Privacy notice

Who this is from, and what the Alpha is

Evenstep is a private Alpha run by [OPERATOR NAME AND ADDRESS: to be completed once the business entity is formed]. It is offered by invitation, to test an early version.

This Alpha uses synthetic data only. The bank connection is Plaid's Sandbox, which provides made-up banks, accounts and transactions, and manual accounts, manual transactions and CSV import are switched off. Please do not enter real financial information anywhere (see the Alpha Terms). We cannot tell real values from invented ones in the free-text and number fields you fill in yourself, such as plan, goal, bill and income names, so please use invented ones.

What we collect

• Your account: your name, your email address and a securely hashed password (we never store the password itself). If you turn on two-step verification, its secret and backup codes are stored encrypted.
• Your invitation: the email address it was sent to, a one-way fingerprint of its link (never the link itself), whether the email was accepted by our email provider, and when it was used, expired or revoked.
• Sign-in records: while you are signed in, a session record with the time, your network (IP) address and your browser type. It ends when you sign out, after 24 hours of inactivity, when you reset your password or when you delete your account.
• A security log of actions on your account, such as signing in, connecting or disconnecting a test bank, downloading your data and deleting it. It records what happened and when, not the contents of your data.
• Test bank information from Plaid Sandbox for the accounts you choose to include: account names, the last 4 characters of an account number, balances and transactions. These are made-up. We do not request real account or routing numbers.
• What you enter: budgets, goals, bills, income and notes, and any sample data you load (which is invented and labelled as sample data).
• Problem reports you send us: the category you choose, your message, and an email address only if you give one for a reply. If you were signed in, the report is linked to your account.
• Short-lived counters of requests per network address and per account, used to limit abuse.
• Technical logs: our hosting provider keeps the usual request records (typically the time, the page requested, the result and the network address). Our own logs hold event names and codes, and we do not put request contents, passwords, tokens or financial figures in them.

What we use it for

• To run the Alpha: signing you in, showing your planning screens, and syncing the test bank you connect.
• To keep it secure and to limit abuse.
• To send you the email you need: your invitation and password-reset messages. We send nothing else, and no marketing.
• To read and answer the problems you report, and to improve the product.
• We do not sell your information, show advertising, or use session-recording or advertising trackers.

Who else handles it

• Plaid provides the test bank connection. In this Alpha it only ever handles Sandbox test data. Plaid has its own privacy statement.
• Resend, our email provider, delivers our emails. It sees your email address and the message, including the link in it, and keeps its own copy for 30 days.
• A hosting and database provider [to be named when chosen] stores the application and its database, including backups.
• An error-monitoring service [if switched on: Raygun] may receive the type of an error, the name of the page's route and a release label. It does not receive request contents, headers, cookies, tokens, email addresses or financial figures.
• We may disclose information if the law requires it. [COUNSEL: confirm the wording, and whether the business is a covered financial institution for any purpose.]

Cookies

• A sign-in cookie that keeps you signed in. It is essential, secure and not readable by scripts.
• A colour-theme cookie that remembers light or dark for one year. It holds only that choice.
• We remember how you like the Spending page laid out (Both, Breakdown or Transactions) in a small cookie that ends when you close your browser. It contains only that choice, never your data.
• No advertising or analytics cookies. When you connect a test bank, Plaid's connection window loads from Plaid and may set its own cookies.

How long we keep it

• Your account information and the data you entered: until you delete them. You can delete your financial data, or your whole account, in Settings.
• Sign-in records: as described above. The security log: [OPEN: we intend to keep it for up to 12 months; the automatic deletion is not built yet.]
• Finished invitations (used, expired or revoked): deleted 90 days after they finish, or when you delete your account.
• Problem reports: deleted 90 days after you send them, or when you delete your account if you sent them while signed in. [COUNSEL: a report sent while signed out can only be matched to a person by the reply address they gave.]
• Test bank connection details: removed when you disconnect, once Plaid confirms the removal.
• Request counters: they expire within minutes to hours. [OPEN: automatic clean-up of expired counters is not built yet.]
• Backups: our database provider keeps backups for its recovery window, and deleted data leaves the backups when they expire. [OPEN: the window will be stated here once the provider is chosen; we aim for 35 days or less.]
• Our email provider keeps copies of messages for 30 days.

Your choices

• Download your data from Settings, as a JSON file or a CSV of transactions. It includes your reports and excludes secrets such as bank connection tokens.
• Delete your financial data, or your whole account, from Settings. Deleting your account removes your profile, your data and your invitation, and ends your sessions; the security log keeps only anonymised entries.
• Disconnect a test bank at any time. We ask Plaid to remove the connection and then delete our encrypted copy of its credential.
• Ask a question or report a problem on the Report a problem page. [COUNSEL: how a person exercises any privacy rights that apply to them, and who may decide whether those rights apply; this depends on the law that actually covers the user and the business, and is not assumed here.]

How we protect it

• Connections are encrypted in transit. Bank connection credentials are encrypted at rest and never sent to your browser.
• Every record belongs to your login and is checked on the server on every request.
• Connecting a test bank requires two-step verification and a recent sign-in. You can turn on two-step verification in Settings.
• The Alpha has not yet had an independent security review, and no system is perfectly secure.

Your agreement

When you create an account you confirm that you have read this notice and the Alpha Terms. Before you connect a test bank, you are asked to agree to a short statement about what that connection shares. [OPEN: the wording is not yet versioned; it will be recorded with a version before any real bank is connected.]

Children

[COUNSEL: the Alpha is intended for adults. Confirm the age statement and any rule that applies.]

What Evenstep is not

Evenstep is read-only: it cannot move money or make payments. Its figures are estimates based on the information in it and are not financial, tax, legal or investment advice.

Changes and contact

If we change this notice in a way that matters, we will tell you in the product. To ask a question or report a problem, use the Report a problem page. [OWNER AND COUNSEL: a monitored contact address, once one exists.]