Privacy Policy

Effective October 29, 2026

Northbound Wallet is operated by Northbound Commerce (“we,” “us,” or “our”). This notice explains how we handle information when you visit our website or use our money-management app. Questions and privacy requests can be sent to [email protected].

Information we collect

• Account information: your sign-in email, name and profile details you provide, user ID, email-verification status, and authentication information handled through Google Firebase Authentication. If you choose Google sign-in, Google shares the profile information authorized during that process.
• Your financial workspace: balances, transactions, income and expense entries, budgets, bills, debt, savings goals, credit-card details, credit scores you enter, and preferences you choose to save. You decide what to enter. Do not enter bank passwords, full payment-card numbers, Social Security numbers, or other unnecessary sensitive identifiers into notes or financial records.
• Technical information: hosting and authentication providers may process IP addresses, browser and device information, request times, authentication events, and error or security logs needed to deliver and protect the service.
• Support communications: information you send when requesting assistance. Please avoid emailing passwords, bank credentials, or payment-card details.

How we use information

We use information to create and secure your account, save and display your workspace, calculate the estimates and progress you request, support your use of the app, troubleshoot problems, prevent abuse, and meet applicable legal obligations. Estimates depend on the information entered and do not guarantee financial results.

Who processes information

We use Google Firebase for authentication and database services and Vercel for website hosting and server functionality. These providers process information necessary to perform those services. Authorized operators may access information when needed for support, security, maintenance, or legal obligations. Authentication and infrastructure providers also have their own privacy notices: Google and Vercel.

The current app has no advertising-pixel integration or data-sale feature. We do not sell your personal information or share your financial workspace with advertisers. We may disclose information when reasonably necessary to comply with law or valid legal process, protect users or the service, or complete a business transfer subject to applicable privacy obligations.

Payments and planned bank connections

Subscription checkout and automatic bank syncing are not active at the effective date of this notice. Creating an account does not start a subscription or charge. Stripe is being configured for billing; payment details entered into a future Stripe-hosted checkout will be processed by Stripe. The app will receive billing identifiers and subscription status rather than your full card number. See Stripe’s privacy notice.

We plan to use Stripe Financial Connections for optional bank connections. Before this feature becomes available, we will explain the data requested and provide a consent flow. The planned purpose is to retrieve balances and transactions for budgeting and spending tools, not to initiate transfers or make lending decisions. No bank information is currently imported through this integration. We will update this notice and provide connection and disconnection controls before launching it. Live credit monitoring and partner sharing are also not active.

Device storage and tracking

Firebase and the app may use browser storage, cookies, or similar technologies for sign-in, session continuity, and app preferences. You can manage browser storage in your browser settings; clearing it may sign you out or reset local preferences. The app does not currently use cross-site advertising tracking. It does not change its behavior in response to a browser Do Not Track signal.

Storage, security, and retention

The current Firestore database is located in the United States. Hosting, authentication, support, and service-provider processing may involve other locations under the providers’ terms; this notice does not promise exclusive U.S. processing. We use authenticated access and database access rules to restrict private workspaces. No online service can guarantee absolute security.

Workspace information is retained while needed to provide your account and features, unless you delete it. Limited logs, backups, support records, or records required for security, dispute resolution, or legal obligations may remain after account deletion under applicable provider retention practices. We do not promise immediate deletion from every backup or provider system.

Your choices and requests

You can review and edit your entries in the app. Settings provides export and account-deletion controls; deletion may require a recent sign-in. Save an export before deleting your workspace. For access, correction, deletion, or other privacy rights that apply where you live, email [email protected]. We may need to verify your identity and will handle requests subject to applicable law and necessary exceptions. Do not send identity documents unless we establish an appropriate secure process.

Children

The service is intended for adults and is not directed to children under 13. If you believe a child under 13 has provided personal information, contact us so we can investigate and address it.

Changes to this notice

We will update the effective date when this notice changes. Material changes to how we use financial information will be communicated through the app or another appropriate channel before taking effect, with additional consent where required.