Privacy Policy

Effective September 15, 2026

Aggregate Finance (“the app,” “we,” “us”) is operated by Mitchel Baker. It connects to your bank accounts through Plaid and keeps a Google spreadsheet you own up to date with your credit card statements, transactions, and recurring payments. This policy explains what we collect, how we use it, and the choices you have.

Information we collect

From your Google account

• Sign-in: your name, email address, profile photo, and Google account identifier.
• Google Sheets access (optional): if you connect Google Sheets, we request the drive.file permission. It lets us create a spreadsheet for you, or open one you explicitly choose, and write to it. It does not give us access to any other files in your Google Drive. We store an encrypted token so the app can keep that spreadsheet updated.
• What you type into the app’s tabs: names and types you set on the Recurring tab are read back so your labels carry over. Notes columns stay in your spreadsheet and are not read.

From your financial institutions, through Plaid

When you connect a bank, you sign in to it through Plaid. We never receive or store your bank username or password. With your permission, Plaid provides us with:

• Accounts: account names, the last four digits of account numbers, current balances, and credit limits for credit cards.
• Transactions: date, amount, merchant name, spending category and subcategory, and which account they belong to.
• Credit card statements: statement balance, minimum payment, statement and due dates, and your most recent payment.
• Recurring payments: recurring charges Plaid detects, such as subscriptions and bills, with their frequency and amounts.

We store only the fields the app uses to build your spreadsheet. The access tokens Plaid issues are encrypted before we store them. Plaid’s handling of your data is described in the Plaid End User Privacy Policy.

Billing

If you subscribe, payments are handled by Stripe. You enter your payment details directly with Stripe, and we never receive or store your full card number. We store your Stripe customer and subscription identifiers, your subscription status, and your billing period, so we know which features you can use. Stripe’s handling of your information is described in the Stripe Privacy Policy.

When you contact us

If you send a message through the contact form, we store your email address, name (if you give one), topic, and message so we can reply. To limit abuse, we also store a one-way hash of your IP address, not the address itself. Messages are deleted along with your account, or on request.

Technical information

We use a single essential cookie to keep you signed in and protect against forged requests. We don’t use advertising or analytics cookies. Our hosting provider records standard server logs (such as IP address, time, and requested page) for security and troubleshooting.

How we use your information

• To sign you in and provide the app: syncing your connected accounts and writing your data to the spreadsheet you chose.
• To manage your subscription, including billing for the number of connected banks.
• To keep the service secure, diagnose problems, and prevent abuse.
• To email you when something needs your attention, such as a bank asking you to sign in again, Google Sheets access ending, or a failed payment, and about important changes to the app.

We do not sell your information, use it for advertising, or share it with data brokers.

Google user data

Aggregate Finance’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we use Google user data only to provide and improve the user-facing features described above. We don’t transfer it except as needed to provide those features, to comply with law, or as part of a merger or acquisition with your notice. We don’t use it for advertising. We don’t allow humans to read it unless you give permission, it’s necessary for security or to comply with law, or it’s aggregated and anonymized. We don’t use it to develop, improve, or train generalized artificial intelligence or machine learning models.

Who we share information with

We share information only with service providers that help us run the app, and only as needed for that purpose:

• Plaid connects to your financial institutions.
• Google provides sign-in and hosts your spreadsheet in your own Google Drive.
• Stripe processes subscription payments.
• DigitalOcean hosts the application.
• Resend delivers our emails to you.
• MongoDB Atlas hosts our database.

We may also disclose information if required by law, or to protect the rights, safety, or security of our users or others.

Security

Data is encrypted in transit using HTTPS/TLS, and our database provider encrypts stored data at rest. Bank and Google access tokens are additionally encrypted by the app before they’re stored, and access to our systems is restricted. No method of transmission or storage is completely secure, so we can’t guarantee absolute security.

Retention and your choices

• Remove a bank: removing a bank in the app revokes our access through Plaid and deletes its stored access token. Data already synced remains until you delete your account. You can also manage connections Plaid knows about at my.plaid.com.
• Disconnect Google Sheets: disconnecting in the app revokes our Google access and deletes the stored token. You can also remove access in your Google Account permissions.
• Your spreadsheet: it lives in your Google Drive, and you can edit or delete it at any time. We don’t delete it for you.
• Delete your account: choose Delete account in the account menu. We immediately disconnect your banks from Plaid, cancel any subscription, revoke our Google access, and delete your account and the financial data we store, including your contact messages. Stripe keeps its own records of past payments as required by law. You can also email [email protected] from the email address you sign in with. We keep your information only as long as your account is active, or as needed to meet legal obligations.
• Access or correct your data: contact us at the same address.

Children

The app is intended for adults (18 or older) in the United States and is not directed to children. We don’t knowingly collect information from children under 13.

Changes to this policy

If we make material changes, we’ll update the effective date above and let signed-in users know in the app or by email.

Contact

Questions or requests: [email protected].