Privacy Policy

Project Millionaire is a single-user, owner-operated personal net-worth tracking application. The sole end-user is the developer and operator of the application. There is no public sign-up, no multi-tenant onboarding, and no third-party user base.

• Financial account data retrieved from Plaid: account names, balances, holdings, securities, and account metadata for accounts the operator has explicitly linked.
• Plaid-issued access tokens used to refresh that data on subsequent syncs.
• User-supplied entries (manual asset and liability rows added via the dashboard).

No personal contact data, browsing history, IP addresses, device fingerprints, or third-party analytics telemetry is collected.

Data is used solely for the operator's own net-worth calculation and historical trend analysis displayed within this application. It is not used for advertising, profiling, machine-learning training against third-party models, or any other purpose.

No data is sold, rented, or shared with marketers, advertisers, or analytics providers. Two service providers process data on behalf of the application:

• Plaid — the data source for financial accounts. See Plaid's privacy policy at plaid.com/legal.
• Neon — the managed Postgres provider where data is stored. See Neon's privacy policy at neon.tech/privacy-policy.
• Google (Gmail API) — only when the user has explicitly opted in to Gmail integration. Read-only access (gmail.readonly scope only). See Google's privacy policy at policies.google.com/privacy.
• Anthropic — receives email body text (passed through Claude) only when Gmail integration is connected, for the purpose of extracting structured transaction details. Inputs and outputs are not used to train Anthropic models per their commercial terms. See anthropic.com/legal/privacy.
• Resend — used to deliver verification emails and net-worth digests. See resend.com/legal/privacy-policy.

Users can optionally connect a Gmail account so that transaction-shaped emails (Amazon orders, food-delivery receipts, bank notifications) can be parsed for line-item detail. This feature is disabled by default and requires explicit OAuth consent.

Scope: only gmail.readonly is requested. The application cannot send, modify, draft, or delete email under any circumstances.

Selectivity: the ingestion query is restricted to a hardcoded sender allowlist (Amazon, DoorDash, Uber, Lyft, major US banks, payment networks, etc.). Emails outside this list are never fetched.

Storage: raw email bodies are encrypted at rest with the same AES-128 (Fernet) key used for Plaid access tokens. Subject, sender, and a 200-character snippet are stored in plaintext for debugging. Bodies are retained so the LLM extractor can be re-run as it improves; users can disconnect at any time, after which no new emails are fetched.

LLM processing: parsed email bodies are sent to Anthropic's Claude API for structured extraction (merchant, amount, line items). Per Anthropic's commercial terms, these inputs and outputs are not used for model training.

• Plaid access tokens are encrypted at rest before persistence using AES-128 (Fernet symmetric encryption). Encryption keys are stored in environment-only secrets and are never source-controlled or logged.
• All data in transit is encrypted with TLS 1.2 or higher (HTTPS to Plaid; TLS with SCRAM channel binding to the Postgres database).
• The application backend runs on Render with TLS-terminated edge; the Postgres database runs on Neon with full-disk encryption at rest and managed key rotation.
• Webhook events received from Plaid are JWT-signature verified against the request body hash before any state mutation.
• Multi-factor authentication is enabled on every administrative account that can access the data (GitHub, Render, Vercel, Neon, Plaid Dashboard).

Account balances, holdings, and historical snapshots are retained indefinitely to support the operator's own net-worth trend analysis — the application's primary purpose.

The application exposes an authenticated DELETE /api/plaid/items endpoint that immediately purges all linked Plaid items, encrypted access tokens, account records, holdings, and historical balance and holding snapshots. The shared securities catalog (containing no user-specific information) is preserved.

As both data subject and data controller, the operator can at any time access, export, correct, or delete all data stored by the application via direct database access and the deletion endpoint referenced above.

If the application's scope ever expands beyond single-user use, this policy will be revised before any third-party user is onboarded, and Plaid will be notified for re-review.

cajetanrodrigues88@gmail.com