Privacy Policy

1. Scope and who we are

This Privacy Policy explains how OnTrack Group, LLC ("OnTrack," "we," "us," or "our") handles information when you visit OnTrack Money websites or use the OnTrack Money budgeting application and related support services (collectively, the "Service").

2. Information we collect

Account and profile information

We collect identifiers and profile details such as your email address, display name, optional phone number, authentication identifiers, account membership and invitation records, and records of your acceptance of our Terms.

Budgeting and financial information

We process information you enter, import, or create in the Service, including budgets, categories, line items, financial-account metadata, balances, transaction names, amounts and dates, allocations, rules, and notes.

Connected-account information

If you connect a financial institution through Plaid, we receive institution and account metadata, balances, transaction information, and connection identifiers and tokens needed to maintain the connection. OnTrack does not receive or store the online-banking credentials you enter in Plaid's connection flow.

Billing information

For mobile subscriptions, we process an OnTrack user identifier, product and entitlement details, purchase status, renewal or expiration information, and related subscription-event metadata. Apple or Google processes the payment transaction; OnTrack does not receive your full payment-card number.

Support and feedback

We collect the contact details and messages you submit, including support requests, product feedback, and the improvement reason requested during account deletion. These messages may contain information you choose to include.

Preferences, telemetry, and device data

We process settings such as theme, notification, budgeting, and display preferences. Our hosting, performance, analytics, and error-monitoring providers may process IP address, browser or device type, operating system, app or route information, request timing, network information, diagnostics, and error details. We configure Sentry not to send default personally identifiable information and to scrub selected sensitive fields, but diagnostic events can still contain contextual data.

Cookies and client storage

We use authentication cookies and browser or device storage to keep you signed in, preserve theme and app preferences, remember selected accounts and refresh state, and temporarily maintain authentication, app-version, and Plaid Link session context. You can clear this storage through your browser or device, although doing so may sign you out or reset preferences.

3. How we use information

• Provide authentication, budgeting, bank-sync, billing, and support features.
• Import, organize, categorize, and display financial information you request.
• Operate optional recommendations and user-authorized AI Connections described below.
• Send account, invitation, service, support, and transactional communications.
• Maintain entitlements and process subscription events.
• Monitor reliability, troubleshoot errors, prevent abuse, and secure the Service.
• Understand product performance and improve features and usability.
• Comply with law, enforce our agreements, and protect users and the Service.

4. AI features and optional connections

OnTrack uses OpenAI for certain AI-assisted features. Information sent depends on the feature:

• Category recommendations: merchant names, transaction amounts, candidate budget line-item and category names, and recent merchant and allocation patterns may be sent to suggest a category after a bank-sync user separately enables AI category suggestions. Accepting the Terms does not enable this sharing. You can change your choice in Settings > AI Features. Turning it off stops new requests, without erasing information already shared. Manual tracking, rules, and merchant matching remain available. We record your choice, its date, and the disclosure version.

Optional AI Connections (MCP)

If you choose to connect a third-party AI assistant with OnTrack Pro, you sign in through OnTrack and approve access to your selected personal account. The connected app can receive budget information, including categories and line items, transactions and allocations, and notes within the access you approve. Read-only access allows questions and searches. Editing access also permits changes to notes, transactions, and individual budget items. Your AI app controls its tool-approval prompts.

We store connection identifiers, app details, granted access, connection and last-use times, revocation status, and activity records of assistant changes to help you review and manage access. These MCP requests use information already stored in OnTrack; they do not invoke OnTrack's AI providers or initiate additional bank-data requests.

The AI app and its providers process information under their own terms and privacy policies, including their retention practices. Review those policies before connecting. You can revoke future access in Settings > AI Features, including after Pro ends. Revocation does not delete information already received or retained by the connected app.

This data is not necessarily anonymous. Do not include information in prompts or notes that you do not want processed for the feature. AI output can be incomplete or inaccurate and should not be treated as financial, legal, tax, or investment advice.

5. Service providers and other disclosures

We disclose information as needed to operate the Service. Our current provider categories include:

• Supabase for authentication, databases, storage, and backend infrastructure.
• Cloudflare R2 for storage of encrypted disaster-recovery backups.
• Plaid for financial institution connections and financial-data aggregation.
• Vercel for hosting and delivery, including Vercel Analytics and Speed Insights for usage and performance measurement.
• Upstash, when configured, for rate limiting and abuse prevention using route-and-IP-derived keys.
• Sentry for application error monitoring and diagnostics.
• Resend for transactional and service email delivery, including support requests, product feedback, account-deletion feedback, and deletion cleanup notices to the OnTrack support inbox.
• OpenAI for category recommendations.
• RevenueCat for mobile subscription entitlements and purchase lifecycle management, and Apple and Google for app distribution and in-app purchase processing.

These providers process information under their own terms and privacy commitments. We may also disclose information when reasonably necessary to comply with law, respond to valid legal process, protect rights and safety, investigate abuse, or complete a business transaction such as a merger or acquisition.

6. No sale of personal information

We do not sell or rent your personal or financial information. Our disclosures to providers are for operating, supporting, securing, and improving the Service as described in this Policy.

7. Retention and deletion

We retain information for as long as needed to provide the Service, maintain security and business records, resolve disputes, and meet legal obligations. We apply data-minimization and purpose-based retention; independently operated provider systems can have their own documented retention and deletion practices.

You can request account deletion from Settings. We require a short product-improvement reason in that simple confirmation flow. OnTrack erases the active account first, then routes the feedback without the deleted account's OnTrack user ID or email address. Free text may still identify you if you include personal information, so do not include account numbers, transaction details, or other sensitive information. The feedback is delivered through Resend to the OnTrack support inbox and may be retained after account deletion for product research and improvement and business recordkeeping. Support messages and product feedback are also delivered to this inbox and may be retained for support records, product research and improvement, and business recordkeeping; a reply email address is included when available. We do not apply a fixed deletion schedule to this correspondence, subject to applicable law.

We send a separate operational notice to our support inbox after account erasure, containing an internal deletion reference, deletion time, and cleanup status for manual verification. It does not include profile contact details, budgets, transactions, or bank credentials. This operational correspondence may be retained for deletion verification and business recordkeeping, subject to applicable law. Legacy file-cleanup failures are handled through manual support follow-up rather than automatic retry.

Some deletion propagation through active systems may take up to 30 days. Encrypted disaster-recovery copies cannot be selectively edited and are scheduled to expire under tiered backup lifecycles of up to 400 days. Physical removal is performed by the storage provider and may occur after the scheduled expiry. OnTrack may retain minimized billing-event facts for a seven-year retention period measured from receipt of the event for tax, accounting, dispute, fraud-prevention, provider-reconciliation, or legal-claim purposes. Expired records are eligible for automated cleanup on the first day of each month at 04:30 UTC and are normally removed on the next scheduled run after their deadline. Large backlogs, failed runs, or retries may delay removal. When an account is deleted, we remove raw billing payloads and direct OnTrack and RevenueCat user identifiers from those retained records. Other security or legally required business records are retained only for the applicable purpose and period.

Deleting your OnTrack account does not cancel an Apple App Store or Google Play subscription; you must manage or cancel that subscription with the store where you purchased it. Account deletion automatically requests provider-side disconnection of linked Plaid institutions and waits for confirmation before erasing your active account. A provider outage or unresolved connection may require a retry or support assistance; the app tells you when deletion has not completed. Separate bank disconnection before account deletion is not required.

8. Security

We use reasonable administrative and technical safeguards designed to protect information, including encrypted network transport, access controls, row-level database authorization, and restricted server-side credentials. No service can guarantee absolute security. Protect access to your email account and device, and notify us if you suspect unauthorized use.

9. Your choices

• Review or update profile and preference information in Settings.
• Choose whether to connect a bank account or use optional AI features.
• Disconnect a linked financial institution from the Service.
• Review or revoke connected AI apps in Settings > AI Features.
• Manage or cancel mobile subscriptions through Apple or Google.
• Delete your account in Settings or contact us about an access, correction, or deletion request.

Rights vary by location. We may need to verify your identity before completing a request, and some information may be exempt from a request where permitted by law.

10. Children

The Service is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal information from children through the Service. Contact us if you believe a child has provided information to us.

11. Processing locations

OnTrack and its providers may process information in the United States and other locations where they operate. Laws in those locations may differ from those where you live. We do not represent that all Service data stays in a particular country or data region.

12. Changes to this Policy

We may update this Policy as the Service or our practices change. We will post the revised version and effective date here and provide additional notice when appropriate.

13. Contact us

Questions or privacy requests can be sent to OnTrack Group, LLC at support@ontrackmoney.com.