Privacy Policy

1 Who We Are

Fortuna ("Fortuna," "we," "us," or "our") is a personal finance application. References to "the app" or "Fortuna" in this Policy mean both the iOS and Android mobile applications and any associated web properties we operate.

Fortuna is responsible for the personal information you provide to us and determines how and why it is processed.

2 Scope of This Policy

This Privacy Policy applies to:

• The Fortuna mobile application on iOS and Android;
• Our backend services and APIs that support the app;
• Any communication you have with us regarding your account or the app.

This Policy does not apply to third-party services you access through the app (such as Plaid or your bank). Those services have their own privacy policies, which we link where relevant.

3 Information We Collect

3.1 Information You Provide Directly

Account Information

• Name (first and last)
• Email address — used for login and security notifications
• Password — managed by Supabase Auth; stored as a salted hash; we never see your plaintext password

Profile Information (collected during onboarding)

• Occupation — to personalize coaching context
• Date of birth — to enable age-appropriate financial goal-setting
• State of residence — for jurisdictional tax and regulatory context in coaching responses
• Marital status — for household financial planning context
• Phone number (optional) — for account recovery

Financial Data You Enter

• Expense amounts, categories, merchant names, and dates
• Budget limits and income figures
• Personal reflections, emotional states, and intent notes you attach to expense records
• Financial entity names, descriptions, and cost-split arrangements
• Savings goals and net worth snapshots you create
• Receipt images you photograph or upload, and the itemized data our AI extracts from them

Identity Verification Data (only if you open an Autopilot Savings account)

This feature is optional and rolling out gradually; it does not apply unless you actively choose to open a savings account. If you do, we collect:

• Social Security number — entered by you and transmitted directly to our banking partner, Unit, for identity verification. Fortuna does not store your Social Security number in our database.
• Legal name, address, and date of birth — used to open and verify your account; some of this may be pre-filled from identity data already returned by Plaid to reduce manual entry.

See Section 6 for full detail on this feature and our relationship with Unit.

Coaching and AI Interaction Data

• Coaching session messages and conversation history
• Financial goals you describe in natural language
• Responses to behavioral prompts and check-ins
• If you use voice coaching: your spoken input, converted to text on-device by your phone's operating system, and audio generated from Aura's text replies by a third-party text-to-speech provider

3.2 Information Collected Automatically

Device and Technical Information

• Push notification token — an anonymized identifier issued by Apple (APNs) or Google (FCM) used solely to deliver notifications you have authorized. We do not link your push token to advertising systems.
• Operating system and app version — for compatibility and crash diagnostics
• Biometric authentication preference — whether you have enabled Face ID / Touch ID. Your biometric data is stored exclusively on your device by the operating system. We never receive, process, or store biometric data on our servers.

Security and Audit Logs

• Login events, IP addresses, and timestamps — for fraud detection and account security
• Significant in-app actions (e.g., bank link, bank unlink, account deletion) — for security auditing
• Webhook events from Plaid — logged by type only; no financial payload is stored in audit logs

3.3 Information Received from Third Parties

From Plaid (only if you choose to link a bank account)

When you link a bank account, Plaid transmits the following limited data to us:

• Merchant or payee name
• Transaction amount (outflows only — we do not process credit/inflow transactions)
• Transaction timestamp
• Plaid-assigned spending category
• Approximate geographic location (latitude/longitude, if provided by your bank)

We do not receive or store: your bank account numbers, routing numbers, login credentials, full transaction history, or account balances.

Plaid access tokens (the server-side credentials that authorize data retrieval) are stored on our servers and are never transmitted to your mobile device or visible to you.

Exception — Autopilot Savings only: if you choose to open an optional Autopilot Savings account (Section 6.6), we additionally request your name, email, and address from Plaid's Identity product to pre-fill the account-opening form. This identity data is requested only at that point, only for that purpose, and is not requested for ordinary Plaid-linked accounts used purely for expense tracking.

From Apple or Google (Sign-In)

If you register or log in using "Sign in with Apple" or Google Sign-In, we receive your email address and name (or an anonymized email relay, if you choose to hide your email via Apple). We use this only to create and identify your account.

4 How We Use Your Information

5 Data Sharing and Disclosure

5.1 Service Providers

We share data only with the following infrastructure providers, each engaged under data processing agreements, and solely to operate the app on your behalf:

5.2 Other Users (Cost-Splitting Feature)

If you use the cost-splitting feature, certain information is shared with collaborators you explicitly invite. See Section 8 for full details.

5.3 Legal Requirements

We may disclose your information if we are required to do so by law, court order, or governmental regulation, or if we believe in good faith that such disclosure is necessary to:

• Comply with a legal obligation;
• Protect and defend our rights or property;
• Prevent or investigate possible wrongdoing;
• Protect the personal safety of users or the public.

We will notify you of any legally compelled disclosure to the extent permitted by law.

5.4 Business Transfers

If Fortuna is acquired by, merged with, or sold to another entity, your information may be transferred as part of that transaction. We will provide notice via the app or email before your information becomes subject to a different privacy policy. You will have the opportunity to request deletion of your account and data prior to any such transfer.

5.5 Aggregated or Anonymized Data

We may share aggregated, de-identified data (e.g., anonymized spending trends) that cannot reasonably be used to identify you, for research, product improvement, or public reporting.

6 Bank Linking, Goals & Autopilot Savings (Plaid and Unit)

6.1 What Plaid Does

Plaid is a third-party financial data platform that enables Fortuna to securely connect to your bank account without ever seeing your bank credentials. When you tap "Link a bank account," you are redirected to Plaid's secure interface. Plaid's use of your data is governed by Plaid's Privacy Policy.

6.2 What We Receive from Plaid

As described in Section 3.3, we receive only five data fields per transaction (merchant name, amount, timestamp, category, and approximate location). We do not receive your bank credentials, account numbers, or full account history.

6.3 How We Use Plaid Data

Plaid transaction data is used only to:

• Alert you in real time of potential expenses for you to review and categorize;
• Pre-fill the expense entry form to reduce manual data entry.

Plaid data is not used to make any automated decisions that affect you, and is not shared with third parties beyond the service providers in Section 5.1.

6.4 Disconnecting Your Bank

You can disconnect your bank at any time from Settings → Connected Banks → Unlink. Upon unlinking:

• We call Plaid's /item/remove endpoint to revoke Plaid's access to your account on Plaid's servers;
• We deactivate the connection in our database, and no further transaction data is received;
• Historical transaction data that has already been converted into expense records is retained in your account (because it is now your own financial record) unless you delete those records or your account.

6.5 Plaid's Independent Data Practices

Plaid may independently collect and retain data about your bank account connection in accordance with their own privacy policy. Fortuna does not control and is not responsible for Plaid's independent data practices. For questions about data Plaid holds, contact Plaid directly at plaid.com/legal.

6.6 Autopilot Savings and Our Banking Partner (Unit)

Fortuna offers an optional feature — Autopilot Savings — that lets you open a savings account to fund goals automatically through round-ups, scheduled contributions, and yield-aware allocation. This feature is rolling out gradually and may not yet be available to you. The account itself is issued by an FDIC-insured bank through our banking-as-a-service partner, Unit Finance Inc. ("Unit"), not by Fortuna. Unit and its partner bank process your identity verification and hold and move the funds in that account; Fortuna's role is to let you configure the rules (round-ups, schedules, goals) and to display the resulting balance and activity.

6.7 Identity Verification Data We Collect and Send to Unit

To open an Autopilot Savings account, we collect your Social Security number, legal name, address, and date of birth. Your Social Security number is transmitted directly to Unit for identity verification and is not stored in Fortuna's database; we retain only a confirmation that verification succeeded or failed. Name, address, and date of birth may be pre-filled from identity data already available through your linked Plaid account.

6.8 What Unit Does With Your Data

Unit and its partner bank process your identity and account data as required to open, maintain, and service your Autopilot Savings account, including compliance with bank secrecy, anti-money-laundering, and other financial regulations. Unit's use of your data is governed by its own privacy policy and the deposit account agreement presented to you directly during account opening, not by this Policy. Fortuna does not control and is not responsible for Unit's or its partner bank's independent data practices.

6.9 Closing an Autopilot Savings Account

You can close an Autopilot Savings account and withdraw its funds from within the app. Closing the account stops future automatic transfers; records of past transfers are retained as described in Section 9 for financial recordkeeping purposes, even after the account is closed.

7 AI Coaching (Aura)

7.1 How Aura Works

Aura is Fortuna's AI financial coach, powered by Claude (Anthropic's large language model). When you interact with Aura — asking questions, receiving monthly summaries, or getting habit recommendations — your messages and relevant financial context are sent to Anthropic's API to generate a response.

7.2 What We Send to Anthropic

Each coaching request may include:

• Your message text;
• Aggregated financial summaries relevant to your question (e.g., "Your spending this month: $1,200 across 34 transactions");
• Recent conversation history for context continuity.

We do not send: your full transaction history, your bank credentials, your Plaid access tokens, your email address, or your full legal name in coaching prompts. We use pseudonymized context where possible.

7.3 Anthropic's Use of Your Data

Anthropic processes your messages to generate responses. Anthropic's use of data is governed by their Privacy Policy and API terms. As of the effective date of this Policy, Anthropic does not use data submitted via their API to train their models, per their API usage terms. However, this is subject to Anthropic's own policies, which you should review.

7.4 Coaching History Retention

Your coaching conversation history is stored in our database for one (1) year to provide continuity between sessions, after which it is automatically deleted. You may request earlier deletion at any time by contacting us or deleting your account.

7.5 Not Financial Advice

Aura is an educational tool. Nothing Aura says constitutes financial advice, investment advice, tax advice, or legal advice. See our Terms of Service for the full disclaimer.

8 Cost-Splitting and Shared Financial Entities

8.1 How Cost-Splitting Works

Fortuna allows you to create a shared financial entity (e.g., a shared household budget or expense group) and invite collaborators by email address. Collaborators who accept the invitation gain a read-only or collaborative view of the shared entity.

8.2 What Is Shared with Collaborators

When you share a financial entity with another user:

• The entity's name, description, and total budget are visible to all accepted collaborators;
• Individual expense records within that entity (amounts, merchant names, dates, categories) are visible to all accepted collaborators;
• Each collaborator's name (as registered in Fortuna) is visible to other collaborators within the same entity;
• Payment records made by any collaborator toward shared expenses are visible to all collaborators.

8.3 What Is Never Shared

• Any financial entities, expenses, or data that you have not explicitly added to a shared entity;
• Your email address (collaborators see your name, not your email, within the shared view);
• Your bank account information, Plaid data, AI coaching conversations, or any other personal data outside the shared entity.

8.4 Removing Collaborators

The entity owner may remove any collaborator at any time. Upon removal:

• The removed collaborator immediately loses access to the shared entity;
• The removed collaborator's mirror copy of the shared entity is deleted from our systems;
• The removed collaborator receives a notification that they have been removed.

8.5 Leaving a Shared Entity

Collaborators may leave a shared entity at any time from the app. This has the same effect as being removed by the owner.

9 Data Retention

9.1 Account Deletion

When you delete your account (Settings → Account → Delete Account):

• All of your personal data — account information, financial records, coaching history, linked bank data, push tokens, and Supabase authentication record — is permanently and irreversibly deleted within 24 hours;
• Any shared entities you own are dissolved and collaborators lose access;
• Security audit logs referencing your account are anonymized (user ID replaced with a null reference) rather than deleted, to preserve security incident records;
• Backup copies, if any, are purged within 7 days.

10 Security

10.1 Technical Safeguards

• Encryption in transit: All data transmitted between your device and our servers uses HTTPS/TLS 1.2 or higher. All data transmitted between our servers and third-party APIs is encrypted.
• Encryption at rest: Your data is stored in Supabase, which encrypts all database data at rest using AES-256.
• Row-Level Security: Our database enforces row-level security (RLS) policies, meaning each query is automatically scoped to the authenticated user. No query can return another user's data without explicit permission.
• Access token security: Plaid access tokens are stored server-side only and are never transmitted to mobile clients.
• Webhook signature verification: All inbound Plaid webhook events are verified using Plaid's JWT-based EC signing scheme before any processing occurs. Unauthenticated webhook requests are rejected.
• Biometric authentication: If you enable Face ID / Touch ID, your biometric data never leaves your device. The operating system handles authentication locally.

10.2 Organizational Safeguards

• Access to production systems and databases is restricted to authorized personnel only;
• No credentials, access tokens, or personal data are logged in application logs;
• Cron endpoints and administrative APIs are protected by secret-key authentication;
• Security changes are reviewed before deployment.

10.3 Limitations

No security system is perfect. While we implement industry-standard protections, we cannot guarantee absolute security. In the event of a breach affecting your personal data, we will notify you as described in Section 15.

11 Your Rights and Choices

Regardless of your location, you have the following rights with respect to your personal information:

11.1 Access

You have the right to know what personal data we hold about you. Most of your financial data is visible directly in the app. To request a complete data export, email privacy@api.danielesambu.com with "Data Export Request" in the subject line. We will fulfill your request within 30 days.

11.2 Correction

You may correct or update most of your information directly in the app (profile settings, expense records). For information you cannot edit directly, contact us.

11.3 Deletion

You may delete your account and all associated data at any time from Settings → Account → Delete Account. This is immediate and irreversible. Alternatively, contact us to request deletion of specific data.

11.4 Data Portability

You may request a machine-readable export of your personal data by contacting us. We will provide it in JSON or CSV format within 30 days.

11.5 Objection and Restriction

You may object to our processing of your personal data on the basis of legitimate interest, or request that we restrict processing while a dispute is resolved, by contacting us.

11.6 Withdraw Consent

Where we rely on your consent to process data (e.g., push notifications, bank linking), you may withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing that occurred before withdrawal.

• Push notifications: Turn off in Settings → Notifications, or in your device's system notification settings.
• Bank linking: Disconnect in Settings → Connected Banks → Unlink.
• AI coaching: You may stop using the coaching feature at any time. Contact us to delete your coaching history.

11.7 How to Submit a Request

Email: privacy@api.danielesambu.com
We will respond within 30 days. We may ask you to verify your identity before fulfilling a request.

12 California Privacy Rights (CCPA / CPRA)

This section applies to California residents. The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you additional rights.

12.1 Categories of Personal Information We Collect

In the past 12 months, we have collected the following categories of personal information as defined by the CCPA:

12.2 We Do Not Sell or Share Your Personal Information

We do not sell your personal information. We do not share your personal information with third parties for cross-context behavioral advertising. Fortuna is an ad-free application.

12.3 Your California Rights

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: We do not sell or share personal information, so no opt-out is required. However, you may still contact us to confirm.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for any purpose beyond those permitted by the CPRA.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise your California rights, email privacy@api.danielesambu.com or use the in-app deletion feature. We will respond within 45 days, with one 45-day extension where reasonably necessary.

13 Geographic Restriction — United States Only

13.1 US-Only Service

Fortuna is designed, operated, and offered exclusively for use within the United States. All of our services, features, bank-linking integrations, and coaching content are scoped to US law, US financial institutions, and US residents.

13.2 Blocking of International Access

We do not knowingly permit access to the Service from outside the United States. If you are located outside the United States, you are not authorized to use or access Fortuna. We reserve the right to block, suspend, or terminate accounts that we determine are being accessed from outside the United States.

13.3 No Cross-Border Data Transfers

Because we serve only US residents, we do not engage in cross-border personal data transfers subject to frameworks such as GDPR, UK GDPR, or equivalent non-US data protection regimes. If you access the Service in violation of this geographic restriction, you do so at your own risk and you are solely responsible for compliance with any laws of your jurisdiction.

13.4 No GDPR or UK GDPR Obligations

Fortuna does not target individuals in the European Economic Area or the United Kingdom, and does not consider itself subject to the General Data Protection Regulation (GDPR) or UK GDPR. If applicable law in your jurisdiction conflicts with this Policy, please do not use the Service.

14 Data Breach Notification

In the event of a security breach that affects your personal data, we will:

• Notify affected users via email and in-app notification as soon as practicable, and no later than 72 hours after we become aware of the breach (where required by law);
• Notify affected state attorneys general or other applicable US regulatory authorities as required by state breach notification laws;
• Provide information about the nature of the breach, the categories of data affected, the likely consequences, and the measures taken to address the breach;
• Take immediate steps to contain, assess, and remediate the breach.

15 Age Requirement

Fortuna is intended for, and may only be used by, individuals who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18.

Age verification occurs during account setup. If you enter a date of birth that indicates you are under 18, your account will be automatically and permanently deleted immediately, and you will not be permitted to use the Service.

If we discover that we have inadvertently collected personal information from a person under 18, we will delete that information immediately. If you believe an underage person has created an account, please contact us at privacy@api.danielesambu.com.

16 Third-Party Links and Services

The app may contain links to third-party websites or services (e.g., Plaid's bank selection interface, legal document pages). This Privacy Policy does not apply to any third-party sites or services. We encourage you to review the privacy policies of any third-party services you access.

We are not responsible for the privacy practices or content of third-party sites or services.

17 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes:

• We will update the "Last updated" date at the top of this Policy;
• For material changes (i.e., changes that meaningfully affect your rights or how we use your data), we will notify you via in-app notification and email at least 30 days before the changes take effect;
• For non-material changes, the updated Policy will be effective when posted.

Continued use of Fortuna after the effective date of a revised Policy constitutes your acceptance of the changes. If you do not agree to a material change, your sole remedy is to delete your account before the change takes effect.

18 Contact Us

For privacy questions, data requests, or concerns about this Policy: