Privacy policy
Last updated August 19, 2026
netboi ("we", "us") is a net-worth tracking service at netboi.app. This policy describes what data we collect, how it is used and shared, how long it is kept, and how to delete it.
What we collect
- Account. When you sign in with Google we store your email address and when the account was created. We never receive or store a password.
- Financial data. Account names, types, institutions, balances, and the historical balance snapshots that make up your net-worth chart. This comes from the connections you set up: Plaid, a SimpleFIN token you bring, or accounts you enter manually.
- Connection tokens. Access tokens for your bank connections, stored encrypted (AES-256-GCM) at rest. We never see or store your bank username or password — credentials go directly to Plaid or your SimpleFIN provider.
- Billing. If you subscribe, Stripe processes your payment. We store only your plan, its status, and Stripe's customer and subscription identifiers — never your card number.
- Operational logs. Standard server logs for debugging and abuse prevention, retained briefly.
What we don't do
- We do not sell or rent your data.
- We do not show ads or run third-party ad trackers.
- We do not use your financial data for anything except showing it back to you.
Cookies
We set the cookies required to keep you signed in (session cookies and their CSRF protections). There are no advertising or cross-site tracking cookies.
How bank connections work
Bank syncing uses Plaid Inc. You authenticate directly with your bank through Plaid; we receive an access token and account data, never your credentials. Plaid's handling of your data is described in the Plaid end user privacy policy. You can revoke a connection at any time from settings, which removes the Item at Plaid and invalidates the token.
Who processes data for us
- Google — sign-in (we receive your email address).
- Plaid — bank connections, as described above.
- Stripe — payments and subscription billing.
- Cloudflare — networking, DNS, and DDoS protection in front of the service.
- Backblaze — encrypted database backups.
Each receives only what its function requires, and none may use your data for their own purposes beyond providing the service.
Security
All traffic is encrypted in transit (TLS). The database is encrypted at rest, connection tokens carry an additional application-layer encryption (AES-256-GCM), and backups are encrypted and access-controlled. Access to production systems is restricted to the operator.
Retention and deletion
Your data is kept for as long as you have an account. Deleting your account (in settings, or by emailing us) immediately removes every bank connection at Plaid, invalidating its tokens, and erases your data from the live database.
Encrypted backups are kept for 90 days and then age out. Data deleted from the live database therefore disappears from all backups no later than 90 days after your deletion request; if we ever restore from a backup, deletions made after that backup are re-applied so deleted accounts stay deleted.
Your rights
Depending on where you live (GDPR, CCPA, and similar), you have the right to access, correct, export, or erase your personal data, and to object to or restrict its processing. Most of these are self-serve: the data we hold is visible in the app, and deletion is available in settings. For anything else, or to exercise these rights without an account, email [email protected] and we will respond within 30 days. We do not discriminate against you for exercising these rights.
Children
netboi is not directed at children and requires you to be at least 18. We do not knowingly collect data from minors.
Changes
Material changes to this policy will be posted here with an updated date above. Continued use of the service after a change constitutes acceptance.