Help Improve Twin Leaf: Data Sharing Notice

1. What It Is

"Help improve Twin Leaf" is an optional setting in Settings. When it is on, your device sends a de-identified copy of your transactions to Angel Gate Solutions, LLC ("we," "us") so our developers can see where Twin Leaf gets things wrong, such as a miscategorized purchase, a missed bill or a bad forecast, and fix it.

It is off by default. Turning it on shows a short consent sheet; nothing is sent unless you choose Share. You can turn it off at any time, and doing so deletes what you shared (Section 8). Not sharing changes nothing else about Twin Leaf.

Ordinarily your financial data is encrypted on your device before it is stored, and we do not see its contents (Security). This setting is the one exception you can choose: it sends decrypted, de-identified transactions, and only while it is on.

2. Exactly What Is Shared

For each transaction that is not excluded (Section 5), your device sends these fields and nothing else. Our server checks every field against this list and refuses anything else, so even a faulty app version cannot send more.

Once per donation (not per transaction), your device also sends these, and only these:

The set is replaced each time it is sent: after an import or a change, at most every few minutes, and at least monthly while the setting is on. At most the newest 20,000 transactions are sent.

3. What Is Never Shared

• Your name, email address, Apple or Google identifiers, or Twin Leaf user ID.
• Account names, account numbers, card numbers, masks (such as the last four digits), and your bank's or institution's name.
• Your notes, tags, receipt details, names you gave transactions, and the names of categories you created.
• The name of the other person in a Zelle, Venmo, Cash App, Apple Cash or PayPal payment: the whole merchant and description read "Person-to-person transfer."
• Balances, budgets, goals, bills, paycheck details, holdings, reflections, and the coach's notes.
• Anything that came from your email: charges, deposits or balances you accepted from Gmail are never shared, and neither is anything learned from your email. Your device marks them so this feature skips them.
• Transactions you hid from reports, transactions you marked "Don't share this one," and categories you excluded.
• Your IP address alongside the data: our server does not store it with shared data, and the log line for a sharing request carries no account tag.

4. How It Is De-identified, and Its Limits

De-identification happens on your device, before anything leaves it:

• Only the fields in Section 2 are built; everything else is left behind.
• Person-to-person payments are replaced by "Person-to-person transfer."
• Anything that looks like an account, card or phone number (a run of four or more digits), an email address, a masked number, or a labelled personal field in bank text (for example "INDN: name") is removed or replaced with "#".
• Your own name, as it appears in your sign-in and in Twin Leaf's settings, is removed from merchant and description text.
• The data is filed under a random donor number created on your device. It is not your user ID, and the link between the two exists only in your own encrypted settings (Section 6).

5. Choosing What to Share

• Per category. In Settings › Help improve Twin Leaf › Categories not shared, tick any category to keep it on your device. Medical, Personal care and Government & giving are ticked for you.
• Per transaction. Open a transaction and tick "Don't share this one."
• Hidden transactions are never shared.

Your choices are kept in your encrypted settings. A transaction or category you exclude after it was shared is removed from our copy the next time your device sends the set, within minutes when our server can be reached.

6. Who Can See It, and Where It Is Kept

Shared data is stored on Twin Leaf's key service, a server operated by Angel Gate Solutions at a private location in the United States, in files readable only by that service, filed under the random donor number. It is not stored in Google's database or with any other provider. Connections to it travel over an encrypted connection routed by Tailscale (see the Privacy Policy).

It can be read only by Twin Leaf's developers: accounts on a developer list kept on that server, and the owner's administrative tools on the server itself. Every other account is refused. We do not disclose it to anyone else except as described under Legal Requirements in the Privacy Policy.

The server keeps only a one-way hash of the secret your device uses to delete the data. To prevent abuse it checks that a request comes from a signed-in Twin Leaf account and limits how often it can send, using a temporary tag held only in memory; it does not store your user ID, email or IP address with the data.

7. What We Use It For

• Fixing mistakes: miscategorized transactions, missed or wrong bills, duplicates, and import errors.
• Improving Twin Leaf's categories, merchant recognition, forecasts, budgets and plans.
• Counting and testing, for example checking a change against real-world bank text before it ships.

We never sell shared data, never use it for advertising or marketing, never use it to contact you, never send it to an AI service, and never use it to train a third-party AI model. We do not try to re-identify anyone. If we publish anything learned from it, it will be aggregate statistics that cannot identify you.

8. Retention and Deletion

Because the data is filed under a random number rather than your account, we cannot find it from your name or email. To delete it, turn the setting off.

9. Security

• Sent only over encrypted connections, only from Twin Leaf's own web address, and only with a valid sign-in.
• Stored in files with owner-only permissions on a server that holds no other copy of your financial data.
• Checked field by field on arrival; anything outside the list in Section 2 is refused.
• Uploads are capped in size and rate-limited.
• Requests to read it are refused unless they come from a developer account or the server's own administrative tools.

The limits on our Security page apply: in particular, people who hold our server's credentials could read shared data, which is one more reason it carries no names or numbers.

10. App Performance & Error Reports (a Separate Setting)

Settings › Privacy & data also has App performance and errors, off by default and independent of the setting above. It sends no transactions. Turning it on shows a consent sheet; nothing is collected or sent before you choose Turn on.

Never: your name, email, user ID or IP address with it; amounts, balances, account numbers, merchants, notes or anything you typed or that was decrypted. Error text has emails, dollar amounts, runs of four or more digits and web-address queries removed on your device, and again on our server. The server accepts only the fields and values on a fixed list and refuses anything else.

Anonymous and aggregated. Each report is added to a daily total the moment it arrives. We keep no user ID or tag with it; a temporary in-memory tag only limits how often one account can send. That means we cannot find or delete one person's reports later, and turning the setting off stops new ones. Only Twin Leaf's developers can read the totals. They are never sold, used for advertising or sent to an analytics company. Daily totals are deleted 12 months after their day.

Send feedback. When you send a problem or idea from the app, you may tick "Include diagnostics" to attach a short summary (app version, device class, browser, page name, load times and the last few scrubbed errors). You see the exact text before sending. It is stored with the ticket and deleted with it.

11. Changes

If we change what is shared, who can see it, or what it is used for, we will update this Notice and its "Last updated" date, and ask again in the app before sharing more than you agreed to.

12. Contact

Questions about sharing: support@angelgatesolutions.com.