Privacy Policy

Last updated October 30, 2026

Nosy ("we", "us") is a personal finance application that shows you your accounts, transactions and investments in one place. This policy explains what data we collect, how we use it, and the choices you have.

Information we collect

• Financial data, via Plaid. When you link an institution through Plaid Technologies, Inc., we receive account names, types, masked account numbers, balances, transactions (up to 24 months of history and ongoing updates), payments we detect as recurring and, if you choose, investment holdings and activity, plus credit card, loan and mortgage details such as rates, payments and due dates. We never receive your bank username or password.
• Account data. Your email address, which is how you sign in, and the date you agreed to this policy.
• Technical data. Standard server logs (IP address, request time, errors) kept for security and troubleshooting.

If you import a Copilot export, the file is read in your browser. We keep only merchant names and how you filed them.

How we use it

Only to provide the app to you: displaying balances, sorting transactions into buckets, setting budgets, and summarizing spending, recurring payments, debts, cash flow and investments. We do not sell your data, share it with advertisers or data brokers, or use it for any purpose unrelated to the app.

Consent

We ask for your explicit consent before you link your first account, and again whenever this policy changes materially. You can withdraw consent at any time by disconnecting your institutions or deleting your data in Settings.

Sharing

We share data only with service providers needed to run the app: Plaid (to connect your accounts; see the Plaid End User Privacy Policy) and Amazon Web Services (hosting, storage and sending sign-in emails). We may disclose data if required by law.

To sort your transactions into budget buckets, we send merchant names, the category from the bank feed and whether money went in or out to Anthropic's Claude AI model, running on Amazon Bedrock. We don't send amounts, account names or account numbers.

Security

• All traffic uses HTTPS (TLS 1.2 or higher).
• Data at rest is encrypted with AES-256 using AWS KMS keys; Plaid access tokens are additionally encrypted at the application layer.
• Sign-in requires a one-time code sent to your email, and no account can be linked without it.
• Access to production systems is limited to the operator. Signing in to the cloud console requires multi-factor authentication.

Retention and deletion

• We keep your financial data only while your institution is connected.
• When you disconnect an institution, we revoke our Plaid access and immediately delete all the data we hold for it.
• "Delete all my data" in Settings revokes every connection and permanently erases all financial data at once.
• If you revoke access through Plaid (for example at my.plaid.com), we delete the associated data when Plaid notifies us.
• Server logs are kept for up to 30 days. Deleted data may persist in encrypted AWS infrastructure for a short period until it is overwritten.

This policy and our retention practices are reviewed at least once a year and whenever we change how we handle data.

Your rights

You can access, correct, export or delete your data, and you may have additional rights under laws such as the CCPA. Most of this you can do yourself in the app; for anything else, contact us.

Contact

Questions or requests: use the contact details provided with your account.