We don't sell your data or use it for advertising. Your subscription is the only way we make money.
The short version
A plain-English summary, for convenience only. It is not part of the Privacy Policy and does not change them — the full text below is what applies.
What we collect
Your email address, and — once you connect a bank — your transaction history and account details from that bank, through Plaid.
Payments go through Stripe. We never see or store your full card number; we keep your subscription status and the last four digits.
We never see your bank login
You enter it with Plaid, not with us. We receive an access token, and we encrypt it before storing it. We can read transactions to find your recurring charges. We cannot move money.
We don't sell your data
Not to advertisers, not to lenders, not to anyone. We take no affiliate commissions and no cut of what you save. If that ever changed it would change the business, and we’d have to tell you.
Anonymised comparisons with other members
One thing we do use your data for. When we offer this feature, amounts from members’ transactions can be pooled to show what people typically pay for a subscription. Direct identifiers are removed, your information is combined with other members’, and a minimum group size applies so no figure can be traced back to you.
It is never sold and never used for advertising, and we never show another member your transactions, your merchant history, or your own cancellation notes. You can opt out in your account settings.
Who we share it with
Only the companies that make the product run: Plaid (bank data), Stripe (payments), Supabase (our database), Vercel (hosting), and Resend (email). Each sees only what it needs.
Getting your data out — or deleting it
You can disconnect a bank at any time, which tells Plaid to invalidate the connection. You can delete your account from Settings, which removes your data and cancels any subscription.
Depending on where you live you can also ask for a copy of your personal information, or ask us to correct it, and object to or restrict some uses of it. Disconnecting and deleting you can do yourself in the app; for anything else email hello@prunemoney.com.
California residents can ask us to access, correct, or delete their personal information, and we won’t treat you any differently for asking.
Three records outlive deletion, because they’re the evidence we handled your account properly: proof that you agreed to the terms, a log of the emails we sent, and a security audit log — which includes the name of the bank you connected, kept for up to two years.
Your transaction history, your balances, and the tokens that connected us to your bank are all deleted.
Privacy Policy in full
Prune Money ("Prune", "we", "us", "our") is operated by Faster Sloths, Inc., a Delaware corporation, 1930 18th St NW, Suite B2, Washington, DC 20009. This Privacy Policy explains what information we collect, how we use and share it, and the choices you have. It applies to our website and application (the "Service").
Prune earns money only from your subscription to the Service. Prune uses your information to run the Service for you, and, in the de-identified and aggregated form described in Section 3, to help other members. We do not sell your personal or financial information, we do not take a cut of what you save, and we do not earn affiliate commissions.
1. Information we collect
Information you give us
- Account information: your email address and authentication credentials when you create an account.
- Payment information: handled by our payment processor (Stripe). We receive limited billing details (e.g., subscription status, card brand and last four digits). We do not receive or store your full card number. Your card details go directly to Stripe and are not stored on Prune's servers, and Prune does not store your full card number, your card security code, or your bank account number.
Financial information you connect through Plaid
With your explicit authorization, you connect a bank or card account through Plaid. We use Plaid to retrieve transaction history and related account information so we can detect recurring charges and analyze spending.
We never receive or store your bank login credentials. You enter those only within Plaid's interface. We receive a secure access token from Plaid, which we store in encrypted form to refresh your data.
The financial data Prune accesses is limited to what the features need, which is the Plaid Transactions and Recurring Transactions products. Prune does not request identity, balance, investment, or loan-account products.
Information we collect automatically
Basic technical and usage data (e.g., device/browser type, log data, and actions within the Service) used to operate, secure, and improve the Service. Prune does not currently respond to browser Do Not Track signals, and Prune does not let third parties collect personal information about your activity across other websites through the Service.
Your decisions about your subscriptions
When you mark a subscription as one you want to keep or one you're working to cancel, and when you tell us you've completed a cancellation, we store that choice and when you made it. We use it to show you what you've decided, to tell you when something you meant to cancel is still charging you, and to confirm a cancellation once the charges stop.
When you tell us whether a subscription is worth the money (worth it, not sure, or not worth it), we store that answer and when you gave it. We use it to show you your own answers, to point out charges you've said aren't worth it that are still being taken, and to summarize what you decided over the year. Prune uses your rating to serve you. Prune does not combine your rating with other members' answers unless you take part in the de-identified insights feature described in Section 3, and you can opt out of that feature.
Records of your agreement to these terms
When you create an account, and again when you start a paid subscription, we record that you agreed, the date and time, your IP address, your browser's user-agent string, and the version of the terms you agreed to. We keep this as proof of consent, which we are required to be able to produce.
Some of these records are kept for a set period after you delete your account, as described in Section 7.
2. How we use your information
We use your information to:
- provide the Service, detect subscriptions and memberships, estimate recurring spend, show spending by category, and send the alerts and weekly summary you sign up for;
- process your subscription and manage billing;
- secure the Service, prevent fraud and abuse, and maintain audit and security logs;
- communicate with you about your account and the Service; and
- comply with legal obligations.
- create de-identified and aggregated insights that help other members, as described in Section 3, unless you opt out.
Prune does not use your financial data for advertising, and Prune does not sell your personal or financial information.
Marketing communications. If Prune sends a promotional email, each message includes a way to unsubscribe. You can opt out of promotional email at any time, and Prune honors the request promptly. Opting out does not stop transactional messages about your account, your billing, or the renewal notices Prune is required to send.
3. De-identified and aggregated insights
When Prune offers the de-identified insights feature, it uses some information in a de-identified and aggregated form to help other members inside the Service. This section describes what Prune uses, how it protects that information, and your choices.
Transaction-derived aggregates. Amounts and subscription prices drawn from members' transaction data, used to show typical prices, for example what other members pay for the same service.
Volunteered cancellation experiences and ratings. Input you choose to share about how a cancellation went, or whether a subscription is worth its price.
How Prune protects this information. Before using it, Prune removes direct identifiers, combines your information with information from other members, and applies a minimum group size so that no figure traces back to an individual. Prune does not sell this information, does not share it for cross-context behavioral advertising, and does not try to identify any individual from the output. The output never shows your individual transactions, your merchant history, your account information, or your own cancellation experience.
Your choice. You can opt out of the insights feature in your account settings, and the Terms of Service also describe this use.
4. How we share your information
We share information only as described here:
Service providers (sub-processors) who process data on our behalf under contract:
- Plaid: connects your financial accounts and provides transaction data. Your use of Plaid is also governed by Plaid's End User Privacy Policy (see Section 5).
- Supabase: database and authentication hosting.
- Vercel: application hosting.
- Stripe: payment processing. We do not send your bank/Plaid data to Stripe.
- Resend: sends the transactional and summary emails you receive. These contain your own account/subscription information. No third party receives them.
Legal and safety: if required by law, regulation, legal process, or to protect the rights, safety, and security of our users or the Service.
Business transfers: Prune may transfer your information in a merger, acquisition, or sale of assets, and the recipient must honor this Policy or give you notice of a material change before your information is used differently.
Prune does not sell your personal information, and Prune does not share it for cross-context behavioral advertising.
5. Plaid
We use Plaid Inc. ("Plaid") to connect your accounts. By using the Service, you also agree to Plaid's End User Privacy Policy, available at https://plaid.com/legal/#end-user-privacy-policy, and you grant us and Plaid the right to access and use your financial data as described here and in Plaid's policy. Plaid's policy explains what Plaid collects and how to contact Plaid.
6. How we protect your information
- Encryption in transit: all connections use TLS/HTTPS.
- Encryption at rest: our database is encrypted at rest, and the access tokens that let us refresh your financial data carry an additional layer of application-level AES-256 encryption. We never store your bank credentials.
- Access controls: your data is protected by per-user access rules so that you can access only your own data. Internal access is limited and protected by multi-factor authentication.
- Logging: we keep audit logs of access to financial data and key account events.
No method of storage or transmission is completely secure, so Prune cannot guarantee absolute security.
If a security breach affects your personal information, Prune will notify you and any regulator as and when applicable law requires.
7. Data retention and deletion
Prune keeps your information while your account is active and while it is needed to run the Service. You can disconnect a financial account or delete your account at any time. When you disconnect an account or delete your account, Prune instructs Plaid to remove the connection (Plaid /item/remove) so it can no longer be used to access your data, and Prune deletes the associated stored data, including your transaction-derived subscription history and the encrypted access tokens.
What Prune keeps after you delete your account. Three records are kept for a set period after deletion, because they are the evidence that Prune handled your account correctly:
- Proof of consent, meaning that you agreed, when, from what IP address and browser, and to which version of the terms. Prune keeps this for three years after the subscription ends, or one year after the account is deleted, whichever is longer. This is Prune's retention policy for consent records, and it meets the California minimum for proof of consent.
- Email log, meaning which notices Prune sent, when, and whether they were delivered. Prune keeps this for three years and limits the stored content to what proves a notice was sent.
- Audit log, meaning access to financial data and key account events, including the name of an institution you connected. Prune keeps this for up to two years for security and fraud investigation.
These records include your email address, IP address, and browser user-agent. They do not include your transaction history, your account balances, or the access tokens that connected Prune to your bank, all of which are deleted.
Some retained records contain information derived from your financial data, and Prune states that rather than leave it out. A retained email subject line can name a subscription and its price, for example a message about a detected subscription. The audit log records the name of the bank or card provider you connected. Where a subject line is not needed to prove a notice was sent, Prune removes or redacts the merchant name and amount after the delivery is recorded.
8. Your rights and choices
Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, and to object to or restrict certain processing. You can exercise many of these directly in the app (disconnect an account, delete your account) or by contacting us at hello@prunemoney.com. You can opt out of the de-identified insights feature at any time in your account settings, and opting out stops Prune from using your information in those insights going forward.
California residents: you can ask to access, correct, or delete your personal information, and Prune does not discriminate against you for asking. Prune does not sell or share your personal information as those terms are defined under California law. Prune provides the automatic-renewal and online-privacy disclosures California law requires, regardless of the CCPA thresholds.
Other states: to exercise a right available where you live, contact Prune at hello@prunemoney.com, and Prune will respond as applicable law requires.
Financial-privacy rules: because the Service handles financial information, additional federal financial-privacy rules may apply, and Prune will provide any notice those rules require.
9. Children's privacy
The Service is not directed to, and we do not knowingly collect information from, individuals under 18. The Service is intended for people 18 and older. Prune does not knowingly collect information from a child under 13, and if Prune learns it has, Prune deletes it promptly. If someone under 18 provides information, Prune uses it only to tell them they are not eligible.
10. Changes to this Policy
This Policy shows a "Last updated" date, and Prune posts any change with a new date and notifies you of a material change before it takes effect.
11. Contact us
Questions about this Policy or your data: hello@prunemoney.com · Faster Sloths, Inc., 1930 18th St NW, Suite B2, Washington, DC 20009.