Skip to main content
Last updated 22 October 2026. Two features send some of your information to a third-party model provider: Chat, and the sorting of a linked bank’s new kinds of transaction into your categories. Both run only after you turn on AI features. This page states precisely what goes, what stays, and what happens to it, because “we use AI” is not a disclosure.

​
Who processes it

The model is Claude, provided by Anthropic PBC in the United States. Anthropic acts as our processor for these features. Under Anthropic’s commercial terms, Anthropic does not train its models on data sent through its API, and prompt and response content sent to the messages endpoint is not retained by default once the response has been returned. Anthropic may retain content that its automated trust-and-safety systems flag, or where retention is required by law. See Anthropic’s privacy policy and their API data-retention documentation.

​
You are asked first

The first time you ask Chat a question, it asks you to turn on AI features, in the place the answer would be. The request names Anthropic and lists what is sent. Nothing reaches Anthropic until you agree. Your choice is kept with your account, so it holds on the phone and on the web. Turning on AI features is never a condition of subscribing, and subscribing never turns it on. You can turn it off at any time in Settings on the phone, or in Profile and settings on the web. Once it’s off, Chat stops sending anything, and your banks’ new transactions are sorted without the model.

​
What Chat sends

Chat looks up what each question needs. With every question, it sends your question and a short orientation; then, as the question needs them, the results of its lookups. So the names you’ve given your accounts, categories, sources and plans are sent, and so are individual transactions when a question needs them, with their notes and amounts. The space’s books include what anyone sharing the space has recorded. We say so plainly rather than implying the model sees only anonymous totals. When Chat proposes a change, the change is worked out and checked by Recontrol, and the confirm card is drawn by the app, not the model. Confirming it sends nothing to Anthropic.

​
What sorting sends

When a bank you linked brings a kind of transaction your space hasn’t seen before, and Recontrol can’t place it from your own history or your category names, it may ask the model to choose among your space’s categories. It sends:
  • the names of your space’s categories;
  • the bank’s category for the transaction, in words;
  • up to three merchant names.
It never sends an amount, a note, or anything that identifies you. It runs only if the person who linked the bank has turned on AI features; nobody else’s choice stands in for theirs. An answer that isn’t one of your own categories is ignored.

​
What is never sent

  • Your name, email address, or phone number
  • Account numbers, including the last four digits imported from a bank
  • Bank or brokerage credentials, which we never hold in the first place
  • Individual investment holdings: security names, quantities and prices. A connected brokerage account appears to Chat as an account with a balance
  • Anything from another space. Chat reads only the space you’re in

​
What we keep

We store the text of your Chat question and whether the exchange succeeded, in our own database, attributed to your account. We do not store the answer, and we do not store the figures that were sent with it. There is no server-side transcript. The conversation you see lives on your device only, for that session. Your questions are deleted when you delete your account, and you may ask us to erase them at any time by emailing support@recontrol.money.
Question text is kept in our own database and is never sent to our analytics provider. Our analytics never include free text of any kind. See What we store.

​
Voice input

If you ask by voice on the phone, the audio is transcribed by your device’s own speech recognition: Apple’s on iPhone, Google’s on Android. On the web, it’s your browser’s speech recognition. Whether that happens on the device or on the provider’s servers is decided by the platform and varies by language and device; Recontrol doesn’t control it. To help the recogniser with names it would otherwise mangle, the phone app supplies your institution and account names to it as vocabulary hints while the microphone is open. The microphone is active only while you’re dictating, and a dictated question waits for you to send it. Recontrol does not record, store, or transmit audio.

​
Guardrails

  • The model does no arithmetic. Every figure in an answer must come from what Recontrol computed. It’s instructed to say it doesn’t have a figure rather than invent one.
  • The model can’t change anything by itself. It can only propose a change, which the app shows you on a card. Nothing is saved unless you confirm it, and a confirmed change is made under your own permissions. Chat can’t connect or disconnect banks, change members, roles or invitations, delete a space or your account, or touch a subscription.
  • Your data is not treated as instructions. Text inside your books, such as an account name or a transaction’s note, is passed to the model as data, explicitly delimited, with an instruction that it’s never a command. A defence against prompt injection.
  • No investment advice. Chat never evaluates, ranks or recommends a security. Recontrol does not provide investment advice, and Chat is not an adviser.
  • Your own permissions apply. Everything Chat reads is read under your own identity, so it contains only what your role in that space already lets you see.

​
Your own AI tool

On the web, Your AI tool lets you connect an AI tool you use, such as Claude or ChatGPT, to your books. That connection is yours: you set it up in your tool, it reads what you can see in your spaces when you ask it to, and the figures it reads go to your AI tool’s provider, under your agreement with them. Remove Recontrol in your tool’s settings to stop it. See Your AI tool.