Privacy Policy

What ZeroSum is

ZeroSum is a personal finance application that connects to your financial accounts, imports your transactions, and helps you categorize and understand your spending. It is operated by Jake Reamer. Questions about this policy or your data can be sent to jakereamer81@gmail.com.

Information we collect

• Account information: your email address, an optional display name, and a password (stored only as a one-way hash).
• Financial data via Plaid:when you link a financial institution through Plaid, we receive account details (name, type, last digits) and transaction history (dates, amounts, merchant names). We never see or store your bank username or password; you provide those directly to Plaid. Plaid's handling of your data is described in the Plaid End User Privacy Policy.
• Your categorizations: answers you give when clarifying transactions, and the categorization rules created from them.

How we use it

Your data is used for one purpose: showing you your own spending, categorized. To categorize transactions automatically, transaction descriptions and amounts are sent to Anthropic's Claude API. No account credentials, access tokens, or personal identifiers are included in those requests. We do not sell your data, share it with advertisers, or use it for anything other than operating the application.

Cookies

ZeroSum uses only cookies that are necessary to sign you in. There are no advertising or tracking cookies.

• zs_session — keeps you signed in. Expires after 30 days.
• zs_otp — set briefly during sign-in while you enter the code we email you. Expires after 10 minutes.

How your data is protected

• All traffic is encrypted in transit with TLS.
• Plaid access tokens are encrypted at rest with AES-256-GCM, and the database applies its own encryption at rest.
• Passwords are stored only as bcrypt hashes.
• Sign-in requires your password plus a one-time code sent to your email.
• Your data is visible only to your account; new accounts require approval.

Who we share data with

Only the service providers needed to run ZeroSum: Plaid (account connections), Microsoft Azure (hosting and database), and Anthropic (transaction categorization). Each receives only what its role requires. We never sell personal information.

Retention and deletion

Your data is kept while your account is active. You can disconnect a linked institution at any time, and you can request deletion of your account and all associated data by emailing the address above. Deletion removes your transactions, rules, and encrypted Plaid tokens from our database and revokes ZeroSum's access with Plaid.

Changes

If this policy changes materially, the effective date above will be updated and active users will be notified by email.