Privacy Policy

Last updated: September 7, 2026

1. Overview

Threshold Money LLC (“Threshold,” “we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and safeguard your information when you use our website and mobile application (“the App”). We believe you should understand exactly what happens with your data, so we've written this policy in plain language.

By visiting our website, creating an account, or using the App, you acknowledge the practices described in this policy. Where we rely on your consent, such as for optional product and content emails, you may withdraw it at any time.

2. Information We Collect

We collect the following categories of information:

Account Information

• Email address
• Name (optional)
• Password (hashed — we never store your password in plain text)

Website Updates Information

• Name and email address when you choose to stay in the loop
• Your consent and subscription status for Threshold product updates and occasional personal finance content

Financial Data

• Bank account names, types, and balances retrieved through Plaid
• Transaction history (amounts, dates, merchant names, categories)
• Institution names and logos
• Investment holdings and related details, such as quantities, cost basis, and gains, when available from your connected institution
• Loan and credit account details, such as interest rates, payment amounts, and due dates, when available
• Information you enter or create in Threshold, including manual accounts, balances, goals, budgets, groups, calculations, labels, and canvas layouts

We never receive or store your bank login credentials. Plaid handles all bank authentication directly.

Subscription, Support, and Customer Relationship Information

• Subscription and purchase identifiers, trial or offer status, renewal information, and access to paid features provided through Apple and RevenueCat
• Messages you send to support or through in-app feedback, along with relevant screen and device information
• Email delivery records and opt-out preferences
• Contact status and communication preferences used to manage customer relationships

Usage Data

• Device type and model
• Operating system and version
• App version
• Pseudonymous account identifiers and app session events used to diagnose errors and monitor reliability
• Security and access records, including IP addresses and authorization events when you connect or revoke an external AI tool
• An Expo push notification token assigned to this App installation when you allow notifications. We link the token to your Threshold account so notifications reach the correct signed-in user.
• Crash logs and error reports (collected via Sentry)
• CAPTCHA verification tokens (processed via Cloudflare Turnstile during authentication and website updates signup)

3. How We Use Your Information

We use your information to:

• Authenticate your identity and secure your account
• Display your financial accounts, balances, and transactions
• Provide personal finance organization tools (canvas, goals, groups, calculations)
• Send transactional emails (password resets, account notifications)
• Send notifications about the app and your account that you choose to allow. Push notification content does not include balances, transactions, account names, or other financial data.
• Send product updates and occasional personal finance content when you explicitly opt in through the website
• Diagnose and fix bugs using crash reports
• Respond to support requests and feedback
• Manage customer relationships, follow-up, and communication preferences
• Manage subscription access, secure connected integrations, and prevent duplicate messages or unwanted email
• Improve and maintain the App

We do not sell your personal information. We do not use your data for advertising. We do not share your financial data with third parties for their own marketing purposes.

4. Third-Party Services

We use a limited number of third-party services to operate our website and the App. Each serves a specific purpose, and none of them receive more data than necessary.

Plaid — Connects to your bank. Plaid acts as a secure bridge between Threshold and your financial institution. It retrieves your account information and transactions on your behalf. Your bank login credentials go directly to Plaid and are never shared with us. Plaid's privacy policy is available at plaid.com/legal.

Supabase — Stores your data. Supabase provides our database and backend infrastructure. Your account information, financial data, and app settings are stored on Supabase's encrypted cloud servers. Supabase's privacy policy is available at supabase.com/privacy.

Sentry — Catches bugs. Sentry collects crash logs, error reports, and session events so we can identify and fix problems. Diagnostic data may include a pseudonymous account identifier, device type, OS version, app version, and technical details of the error. We configure diagnostic reporting to exclude financial account details and scrub sensitive information. Sentry's privacy policy is available at sentry.io/privacy.

Cloudflare Turnstile — Prevents bots. During authentication and website updates signup, Cloudflare Turnstile verifies that you are a real person using a non-intrusive CAPTCHA. Cloudflare's privacy policy is available at cloudflare.com/privacypolicy, and Cloudflare's collection and use of data in connection with Turnstile is governed by the Cloudflare Turnstile Privacy Addendum, available at cloudflare.com/turnstile-privacy-policy.

Resend — Sends emails and manages email preferences. We use Resend to process your name, email address, subscription status, and email delivery activity for transactional messages and, when you opt in, occasional Threshold product updates and personal finance content. Resend remains the authority for those email subscription and delivery preferences. Resend's privacy policy is available at resend.com/legal/privacy-policy.

HubSpot — Helps us manage customer relationships. We use HubSpot to organize contact details, such as names and email addresses, for customer relationship management and follow-up. For Threshold Updates, HubSpot stores synchronized reporting fields while Resend remains the preference authority. This synchronization does not change HubSpot's native marketing status or communication preferences. Marketing emails remain subject to the consent and opt-out choices described in this policy. HubSpot's privacy policy is available at legal.hubspot.com/privacy-policy.

RevenueCat — Manages subscriptions. We use RevenueCat to process subscription purchases and entitlements. We send it a pseudonymous user identifier and it returns your subscription and purchase status. RevenueCat does not receive your financial account data. RevenueCat's privacy policy is available at revenuecat.com/privacy.

Expo Push Service — Routes push notifications. When you allow notifications, Expo processes the App installation's push token and the limited notification content needed to deliver the message through Apple Push Notification service. Expo does not receive your financial account data in notification payloads. Expo's privacy policy is available at expo.dev/privacy.

5. Connecting Your Own AI Tools (Model Context Protocol)

Threshold supports the Model Context Protocol (MCP), an open standard that lets you connect your own AI assistant — such as Claude or ChatGPT — to your Threshold data. This connection is off by default and only happens if you choose to set it up.

When you connect an AI tool through MCP, the authorization screen shows the permissions you are granting. Depending on those permissions, the tool can read your Threshold information and create, modify, or delete supported items within Threshold, such as goals, groups, calculations, canvas elements, and manual accounts, at your direction. This does not give it the ability to move money or transact at your bank. Review the permissions and any changes you ask a tool to make. Threshold does not send your data to any AI provider on its own — this happens only at your request, through a connection you create and control.

The connected provider handles information it receives under its own terms and privacy policy. This policy continues to govern how Threshold handles and shares your information.

You can disconnect Threshold in the connected tool's settings. To request revocation of a connection directly with Threshold, contact privacy@thresholdmoney.app. Revoking a connection prevents future access through that authorization; it does not delete information already received by the provider. Deleting your Threshold account removes its connected-tool authorizations as well.

6. Data Security

We implement industry-standard security measures to protect your data:

• All data is encrypted in transit using HTTPS/TLS
• Plaid access tokens are encrypted at rest using AES-256-GCM
• Your bank login credentials are never stored on our servers — Plaid handles all bank authentication
• Passwords are hashed and salted before storage
• Our backend infrastructure uses row-level security policies to isolate user data

While we take reasonable measures to protect your data, we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at support@thresholdmoney.app.

7. Data Retention

Account deletion removes your active account and financial records. Some records are managed separately, as described below:

• Account data (email, settings, canvas layout): Retained while your account is active. When you delete your account, its active records are permanently deleted and cannot be recovered
• Financial data (accounts, balances, transactions): Retained while your account is active. Its active records are permanently deleted when you delete your account
• Crash logs, error reports, and security records: Managed separately from your account to diagnose errors, investigate security issues, and monitor reliability. Diagnostic reports are subject to our provider's configured retention period
• Push notification token: Retained while that App installation is registered to your account. It is removed when the installation is successfully unregistered or when you delete your account.
• Website updates information (name, email, consent, and subscription status): Retained until you unsubscribe or ask us to delete it, subject to limited records we may keep to honor your opt-out and legal obligations
• Customer-relationship records: Contact details and synchronized Threshold Updates reporting fields held in HubSpot are managed separately from your app account. Resend remains the authority for Threshold Updates preferences. You may request access, correction, or deletion of these records using the contact details below. Limited opt-out records may be retained to honor your preferences and legal obligations
• Support and feedback: Support correspondence and feedback messages may remain after your account is deleted to handle support requests and investigate reported problems. The in-app feedback record is unlinked from the deleted account, but its message content is not automatically erased. You may request deletion of personal information in these records by contacting us
• Subscription and email-delivery records: Some purchase identifiers and delivery records remain separately from your account to reconcile subscription events and prevent duplicate emails. We also retain opt-out records to honor your email preferences

Deleting your account cannot be undone. Records retained separately are not an account-recovery mechanism. Residual copies in infrastructure backups remain until the normal backup rotation overwrites them.

We request removal or revocation of the account's connections and records with relevant service providers. Provider processing may take additional time, and their own retention obligations may apply. Apple retains and manages App Store purchase records separately. Deleting your Threshold account does not cancel an App Store subscription.

You can ask us about retained personal information or request its deletion at privacy@thresholdmoney.app. Any retention required by applicable law continues to apply.

8. What Happens When You Disconnect a Bank

When you disconnect a bank account from Threshold:

• We revoke the Plaid access token for that institution, stopping all future data retrieval
• We permanently delete that institution's accounts and synced transaction history from Threshold. If cleanup needs to be retried, removal may take additional time after the bank connection has been revoked. Disconnecting is not reversible — to see the synced data again you would need to reconnect the bank and re-sync
• Historical calculation results derived from that bank's data may remain in your Threshold account. Disconnecting a bank does not delete your Threshold account or its calculation history
• To delete your Threshold account and its active financial records, use the account-deletion option in the app, or contact us at privacy@thresholdmoney.app. Section 7 explains records retained separately and backup handling

9. Your Privacy Rights

Depending on where you live, you may have specific rights regarding your personal information. We honor these rights regardless of whether we are technically required to under each law, because we believe they reflect good practice.

All Users

Everyone can:

• Access their personal data
• Request correction of inaccurate data
• Request deletion of their account and data
• Disconnect financial accounts at any time
• Withdraw consent for optional emails at any time using the unsubscribe link in any marketing message or by contacting us

To exercise these rights, email privacy@thresholdmoney.app. We will respond within 30 days.

California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act and California Privacy Rights Act, you have the right to:

• Know what personal information we collect, use, and disclose
• Delete your personal information
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information — we do not sell personal information or share it for cross-context behavioral advertising
• Non-discrimination — we will not treat you differently for exercising your privacy rights
• Limit use of sensitive personal information — we only use sensitive personal information (financial data) to provide the service you requested

We do not sell personal information as defined by the CCPA/CPRA. We do not use personal information for cross-context behavioral advertising.

Virginia Residents (VCDPA)

Under the Virginia Consumer Data Protection Act, you have the right to: confirm whether we are processing your personal data and access that data; correct inaccuracies; delete your personal data; obtain a portable copy; and opt out of targeted advertising, sale, or profiling used to make decisions with legal or similarly significant effects — we do not engage in any of these activities.

If we deny your request, you may appeal by emailing privacy@thresholdmoney.app with the subject line “VCDPA Appeal.”

Colorado Residents (CPA)

Under the Colorado Privacy Act, you have the right to: confirm whether we process your personal data and access it; correct inaccuracies; delete your data; obtain a portable copy; and opt out of targeted advertising, sale, or profiling used to make decisions with legal or similarly significant effects — we do not engage in any of these activities.

If we deny your request, you may appeal by emailing privacy@thresholdmoney.app with the subject line “CPA Appeal.”

Connecticut Residents (CTDPA)

Under the Connecticut Data Privacy Act, you have the right to: confirm whether we process your personal data and access it; correct inaccuracies; delete your data; obtain a portable copy; and opt out of targeted advertising, sale, or profiling used to make decisions with legal or similarly significant effects — we do not engage in any of these activities.

If we deny your request, you may appeal by emailing privacy@thresholdmoney.app with the subject line “CTDPA Appeal.”

Texas Residents (TDPSA)

Under the Texas Data Privacy and Security Act, you have the right to: confirm whether we process your personal data and access it; correct inaccuracies; delete your data; obtain a portable copy; and opt out of targeted advertising, sale, or profiling used to make decisions with legal or similarly significant effects — we do not engage in any of these activities.

If we deny your request, you may appeal by emailing privacy@thresholdmoney.app with the subject line “TDPSA Appeal.”

10. Global Privacy Control

We recognize and honor the Global Privacy Control (GPC) signal. If your browser or device sends a GPC signal, we will treat it as a valid opt-out request for the sale of personal information or its sharing for cross-context behavioral advertising. We do neither, so the signal does not change our current processing. Disclosures to the service providers and connected tools described above are distinct from advertising sharing.

11. Browser Storage and Advertising

Our website uses local browser storage to remember preferences such as your light or dark theme. We do not use third-party advertising trackers, build profiles for advertising, or engage in cross-app or cross-site advertising tracking. We do not share your data with data brokers or advertising networks. The information described in Section 2 is used for the purposes described in this policy.

12. What Threshold Is

Threshold is a personal-finance software tool. It helps you view and organize financial information retrieved from your financial institutions through Plaid on a read-only basis — Threshold cannot move money, initiate transactions, or take any action on your bank accounts.

13. Not Financial Advice

Threshold is an informational tool that helps you organize and visualize your financial data. Nothing in the App — including responses from AI tools you connect, calculations, goal projections, or any other feature — constitutes financial, investment, tax, or legal advice. We provide math, not recommendations. Any decisions you make based on information in Threshold are your sole responsibility. If you need financial advice, consult a licensed professional.

14. Children's Privacy

Threshold is not intended for anyone under 18 years of age. We do not knowingly collect personal information from children under 18. If we learn that we have collected information from a child under 18, we will delete that information promptly. If you believe a child has provided us with personal information, please contact us at privacy@thresholdmoney.app.

15. Data Breach Notification

If a data breach affects your personal information, we will investigate and take steps to address it. We will notify affected individuals and relevant authorities where required by applicable law, within the required timeframes and with the required information.

16. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the updated policy on this page, updating the “Last updated” date, and sending a notification via email or in the App. The notice will explain when the changes take effect. If a change requires your consent under applicable law, we will request that consent before applying it; continued use alone is not consent to a new use that requires your permission.

17. Contact Us

If you have questions about this Privacy Policy or want to exercise your privacy rights, contact us at:

Email: privacy@thresholdmoney.app

General support: support@thresholdmoney.app