Privacy Policy

1. Introduction & Scope

This Privacy Policy describes how Angel Gate Solutions, LLC ("we," "us") collects, uses, shares, and protects personal information in connection with Twin Leaf, our personal budgeting web application at twinleaf-app.web.app (the "Service"). It applies to people who sign in to or use the Service, visitors to its public pages, and anyone who contacts us about it.

It is incorporated into our Terms of Service. Our Cookie & Local Storage Notice, Security & Data Protection page, and Account & Data Deletion page give more detail and form part of this Policy. Other Angel Gate Solutions products have their own policies.

2. Who Is Responsible

For people in the European Economic Area, Switzerland, or the United Kingdom, Angel Gate Solutions, LLC is the controller of the personal data described here. We have not appointed an EU or UK representative because the Service is directed to people in the United States; you may contact us directly.

3. What We Can and Cannot See

When you set up Twin Leaf, your browser creates a random data key and uses it to encrypt everything you add — transactions, accounts, balances, bills, budgets, goals, rules, notes, paycheck details, holdings, and settings — on your device, before it is stored. The data key is stored only in wrapped (encrypted) form that opens with your passcode (which also needs a counted answer from our key service for every guess) or with your recovery code. We do not receive your passcode, your recovery code, or your data key.

4. Categories of Personal Information We Collect

The table below lists the categories of personal information we collect, their sources, why we use them, and to whom we disclose them. We provide it in the format used by the California Consumer Privacy Act and similar state laws, whether or not those laws apply to us (Section 16).

Weekly savings reflections. Once a week, Ask Twin Leaf asks what you did that saved you money. Your answer is read on your device by matching keywords and compared with your own transactions there, to give an estimate; the answer is not sent anywhere to be read: not to our key service, and not to any AI, including Groq. Nothing about it is kept unless you choose "Save reflections" when the app asks (once), or turn on Settings › Reflection Saving. With it on, each reflection is encrypted on your device and then saved with the rest of your encrypted data in Cloud Firestore: your own words (with anything that looks like a card or account number removed first), the habit it matched, the merchant names involved, the estimated amounts and how confident the estimate is, and the date. Like the rest of your data, we do not see their contents in the ordinary course (Section 3). The app keeps the newest 100. With it off, reflections are still answered but nothing is stored, on our side or in your browser's storage. The only record when it is off is, inside your encrypted settings, your choice and the week the question was last asked, so it is asked only once a week. You can delete saved reflections in Settings at any time; they are also deleted by Erase my data and when you delete your Account.

We do not collect bank or card login credentials, full account or card numbers, Social Security numbers, government ID numbers, precise geolocation, contacts, biometric or genetic data, or health information. You could choose to type such information into a note; like all your financial data, it would be encrypted on your device.

5. Sensitive Personal Information

Pay statement PDFs. When you check a pay statement PDF, your browser reads it on your device. The file is never uploaded to us or to any other service, and it is not saved. The check compares the figures on that one statement with each other and shows you the result; the check result is not kept. If you instead type or paste a statement's figures, those figures are saved encrypted on your device with the rest of your data. The employer name is not saved. Each deposit is linked to the bank account it went into, and the account number shown on the statement is used only to find that account and is not kept. The first pasted statement also teaches Twin Leaf your state tax rate and year-to-date pay; that profile is saved encrypted and holds no employer name or account number.

Your answers about each job. For each job, you can say whether it pays overtime, holidays, and holidays you take off. These answers are saved encrypted on your device with the rest of your data. If a saved statement shows a holiday or overtime line paid, Twin Leaf asks which job it came from; choosing "Not sure" stops the question for that statement.

Your financial information may be sensitive personal information under some laws. We store it only in encrypted form and use it for one purpose: storing it so that you can use the Service. We do not use or disclose sensitive personal information to infer characteristics about you. We do not sell sensitive personal information, including under the Florida Digital Bill of Rights (Fla. Stat. § 501.715) and the Texas Data Privacy and Security Act.

6. How We Collect Information

7. How We Use Information

We use the limited personal information we can access only to:

• create and authenticate your Account and keep you signed in;
• store, synchronize, and serve your encrypted data to your devices;
• answer your passcode-lock requests, count attempts and slow down passcode guessing, and check with Google that your sign-in session has not been revoked;
• protect the Service against fraud, abuse, attacks, and quota exhaustion, including by rate limiting and by diagnosing faults on our server;
• respond to your requests, provide support, and send essential notices about your Account, our policies, or security;
• comply with law, enforce our Terms, and establish, exercise, or defend legal claims; and
• maintain the reliability of the Service using aggregate operational measures (for example, total storage used); and
• only if you turn on app performance and error reports, find slow pages and crashes and measure whether fixes work (Section 9B); and
• only if you turn on Help improve Twin Leaf, fix mistakes and improve Twin Leaf's categories, forecasts, budgets and plans using the de-identified transactions you share (Section 9A).

8. Legal Basis for Processing (GDPR / UK GDPR)

Where we rely on legitimate interests, you may object at any time (Section 16).

9. AI Features (Coach Plus)

When you ask the chat a typed question, your device decrypts the small summary that question needs and sends it, with your question, over an encrypted connection to our key service, which forwards it to Groq, Inc. (our processor, through its business API) and returns the answer. Specifically:

• What is sent: your question; the current date; the category list; and only the slices of your data that the question needs, chosen on your device by topic: for example totals and top categories for a spending question, cards with balances, rates and minimums for a debt question, upcoming bills for a bills question, the coach's notes, and a few relevant recent transactions (date, merchant name, amount, category) when the question is about specific charges. Never your full history, account numbers, notes, or sign-in details. The app shows which topics were used under each answer.
• Retention: Twin Leaf stores no question, summary, or answer; our server holds them in memory while the request runs. Our log line for a request records only the route, result, and duration. The only record is a daily count per member (filed under a keyed tag, not your user ID) used to enforce the limits (currently 5 questions per member per day), which resets daily.
• Groq: our account is set to Groq's zero-data-retention mode, and we have chosen not to allow our data to be used to train models. Groq processes the request under its business terms and privacy policy and may handle it on its own infrastructure and providers in the United States or elsewhere. See Groq's published terms.
• Consent: the app asks for your explicit agreement before your first request and records it in your encrypted settings. You can withdraw it at any time in Settings; nothing is sent while it is off.
• Actions: if the AI proposes adding a transaction, bill, or budget, nothing is saved until you press Confirm; saving happens on your device, encrypted.
• Crisis and hardship: if what you type suggests you are in crisis, the app shows support information and sends nothing to the AI.

AI plan review. After the app builds a budget for you on your device, you can ask for a one-time AI review of it: one per account for free accounts, and up to one each calendar month for Coach Plus members. It works like the chat, under the same agreement, processor and settings, with these differences:

• What is sent: the plan the app built: each budget category with its name, your usual monthly spending, the proposed amount and its allowed range, the reason the app gave, and up to eight merchants behind it (name, usual monthly amount, number of visits); the one small regular treat the plan keeps for you, if it found or you chose one (its name, budget category, usual and kept monthly amounts, visits a week and average cost); subscriptions the app suggests cancelling (merchant, monthly cost, reason); the plan's totals (income, bills, minimum payments, amount budgeted, money freed, the extra going to debt, the monthly cushion savings) and its estimated effect on your debts (months sooner, interest saved, when the cushion is built); your debts (name, balance, interest rate, minimum payment, next due date, recent late fees); any support note the app added; and three household facts (household size, the dates of your next paydays, whether you usually run short before payday). Never individual transactions, account numbers, notes, or sign-in details.
• Retention: our server stores no plan and no review. To enforce the limit we keep only when you last used the review (and a daily total for all users), filed under a tag derived from your user ID with our server key; clearing your browser does not reset it. A review that fails does not count. The review you get back is saved in your own settings, encrypted on your device like the rest of your data (Section 3), so you can open your 30-day plan again; we do not see its contents in the ordinary course, and deleting your Account deletes it.
• Output: a short note on why the plan works for you, a dated checklist for the next 30 days (such as which card to pay by its due date), and optional suggestions (cheaper swaps, budget changes within the plan's own ranges). Our server checks every step and suggestion against your plan and drops any that fall outside it, including dates outside the next 31 days, amounts above what the plan shows, and merchants or debts that are not in it. No budget changes unless you choose to apply them.

We do not use your data to train models, we do not sell it, and we do not use a personal or consumer AI subscription for this feature. AI answers can be wrong and are Estimates (see the Financial Disclaimer).

9A. Help Improve Twin Leaf (Optional Data Sharing)

• What is shared: for each transaction, its date, amount, whether money went in or out, the merchant and the bank's description (cleaned), Twin Leaf's category and the bank's category label, the account type only (checking, savings, credit, loan, investment or other), and whether it is pending, recurring or a transfer.
• What is never shared: your name, email, sign-in identifiers or user ID; account names, numbers, masks and your bank's name; your notes, tags, renames and the names of categories you created; the other person's name in person-to-person payments (Zelle, Venmo, Cash App, Apple Cash, PayPal), which are sent only as "Person-to-person transfer"; anything that looks like an account or phone number or an email address; hidden transactions; and anything you exclude.
• De-identified, not anonymous: this is done on your device before anything leaves it, and the data is filed under a random donor number, not your account; the link between the two exists only in your own encrypted settings. But dates, amounts and merchants together can sometimes identify a person. Medical, personal care and government & giving transactions are left out unless you include them, and you can exclude any category or transaction.
• Who can see it: only Twin Leaf's developers, on our own server (our key service); it is not stored with Google or any other provider.
• Use: fixing mistakes and improving Twin Leaf's categories, forecasts, budgets and plans. Never sold, never used for advertising, never sent to an AI service, and never used to train a third-party AI model.
• Retention and deletion: until you turn the setting off, use Erase my data, or delete your Account, each of which deletes it; a copy your device could not delete (for example after deleting your Account from the lock screen) is deleted automatically 12 months after its last update.

9B. App Performance & Error Reports (Optional)

• What is sent: how long the app took to load and draw a page (in milliseconds); counts of which screens you opened (for example "budgets: 3"); for an app error, its type, a short message and code location with emails, dollar amounts, long numbers and web-address queries removed on your device and again on our server, and the page name; the app version; and your device class (phone, tablet or computer), browser and operating system.
• What is never sent: your name, email, user ID or IP address with the report; amounts, balances, account numbers or merchant names; anything you typed; anything decrypted. Our server accepts only the fields and values on a fixed list and refuses everything else.
• Anonymous by design: each report is added to a daily total on our server and is not kept as a separate record. We keep no user ID or tag with it (a temporary in-memory tag limits how often one account can send, and is never written to disk), so we cannot find or delete one person's reports afterwards; turning the setting off stops anything further from being collected or sent.
• Who can see it: only Twin Leaf's developers, on our own server. It is not sent to Google Analytics or any other analytics company. Never sold, never used for advertising.
• Retention: daily totals are deleted 12 months after their day.
• Feedback: when you send us a problem or idea from the app, you may tick "Include diagnostics" to attach the same kind of summary. You see the exact text before you send it, and it is kept with the ticket (Section 13.2).

9C. Bank Connections Through Plaid (Not Available Yet)

• Optional. You choose to connect a bank, you can disconnect it at any time, and Twin Leaf works without it. It may be part of the paid Coach Plus membership.
• Plaid Link. You sign in to your bank inside Plaid's window. Your bank username and password go to Plaid and your bank; Twin Leaf never sees or stores them. By using Plaid Link you also agree to the Plaid End User Privacy Policy, which describes what Plaid collects from your bank and how it uses it, and which governs Plaid's handling of your information. Plaid is an independent company, not a Twin Leaf processor for its own purposes.
• What Plaid sends us: account names, masks (last four digits), types and balances, and transactions (date, amount, merchant and description, category, pending status). We ask only for what Twin Leaf needs, and no more than your transaction history Plaid makes available.
• Access tokens stay on our server. Plaid gives our key service a token for each connection. It is stored encrypted on our server and is never sent to your browser, Firestore or our logs.
• A limit on the encryption promise. Transactions from Plaid reach our key service first, in readable form, because that is how Plaid delivers them. The server holds them only to hand them to your signed-in device, which then encrypts them like any other import before they are stored with Google. Until your device collects them (up to 30 days; then they are dropped and fetched again), our server could technically read them. This is different from data you import yourself, which never leaves your device unencrypted. We do not look at it, use it for any other purpose, or share it.
• Disconnect and deletion. Disconnecting a bank asks Plaid to remove the connection and deletes our token, sync position and any transactions waiting for your device. Erase my data and Delete my account disconnect every bank first. Transactions already saved in your encrypted data are deleted like the rest of it. Plaid keeps its own copy under its own policy and retention; you can ask Plaid to delete it through Plaid's privacy channels.
• Duplicates. A bank transaction that matches one you already imported or entered is skipped; yours stays as you left it.
• Broken connections. If your bank needs you to sign in again, Twin Leaf shows a reconnect prompt and stops syncing that bank until you do.
• No selling. We do not sell bank data, use it for advertising, send it to an AI service without your separate agreement, or use it for any purpose other than showing you your own money.

9D. Email Connection (Gmail): Optional

The email connection lets Twin Leaf read receipt, payment and bank-alert emails in your Gmail so it can suggest charges, deposits and account balances you may not have imported, notice duplicates, work out which of your accounts a charge belongs to, and compare the balances your bank's emails state with the balances worked out from your files. You review every suggestion before anything is saved.

Eligibility, your other rights and our contact details are in Sections 16 and 24. This section describes the Service as it works when the email connection is available to you.

10. Sharing, Disclosure & Service Providers

We share personal information only as described below. We do not sell it and do not share it for cross-context behavioral advertising.

11. Do Not Sell or Share

ANGEL GATE SOLUTIONS DOES NOT SELL OR SHARE PERSONAL INFORMATION COLLECTED THROUGH TWIN LEAF, AS THOSE TERMS ARE DEFINED UNDER THE CALIFORNIA CONSUMER PRIVACY ACT AND SIMILAR STATE LAWS, HAS NOT DONE SO, AND DOES NOT PROCESS PERSONAL INFORMATION FOR TARGETED ADVERTISING OR FOR PROFILING IN FURTHERANCE OF DECISIONS THAT PRODUCE LEGAL OR SIMILARLY SIGNIFICANT EFFECTS. WE HAVE NO ACTUAL KNOWLEDGE OF SELLING OR SHARING THE PERSONAL INFORMATION OF CONSUMERS UNDER 16.

12. Financial Privacy (Gramm-Leach-Bliley Act)

Some laws, including the Gramm-Leach-Bliley Act and the Federal Trade Commission's Privacy Rule (16 C.F.R. Part 313) and Safeguards Rule (16 C.F.R. Part 314), may treat a budgeting service like Twin Leaf as a "financial institution." We have not concluded that they apply to us, but we intend to act as if they do. To the extent they apply, this Policy is our privacy notice: we do not disclose nonpublic personal information about you to nonaffiliated third parties except to service providers that help us operate the Service, as permitted by law, or as required by law, so there is no opt-out to exercise. We protect the information we hold with the safeguards described in Section 14 and on our Security & Data Protection page, and Section 15 describes how we would notify the FTC of a security event.

13. Logs & Data Retention

14. Cookies, Local Storage & Data Security

15. Data Breach Notification

If we become aware of a breach of security affecting personal information we hold, we will:

• investigate, contain, and remediate it promptly;
• notify affected users as quickly as practicable and without unreasonable delay — for Florida residents, no later than 30 days after we determine a breach occurred, as Fla. Stat. § 501.171 requires — by email where we have an address and by a notice in the Service;
• notify the Florida Department of Legal Affairs within 30 days if 500 or more Florida residents are affected, and other state regulators as their laws require;
• to the extent the FTC Safeguards Rule applies to us, notify the Federal Trade Commission within 30 days of discovering an unauthorized acquisition of unencrypted customer information involving 500 or more consumers;
• notify regulators within 72 hours under GDPR Article 33 where it applies; and
• describe what happened, what information was involved, what we are doing, and what you can do.

Many breach laws do not treat encrypted data as breached unless the key or the means to decrypt it is also compromised. Because we hold the key service's secret, we will not rely on encryption alone: if an incident may have exposed both our database and that secret, we will treat data protected by short passcodes as potentially readable and notify accordingly. We will also tell you about any incident that affects Twin Leaf's security in a meaningful way, even where the law would not require it.

16. Your Privacy Rights

17. Automated Decision-Making & Profiling

Twin Leaf's money engine runs in your browser and calculates Estimates — such as your safe-to-spend amount, detected paydays and bills, and debt payoff plans — from your own data, for your own use. If you connect Gmail, its suggestions (possible charges, a guess at which account a charge belongs to, duplicate notes and balance comparisons) are produced the same way, on your device, and nothing is saved until you accept it. These are not decisions about you: they have no legal or similarly significant effect, we do not see them, and you can override them. We do not profile or score users. Automated security measures, such as rate limits and wrong-passcode lockouts, are temporary and lift automatically; you may contact us for human review of any security action that affects you.

18. Health Data & Other Special Laws

Twin Leaf is not designed to collect health information and is not a "covered entity" or "business associate" under HIPAA. It is not intended to collect consumer health data within the meaning of Washington's My Health My Data Act or similar laws. If you label a transaction in a way that reveals health information, that label is encrypted on your device.

19. Government Access & Law Enforcement

20. Children's Privacy

Twin Leaf is intended only for adults 18 and older and is not directed to children. We do not knowingly collect personal information from anyone under 18. If we learn that a child under 13 (or anyone under 18) has created an Account, we will delete the Account and its data. If you are a parent or guardian and believe your child has created an Account, contact support@angelgatesolutions.com.

21. International Users & Data Transfers

Angel Gate Solutions is based in the United States, Twin Leaf is directed to people in the United States, and information is stored and processed in the United States (and, for website delivery, sign-in, connection routing, and email, on our providers' global infrastructure). If you use the Service from outside the United States, your information will be transferred to the United States, which may not provide the same level of protection as your home country. Where the GDPR or UK GDPR applies, transfers rely on the necessity of the transfer to provide the Service you request (GDPR Art. 49(1)(b)) and, for our service providers, on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) or Standard Contractual Clauses, as each provider makes available.

22. Third-Party Services & Links

Apple and Google process information about your sign-in under their own privacy policies. If bank connections are offered, Plaid processes your bank data under the Plaid End User Privacy Policy (Section 9C). Files you export from other services (such as your bank or Rocket Money) are governed by those services' policies. This Policy does not apply to third-party websites or services that the Service links to.

23. Changes to This Privacy Policy

We may update this Policy to reflect changes in the Service, our practices, or the law. For material changes, we will post a notice in the Service and ask you to review the updated Policy, email you where we have your address, and update the "Last updated" date. Material changes that reduce your privacy protections take effect at least 14 days after we post them, and we will obtain your consent where the law requires, including before using previously collected information in a materially different way. Non-material changes take effect when posted. If you do not agree to an updated Policy, you may delete your Account.

24. Contact

If you have questions, concerns, complaints, or requests about this Privacy Policy, contact us: