Privacy Policy

We don’t sell your data, and there are no advertising or analytics trackers on Firdona. This page lists, plainly, exactly what’s collected and which third parties see it.

What we collect

• Account info: name, email, and a hashed (never plaintext) password.
• Financial data: if you connect a bank account, Plaid provides account balances and transaction history, which we store to compute the figures Sterling narrates. Plaid access tokens are encrypted at rest before storage.
• Data you enter directly: goals, calendar dates, logged refunds, and your conversation history with Sterling.
• Basic security metadata: sign-in events, shown on your Profile page.

Who we share it with, and why

• Plaid, Inc. — to establish and maintain your bank connection. Plaid has its own privacy policy governing what it does with your bank credentials and data.
• Anthropic — computed facts about your finances (never raw account credentials) are sent to Anthropic’s Claude API so Sterling can narrate them. This is the one third party that genuinely sees a summarized version of your financial activity, since that’s the product’s core function.
• Resend — your email address, to send account-verification and password-reset emails.
• Neon (database) and Vercel (hosting) — infrastructure providers that store and serve the application; they don’t use your data for anything beyond operating the service.

We do not sell data to advertisers or data brokers, and there are no ad-tracking or analytics scripts on this site.

Cookies

Firdona uses one session cookie to keep you signed in (a signed JWT via Auth.js). No third-party advertising or tracking cookies are set.

Data retention and deletion

Your data is retained while your account exists. To request deletion of your account and everything tied to it, contact the account owner via firdona.com — this removes your user record and everything referencing it (accounts, transactions, goals, conversations, notifications) from the database.

Security

Passwords are hashed with bcrypt, never stored in plaintext. Plaid access tokens are encrypted at rest. Sessions use signed, httpOnly JWT cookies. That said, Firdona is an early-preview product without a formal security audit — see the Terms of Service for current limitations.

Changes to this policy

If what we collect or who we share it with changes — notably once real bank connections and payment processing are introduced — we’ll update the date at the top of this page.

Contact

Questions about this policy or a data deletion request: reach the account owner via the contact on firdona.com.