google Cloud.
• Transcription. Every call is transcribed: what you say and what Penny says are kept as a written transcript. Penny tells you this at the start of every call.
• Six-month retention. Call transcripts are kept for 6 months from the call and then deleted automatically (see Section 6).
• Compliance review. Authorized Financial Fitness Passport staff may review call transcripts, and your text conversations with Penny, for quality and compliance purposes. Every review is recorded. Transcripts are not shown in the App.
• Phone calls. If you want Penny to call you, you add your mobile number and confirm it with a one-time code we send by text message through Twilio. We use your number only to place calls you ask for: Penny calls only when you tap "Have Penny call me" and agree to the call. Your number is stored encrypted. Message and data rates may apply.
• Stopping calls. You can stop Penny's phone calls at any time by saying "stop calling me" during a call, by tapping "Stop phone calls" in the App, or by emailing support@financialfitnesspassport.com. Only you can turn calls back on, in the App.

Voice Demo

You can try a three-minute voice demo with Penny without an account. To start it, we ask for your name and email address. A phone number is optional for a demo in your browser and required if you ask Penny to call you; in that case we first text a one-time code to the number, through Twilio, to confirm it is yours, and we call it once, from (631) 518-3334. We use these details to allow one demo per person and to prevent abuse, and we set a small cookie on your device for the same purpose. If, and only if, you check the separate box, we may also contact you about Financial Fitness Passport by email, and by calls and texts to the number you gave. Checking it is not required to try the demo. In the demo, Penny sees no account information and shares general education only. The call is processed and transcribed as described in "Voice Calls with Penny." To keep out automated sign-ups, the form uses Cloudflare Turnstile, which receives your IP address and information about your browser. We keep demo sign-up details and transcripts for 6 months and then delete them automatically, except that, if you agreed to be contacted, we keep your contact details until you withdraw that consent. If you later create a Financial Fitness Passport account with the same email address and confirm it, we delete your demo details within a day. To withdraw your consent or ask us to delete your demo details, email support@financialfitnesspassport.com.

Uploaded Documents

Pro features include the ability to upload financial documents — insurance declarations, estate documents, employee benefits guides, and investment account statements — for AI-powered analysis. When you upload a document:

• The document is temporarily stored in Firebase Storage solely for the purpose of processing
• The document content is transmitted to OpenAI for AI analysis
• The document is permanently and immediately deleted from our systems the moment analysis is complete. No copy is retained.
• The written analysis is returned to you. Where the document is an investment statement, the holdings we read from it — the securities, quantities and values described under "Account Sync" below — are saved to your account so that your Investing area can show them to you and so that you do not have to upload the same statement again. You can delete them, and deleting your account deletes them.

Payment Information

• Processed by Stripe: Credit card information is collected and processed by Stripe, Inc. We do not store full credit card numbers
• Subscription status, billing history, and payment method type
• Promotional codes used and discount applications
• If you begin a free trial, we record that a trial was started, when it ends, and whether it converted to a paid subscription

Usage Data & Analytics

We automatically collect:

• Device information (type, operating system, browser)
• IP address and approximate geographic location
• App interactions, page views, and feature usage
• Login count and session duration
• Only if you allow analytics: product-usage events (PostHog) and Google Analytics / Firebase Analytics data — see Section 11

Cookies & Tracking Technologies

We use cookies and similar technologies (including browser localStorage) for authentication, security and preferences, and — only with your consent — for analytics and advertising measurement. Section 11 lists them and explains how to change your choice.

3. How We Use Information

We use your data to:

• Operate and improve the App: Provide core features, calculate your Financial Fitness score, generate badge assessments, and track progress
• Provide AI-powered insights: Generate general financial education, coaching, roadmaps, and progress analysis based on the information you provide, using third-party AI engines. These are not personal recommendations.
• Process payments: Manage Pro subscriptions, apply promotional codes, and handle billing
• Communicate with you: Send account notifications, educational content, feature updates, security alerts, and customer support responses
• Analyze trends and enhance user experience: Understand how features are used, identify bugs, and develop improvements
• Provide benchmarking (opt-in): Aggregate anonymized data for community comparisons
• Comply with legal obligations: Respond to subpoenas, prevent fraud, enforce our Terms, and maintain audit logs
• Maintain security: Detect and prevent unauthorized access, abuse, and security threats

4. How We Share Information

Service Providers

We share data with trusted third-party service providers:

• Firebase (Google): Authentication, Firestore database, Firebase Storage, and Analytics
• Stripe: Payment processing and subscription management
• OpenAI: AI-powered features — GPT-4o-mini for Penny AI chat, Tax Planner, Roadmap, and Progress Interpreter; GPT-4o (vision model) for Document Analysis and Employee Benefits Analyzer, which processes uploaded document content
• PostHog: Product analytics. We use PostHog to understand how features are used, to identify errors, and to improve the App. In your browser, PostHog, including session replay, runs only with your analytics consent (Section 11): it receives an identifier for your account and records the actions you take in the App, such as the pages you open and the features you use. Our servers also send PostHog a limited set of events, identified by your account identifier, whether or not you allow analytics: account and purchase events (such as email verified, trial started, checkout started, completed or abandoned, and subscription cancelled), emails we sent you, and a few feature events (such as fund comparisons, cash-flow setup steps, and whether a question to Penny was about Social Security). These server events never include session replay. PostHog does not receive the financial figures you enter, your uploaded documents, or the text of your conversations with our AI features
• RevenueCat: Subscription management for purchases made inside our mobile app. RevenueCat receives an identifier for your account and the status of your subscription
• Vercel: Application hosting and deployment infrastructure
• Twilio: Phone-number verification for the optional "Have Penny call me" feature, and for a phone demo, the one-time code that confirms the number before Penny calls. If you add a phone number, Twilio receives that number and sends it a one-time code by text message. Twilio is used only if you choose to add a phone number or ask Penny to call you for the demo
• Retell AI: Voice calls with Penny, in your browser or by phone. Retell carries the call audio, converts your speech to text and Penny's answers to speech, and, for a phone call, receives the number being called. Retell is not told who you are and receives no other Passport data. Retell is used only if you choose to start a voice call — see "Voice Calls with Penny" above
• Cloudflare Turnstile: A security check on the voice demo sign-up form, to keep out automated sign-ups. Cloudflare receives your IP address and information about your browser. Turnstile is used only on the voice demo form — see "Voice Demo" above
• Plaid: Bank and financial account connectivity for the optional Account Sync feature — see "Account Sync" below. Plaid is used only if you choose to connect an account
• Google Analytics / Firebase Analytics (Google): Website and app usage analytics — only with your analytics consent
• Meta, TikTok and Reddit: Advertising measurement pixels, and for Meta a purchase report from our servers (Conversions API) — only with your marketing consent

These providers are contractually obligated to protect your data and use it only for the purposes we specify.

Account Sync (Bank Connections via Plaid)

In the product this is called the connected accounts feature, referred to in this policy as Account Sync.

Account Sync is optional. Connecting a bank or financial account is never required to create an account or to use any part of Financial Fitness Passport. If you never connect an account, nothing described in this subsection happens and no data is exchanged with Plaid.

If you choose to connect an account, we use Plaid Inc. ("Plaid") to establish and maintain that connection:

• Your credentials go to Plaid, not to us. Your bank username, password, and any multi-factor codes are entered inside Plaid's secure Link interface and are transmitted to your financial institution by Plaid. Financial Fitness Passport never receives, sees, or stores your bank login credentials.
• What we receive. Plaid returns an access credential that identifies the connection, together with information about the accounts you selected: the institution name, account names, types and mask (last digits), and — for the products you have authorized — transaction records (date, amount, currency, description, category, and pending status) and account balances.

  If you later give the separate authorization described below, we also receive, for the accounts you select:

  • For investment accounts: the individual holdings in the account, including each security's name and symbol where reported, its type, the quantity held, its price and market value, its cost basis where reported, and the resulting gain or loss.
  • For loan and credit accounts: the terms your provider reports for the account, including its annual percentage rates and the balances those rates apply to, interest charged, the minimum payment due, and the statement and payment due dates. This applies to credit, student loan, and mortgage accounts.

  We receive this information only for the accounts you choose, and only after you complete the additional authorization for that product.

• What we ask for. A new connection is authorized for transaction data only. Access to liability data and investment holdings is not requested at connection time; if those features are offered to you later, they require a separate, additional authorization from you.
• Purpose. We use this data solely to populate features you asked for — your Cash Flow, debt, and investment records inside your own account. We do not sell it, and we do not use it for advertising. If you use our AI-powered Pro features, transaction descriptions and merchant names from your connected accounts may be processed by our AI provider to generate insights and to answer your questions about your spending. See "Third-Party AI Processing" below.
• Storage and retention. The access credential for each connection is encrypted at rest. Synced records are retained under the same terms as the rest of your financial data (Section 6). You may disconnect an institution at any time. When you disconnect an institution yourself, we instruct Plaid to end the connection, we delete the stored access credential, and we delete the transactions we synced from it. When you delete your account, we delete all of it.
• If your plan ends. If a payment fails, Account Sync stops updating while we retry the payment, and nothing is removed. If your plan ends, your connected institutions stop updating. Everything already imported (transactions, accounts, balances and investment history) stays in your account, and you can still view it. No sooner than 30 days after your plan ends, we disconnect your institutions: we instruct Plaid to end the connections and we delete their access credentials. We email you at least a week before we do this, and again shortly before. Disconnecting does not delete what was already imported. If your plan becomes active again before then, your connections keep working with no need to link your bank again. Information you entered yourself is never affected. You can also disconnect an ended connection and delete what was imported from it.
• Plaid's own practices. Plaid is an independent company and handles your data under its own end-user privacy policy, available at plaid.com/legal. We do not control Plaid's data practices.

When an organization pays for your account

Your subscription may be paid for by an organization rather than by you — an employer, an advisory firm, or another partner organization.

An organization that funds your account can see that you hold one of the seats it pays for. For that purpose it can see your name, your email address, the date you claimed the seat, and whether the seat is currently active. It can release a seat, which ends the subscription that organization is paying for.

It cannot see anything else. An organization that pays for your account does not receive your Financial Fitness score, your account balances, your transactions, your goals, your uploaded documents, or your conversations with our AI features. It cannot see what you entered or what we found. Your data is yours, and ending the sponsorship does not give the organization access to it.

Organizations that do not fund seats — for example a partner whose audience buys subscriptions directly at a discount — receive no member list at all.

Third-Party AI Processing

Legal Requirements

We may disclose information when required by law or to:

• Comply with legal process (subpoenas, court orders)
• Protect rights, property, and safety
• Prevent fraud or security threats
• Enforce our Terms and Conditions

Business Transfers

During a merger, acquisition, sale, or reorganization of our business, your information may be transferred to the successor entity. We will notify you of any such change.

Aggregated & Anonymized Data

We may share de-identified or aggregated data that cannot reasonably identify you for research, marketing, or analytics purposes.

We Do Not Sell Your Data

We do not sell your personal information to third parties for monetary consideration.

If you allow marketing cookies, the Meta, TikTok and Reddit pixels receive information about your visit (and, for Meta, a purchase report) to measure our advertising. Some U.S. state laws treat this as “sharing” for cross-context behavioral advertising. It happens only with your consent, you can withdraw it at any time in Cookie preferences, and we treat a Global Privacy Control signal as an opt-out of it.

5. Use of Artificial Intelligence and Data Processing

Our App integrates third-party AI services (OpenAI GPT-4o-mini and GPT-4o) that process user data to generate insights, coaching, roadmaps, progress analysis, and document analysis. This includes the content of any financial documents you upload via the Document Analysis or Employee Benefits Analyzer features.

By using AI-powered features, you consent to your data being transmitted to and processed by external AI providers. You can avoid this by using only the free features of the App.

6. Data Retention

We retain personal and financial data as long as your account is active or as needed to:

• Provide Services and support
• Comply with legal obligations (tax records, financial regulations)
• Resolve disputes and enforce agreements
• Prevent fraud and abuse

Conversations with Penny. Your text chats with Penny and the transcripts of your voice calls with Penny are kept for 6 months from when they happen and are then deleted automatically. Deleting your account deletes them sooner, as described below.

Account Deletion

You may request deletion of your account and data at any time by:

• Using the "Delete Account" feature in your Profile settings, or
• Emailing support@financialfitnesspassport.com

When you delete your account, we delete the information in it. This includes what you entered, anything we received from a connected financial account, your uploaded analysis results, your scores and history, and your conversations with our AI features. Deletion is completed within 30 days.

We keep one record afterwards, for tax, accounting and dispute purposes: a billing record showing that a subscription existed, which provider processed it, which product it was for, the dates the subscription started and ended, and its final status. That record is stored under an identifier derived from your account through a one-way function; it does not contain your name, your email address, your account identifier, your payment method, or any financial information from your account.

7. Security

We use reasonable technical and organizational measures to protect your data, including:

• Firebase Authentication with bcrypt password hashing
• Encrypted data transmission (HTTPS/TLS)
• Firestore Security Rules to restrict unauthorized access
• Firebase Storage Security Rules for file protection
• Server-side authentication verification via Firebase Admin SDK
• Email verification enforcement before accessing protected features
• Rate limiting on AI API endpoints
• Technical measures to limit demo usage and prevent abuse (these measures do not involve collecting personal financial or account information)
• Comprehensive security headers (CSP, HSTS, X-Frame-Options)
• Regular security audits and dependency updates
• Archival logging with SHA-256 hashing for audit trails

8. Your Rights

Depending on your jurisdiction (GDPR, CCPA, or other applicable laws), you may have rights to:

Access & Portability

• Access and download your personal data
• Request a copy of your data in a portable format (JSON export available in Profile)

Correction & Deletion

• Correct inaccurate information
• Request deletion of your account and data

Consent & Opt-Out

• Withdraw consent to data processing
• Opt out of marketing communications
• Opt out of community benchmarking (Profile settings)
• Choose or change analytics and marketing cookies at any time (“Cookie preferences” in the footer, or Profile settings) — see Section 11
• Do Not Sell My Personal Information (CCPA) - We do not sell data

Complaints

File a complaint with a data protection authority in your jurisdiction

To exercise your rights, email us at support@financialfitnesspassport.com. We will respond within 30 days.

9. Children's Privacy

Our App is intended for adults (18+). We do not knowingly collect information from minors under 18.

If we become aware that a child has provided information, we will delete it promptly. If you believe we have collected data from a minor, please contact us immediately.

10. International Users & Data Transfers

Our App is operated in the United States. If you access it from outside the U.S., your information will be transferred to, stored, and processed in the United States.

By using the App, you consent to the transfer and processing of your data in the U.S., which may have different data protection laws than your country. We use Firebase and other services with global infrastructure that may process data in multiple jurisdictions.

GDPR (European Users)

If you are in the European Economic Area (EEA), you have additional rights under GDPR, including data portability, erasure, and the right to lodge complaints with supervisory authorities.

CCPA (California Users)

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, request deletion, and opt out of data sales (we do not sell data).

11. Cookies & Tracking Technologies

We use cookies and similar technologies, including browser localStorage and sessionStorage. On the website, nothing optional runs until you make a choice in the cookie banner; until then, and if you choose “Reject non-essential”, only the necessary and functional items below are used.

Necessary (always on)

• Your sign-in session (Firebase Authentication, stored in your browser's IndexedDB)
• Security and app state: the email address for an email sign-in link, advisor view-as sessions, pending invitation codes, and Penny chat history for the current browser session
• Your cookie choice itself (ffp_consent_v1 in localStorage — not a cookie, never sent to us or anyone else)

Functional

• Preferences such as dismissed tips and prompts, onboarding progress, and cached prices (localStorage)
• Referral attribution: when you open a referral link, a first-party cookie (ffp_ref, 30 days) remembers the code so the referrer can be credited when you sign up. It is not shared with advertising networks.

Analytics (only with your consent)

• PostHog (cookie and localStorage ph_*): page views, automatically captured clicks and interactions, and — where enabled — session replay, with all text and form inputs masked. When you are signed in, events are linked to your account ID, email address and name.
• Google Analytics 4 / Firebase Analytics (cookies such as _ga): usage analytics. Google Consent Mode is set to “denied” by default and the Google tag is not loaded until you allow analytics.

Marketing (only with your consent)

• Meta Pixel (cookies such as _fbp, _fbc), TikTok Pixel and Reddit Pixel: measure visits and conversions from our ads
• Meta Conversions API: when you buy a paid plan, our servers may send Meta your email address in hashed form and the Meta click identifiers above — only if marketing consent was in force when you started checkout.

Abuse prevention (Penny demo)

The public Penny demo page computes a device fingerprint from browser characteristics (such as browser version, language, screen size, time zone and how your device renders a small test image) to limit free demo usage. It is stored with a usage count and is not used for analytics or advertising.

Your choices

• Open Cookie preferences (also in the site footer and your Profile) to accept or reject analytics and marketing at any time. The choice is stored on this device.
• Withdrawing analytics consent stops PostHog and Google Analytics at once and deletes their cookies on our domain. Withdrawing marketing consent deletes the pixels' cookies on our domain and reloads the page without them. Data already sent to a provider is handled under that provider's own policies.
• If your browser sends a Global Privacy Control signal, marketing stays off and the advertising pixels are not loaded.
• If you turn analytics off in Profile settings while signed in, it stays off on this device and on other devices where you sign in — the cookie banner cannot turn it back on; only the Profile setting can.
• In the mobile app, the advertising pixels and the Google Analytics website tag are never loaded; product analytics can be turned off in Profile settings.
• Separately from cookies, our servers record some account and billing events (for example, subscription changes), including in our product-analytics tool. These are not stored in your browser and are not controlled by cookie preferences.

12. Email Communications

We may send you:

• Transactional emails: Account verification, password resets, billing notifications (cannot opt out)
• Service updates: Feature announcements, security alerts, Terms changes
• Educational content: Financial wellness tips, academy lessons (opt-out available)
• Marketing communications: Promotions, product news (opt-out available)

You can manage email preferences in your Profile settings or click "unsubscribe" in any marketing email.

13. Community Benchmarking (Opt-In)

Pro users may opt in to share anonymized data for community benchmarking. When you opt in:

• Your passport score and debt metrics are aggregated with other users' data
• All data is fully anonymized before aggregation (no names, emails, or identifiers)
• You can view community averages and compare your progress
• You can opt out at any time from Profile settings

14. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you and relevant authorities as required by applicable law. Notification will be sent to your registered email address without undue delay.

15. California Privacy Rights (Shine the Light)

California residents may request information about disclosures of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing.

16. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last Updated" date above and keep the date of the previous version beside it. If a change materially affects how we handle your information, we will tell you by email or in the App before it takes effect.

Material changes will be announced via email or in-app notification. Your continued use of the App after changes constitutes acceptance of the updated Privacy Policy.

17. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or your data, contact: