Privacy Policy

Effective date: November 13, 2026

Tiny Banker is a personal finance service. It is run by [COMPANY LEGAL NAME], a [STATE OF FORMATION] company ("Tiny Banker," "we," "us," or "our"). This policy explains what information we collect, how we use and share it, how long we keep it, and the choices you have. It applies to our website at tinybanker.com, our mobile and web apps, and any other service that links to this policy (together, the "Service").

Tiny Banker is not a bank. We do not hold your money, and we cannot move it.

The short version

• You choose which financial accounts to connect. Tiny Banker reads them. It does not move money, make payments, or change anything in your accounts.
• We use your information to run Tiny Banker for you. We do not sell it. We do not share it for advertising. We do not use it to make credit, insurance, employment, or housing decisions about you, and we do not provide consumer reports.
• We use Plaid Inc. ("Plaid") to connect your accounts. We never see or store your bank username or password.
• You can disconnect an account, correct or export your information, or delete your account at any time. See "Your choices and rights" below.
• Questions? Write to privacy@tinybanker.com.

Information we collect

Information you give us

• Account and contact details. Your name, email address, phone number, the credentials you use to sign in to Tiny Banker, and the settings you choose.
• Messages to us. What you send when you email support or give feedback, including attachments.
• Launch list. If you ask us to tell you when Tiny Banker launches, your email address.
• Content you choose to connect or upload. Documents, files, messages, or other content that you choose to connect or upload to the Service, and the questions and instructions you give it.

Information from your connected financial accounts

When you connect an account, you decide what to share on the connection screen. Depending on the account and what you approve, we receive:

• Account details: the name of your financial institution, the account name and type, a masked account number, and the account holder's name.
• Account and routing numbers. We use these only to identify which of your accounts a payment came from or went to. We do not use them to move money.
• Balances.
• Transactions: date, amount, merchant or payee, description, category, and status.
• Investments: holdings, securities, and investment transactions.
• Loans and credit: balances, interest rates, due dates, minimum payments, and payment history for credit cards, mortgages, and student loans.
• Identity details that your financial institution has on file: name, address, email address, and phone number.
• Income and employment details: employer name, pay dates, pay amounts, and related payroll information.
• Account statements that your financial institution makes available.

We ask only for the categories you approve and that the features you use need.

Information we collect automatically

When you use the Service, we collect your device and browser type, operating system, app version, IP address, the pages or screens you view, the dates and times of your visits, crash and error logs, and security signals such as sign-in attempts.

Information from others

We receive information from Plaid and your financial institutions, as described above. If you choose to sign in with another account, such as Apple or Google, we receive the name and email address that account shares. Our security providers may give us signals that help us spot fraud and abuse. We do not buy personal information from data brokers.

How we use information

We use information to:

• Provide the Service. Connect your accounts, show your information in one place, and respond to your requests and questions.
• Keep the Service secure. Verify your identity, prevent fraud and abuse, find and fix errors, and protect the Service and the people who use it.
• Support you. Answer your messages and resolve problems.
• Improve the Service. Understand how features perform and fix what does not work, using usage and performance data.
• Communicate with you. Send service messages, such as security alerts, receipts, and changes to our terms. We send product news or launch notices only if you ask for them. Every such email has an unsubscribe link.
• Meet legal duties. Comply with the law, respond to legal requests, and enforce our Terms of Service.

We use sensitive information, such as your financial account data, only to provide the Service you asked for and as the law allows. We do not use your information for advertising. We do not use it to decide whether to give you or anyone else credit, insurance, a job, or housing, and we do not provide it to consumer reporting agencies. We will not use your information for a purpose that is materially different from the purposes above without telling you first and, where the law requires, asking for your consent.

AI features and third-party AI providers

Some features use artificial intelligence to organize, summarize, or answer questions about your information. When you use one of these features, we send the information needed for that request, such as the transactions or documents you ask about, to an AI model provider that processes it for us. We ask for your permission in the app before we send your personal information to a third-party AI provider.

Our AI providers may use the information only to provide their service to us and to keep it secure. Our contracts do not allow them to use your information to train or improve their models, and we do not use your information to train models that we offer to others. We do not use AI to make decisions that have legal or similarly significant effects on you. AI responses can be wrong. Please check anything important against your own records.

How we share information

We share your information only in these ways:

• With Plaid and your financial institutions, at your direction. See "Plaid" below.
• With service providers that work for us. These include cloud hosting and storage providers, AI model providers, security and fraud-prevention providers, email and messaging providers, customer-support tools, error-monitoring tools, and professional advisers such as lawyers, accountants, and insurers. They may use the information only to provide services to us, and they must protect it.
• To obey the law or protect people. We may share information to respond to a subpoena, court order, or other lawful request; to enforce our terms; to detect, prevent, or address fraud, security, or technical problems; and to protect the rights, property, or safety of you, us, or others.
• In a business transfer. If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred. We will tell you first. The new owner must honor this policy for information already collected, or ask for your consent before using it in a materially different way.
• With your consent. For example, when you ask us to export your information to another service.

We do not sell your personal information. We do not share it for cross-context behavioral advertising. We do not give it to data brokers or advertisers.

Plaid

We use Plaid to connect your financial accounts to Tiny Banker. When you connect an account, Plaid collects your login information (or a security token from your financial institution) and your account data, and sends the data you approve to us. Plaid's use of your information is described in Plaid's End User Privacy Policy at https://plaid.com/legal/#end-user-privacy-policy. Plaid is responsible for its own practices, and this policy does not cover them. Plaid may keep information as its policy describes, even after you disconnect an account from Tiny Banker.

By connecting an account, you authorize us and Plaid to access and retrieve your account data as described in this policy and in our Terms of Service. You can see and manage the apps connected to your accounts at https://my.plaid.com. You can also disconnect any account inside Tiny Banker.

De-identified information

We do not use data from your connected financial accounts, including in aggregated or de-identified form, for any purpose other than operating, securing, and improving Tiny Banker as a personal finance service. We do not sell or license that data. We do not try to re-identify it.

Cookies, tracking, and Do Not Track

Our website uses only the cookies and similar technologies it needs to work and stay secure. We do not use advertising cookies. We do not allow advertising networks or other third parties to collect information about your activity on our Service, over time or across other websites, for their own purposes.

Our hosting provider, Vercel Inc., processes standard server logs for us, such as your IP address, browser type, and the pages you request, so that it can deliver and protect the site.

Because we do not track you across other websites or services, we do not change how we work in response to "Do Not Track" or Global Privacy Control signals.

How long we keep information, and how to delete it

• While your account is open, we keep your information so that we can provide the Service.
• When you disconnect an account, we stop collecting new data from it and delete the data we collected from it within 30 days.
• When you close your account, we delete your personal information within 30 days, and we remove it from our backups within 90 days.
• Limited records may stay longer when we need them to comply with the law, resolve a dispute, enforce our terms, or prevent fraud. Examples are records of your consent and requests, security logs, and records we must keep for tax and accounting.
• In every case, we dispose of customer information no later than two years after we last use it to provide a service to you, unless the law requires us to keep it longer.

To delete your account and your information, use the delete option in the app when it is available, or email privacy@tinybanker.com from the email address on your account. We will confirm by email when the deletion is done. You can withdraw your consent to connect an account at any time. Disconnect it in the app, at https://my.plaid.com, or with your financial institution.

Security

We use administrative, technical, and physical safeguards designed to protect your information. These include encryption of your information in transit and at rest, multi-factor authentication for our systems, access limited to people who need it, logging and monitoring, and an incident response plan. We never see or store your bank username or password. Your financial institution and Plaid handle those.

No system is perfectly secure. If a security incident affects your information, we will tell you and the authorities as the law requires. If you think your Tiny Banker account is at risk, email support@tinybanker.com right away.

Your choices and rights

You can do the following at any time. We give these rights to all U.S. users, wherever you live:

• Access. Ask for a copy of the personal information we hold about you.
• Correct. Ask us to fix information that is wrong.
• Delete. Ask us to delete your information. See "How long we keep information, and how to delete it."
• Export. Ask for your information in a common, portable format.
• Disconnect. Remove any connected account from Tiny Banker.
• Opt out of emails. Use the unsubscribe link in any marketing email.
• No retaliation. We will not deny you the Service, or charge you a different price, because you use these rights.

We do not sell your personal information or share it for advertising, so there is nothing to opt out of. If that ever changes, we will tell you and ask first.

How to make a request. Email privacy@tinybanker.com from the email address on your account, or use the settings in the app when they are available. We may ask you to confirm your identity so that we do not give your information to the wrong person. You may use an authorized agent if you give them written permission and confirm your identity with us. We answer within 45 days. If we need more time, we will tell you why and take up to 45 more days.

Appeals. If we deny your request, you can appeal by replying to our message with the word "Appeal." We answer within 60 days. If you are still not satisfied, you may contact your state attorney general.

Depending on where you live, state law may give you more rights. We apply the rights above to every U.S. user.

U.S. financial privacy notice

Federal and state financial privacy laws apply to information about your financial accounts. This section is our notice under those laws.

• What we collect. We collect information from you, and information about your accounts and transactions with other financial institutions, which Plaid gives us with your permission. We do not collect information from consumer reporting agencies.
• What we disclose and to whom. We disclose your information to service providers that help us run Tiny Banker, to Plaid and your financial institutions at your direction, and as the law permits or requires. We disclose information about former users in the same way.
• What we do not do. We do not disclose your nonpublic personal information to nonaffiliated companies so that they can market to you. We do not share your information with affiliates for marketing. Tiny Banker has no affiliates that receive your information today.
• Your right to opt out. Because we make no such disclosures, there is nothing for you to opt out of. If that changes, we will give you notice and the right to opt out before we make any disclosure. Where state law requires your consent, we will ask for it first.
• How we protect your information. See "Security."

Children

Tiny Banker is for adults who are at least 18 years old. We do not knowingly collect personal information from anyone under 18. If you think a child has given us information, email privacy@tinybanker.com and we will delete it.

Where we operate

The Service is for people in the United States. We store and process information in the United States.

Changes to this policy

We will post any updated policy at https://tinybanker.com/privacy with a new effective date. For a material change, we will email you or show a notice in the Service at least 30 days before the change takes effect, unless the law or a security issue requires us to act sooner. If a change would let us use information we already hold in a materially different way, we will ask for your consent first.

Contact us

[COMPANY LEGAL NAME]

[COMPANY MAILING ADDRESS]

• Privacy requests: privacy@tinybanker.com
• Everything else: support@tinybanker.com