What we store

Last updated 23 October 2026.

Data you provide directly

Data	Details	Why
Email address	From the Google or Apple account you sign in with, or the address you sign in with	Account creation and authentication
Display name	From your sign-in, and changeable in your profile	Identifying you within shared spaces
Sign-in	You sign in with Google, Apple or your email: a six-digit code sent to your address, or a password where your account has one. A password is kept only as a one-way hash we can’t read	Authentication
Phone number	Optional	Inviting members to a space by phone
Accounts, categories and sources	Their names, classes and currencies	Core functionality
Transaction data	Amounts, notes, days, and the From and To accounts	Core functionality
Plans and alerts	Budgets, goals and watchlists: their names, amounts, dates, accounts and your own planning figures; and the alerts set on them and on accounts	Planning, and telling the space what you asked to be told
Space names	Names of spaces you create or join	Collaborative workspace management
Reporting currency	The display currency for each space. Defaulted from your device’s region when a space is created, and changeable in-app	Display formatting and conversion
Chat questions	The text of questions you ask in Chat, never the answers	Understanding which questions people ask so we can build them into the product
Feedback	What you send with Send Feedback: its type, your message, whether you’d like a reply, the space you were in, and, if Include Diagnostics is on, the app’s version, your device or browser platform, and the screen it was sent from. Never anything about your money	Fixing problems and deciding what to build
Support messages	Emails you send to support@recontrol.money	Customer support

Data collected automatically

Data	Details	Why
Authentication tokens	JWT access tokens and refresh tokens	Session management
Session identifiers	Login timestamps and session IDs	Security
Country / region	A two-letter country code from your device’s region setting at sign-up (not GPS); omitted if unavailable	Establishing your country/region for regional privacy rights and defaults
Device push token	An Expo push token, device name, and platform, once your phone allows notifications	Sending notifications
Notifications	What Recontrol has told you, and whether you’ve read it	Your notifications inbox
Subscription status	Whether you hold a subscription and when it renews or expires, an anonymous customer identifier issued by our billing provider, your monthly Chat usage count, and which spaces you have chosen to sponsor	Unlocking paid features and enforcing fair-use limits
Product analytics	Pseudonymous usage events and device/app metadata via PostHog, never your name, email, or financial data. On the phone, on with a switch to turn it off; on the web, off in the EEA and the UK until you turn it on	Improving the app
Crash and error reports	Uncaught app errors and native crashes via PostHog, with the error type and code locations only; messages and runtime values are stripped before sending. Covered by the same switch as analytics	Fixing bugs
Basic request metadata	IP address, user-agent string, request timestamps, seen by our API and, for the web app, by Vercel	Server operation, security monitoring, debugging
Server-side telemetry	Traces, metrics and logs from our API: timings, error rates, route names, and opaque internal identifiers such as your user ID. Never names, amounts, balances, emails, or free text	Infrastructure monitoring and debugging

Analytics is limited and optional. Recontrol uses one product-analytics tool, PostHog (US cloud). It records pseudonymous usage events and crash reports to help us improve the app, and never receives your financial data, name, or email. You can turn it off in Settings on the phone, or in Profile and settings on the web, and it is disabled entirely on development builds. We use no advertising SDK and no cross-app tracking.

AI

Chat sends your question and the parts of the space’s books it needs to answer to Anthropic (Claude). When a bank you linked brings a kind of transaction your space hasn’t seen before, its merchant names and your category names may go to Anthropic to sort it, never its amount. Both happen only after you turn on AI features. We store your Chat question; we never store the answer, and there is no server-side conversation history. Exactly what is sent, what is never sent, and what Anthropic does with it is documented in AI and your data.

Data from connected institutions (optional)

If you choose to connect an external financial account, we import data from it on your behalf, with your consent. These connections are optional and inactive until you connect an account; adding accounts by hand is always available. We never receive your banking or brokerage login credentials.

Connection	What we import	Region
Plaid (banks)	Account names, types, last 4 digits of the account number, balances, currency, and up to 2 years of transactions (amount, date, description, merchant, pending status), plus your institution’s name. Where your bank reports them: an investment account’s holdings (each security’s name, quantity, price and value); a card’s or loan’s terms (last statement, minimum payment, due date, interest rate, whether a payment is overdue, and when a loan ends); and payments it has seen repeat (merchant, usual amount, how often, next expected date)	United States & Canada
Zerodha (Kite Connect)	Equity and mutual-fund holdings (ISIN, name, quantity, average price, last price, P&L) and your Zerodha user ID, name, and email	India

We store an access token for each connection so we can refresh your data. These tokens are encrypted at rest using AES-256-GCM, on top of the database’s own encryption. You can disconnect at any time, which revokes and deletes the token. See Security and Connections.

Subscriptions and payments

We never see, receive, or store your card or payment details. Purchases are made entirely inside the Apple App Store or Google Play. Your payment method belongs to your store account.

Purchases are processed by Apple or Google and reconciled through RevenueCat, our subscription-management provider. What reaches us is only: whether an active subscription exists, when it expires, and an opaque customer identifier. No card number, no billing address, no transaction amounts. RevenueCat receives an anonymous app user identifier, your device type and operating system, and the store’s own purchase receipt or token. It acts as our processor and stores that data in the United States.

Data we do not collect

Precise or GPS location. The phone records only the coarse country code from your device’s region setting at sign-up (see above). The web app reads the country Vercel derives from your IP address on each request, only to decide whether usage analytics start off, and doesn’t store it
Device contacts or address book
Photos or camera access
Advertising identifiers (IDFA or similar)
Your bank or brokerage login credentials (sign-in is handled by Plaid or Zerodha; we never see it)
Your card or payment details (handled entirely by Apple and Google)
Audio recordings. Voice questions are transcribed by your device’s or browser’s own speech recognition, and we receive only the resulting text
Biometric data (the optional app lock uses your device’s on-device biometrics; the data never reaches us)

Where your data lives

Changed 29 July 2026. Recontrol’s database moved from AWS ap-south-1 (Mumbai, India) to AWS us-east-1 (Northern Virginia, United States). Nothing about what we collect changed, only where it is stored. See the Privacy Policy.

Recontrol’s database is hosted on Amazon Web Services in the us-east-1 (Northern Virginia, United States) region, via Nhost. The data you enter, and the data we import on your behalf, is stored at rest in the United States. Our application/API server is also hosted in the United States (on Railway), so your data is processed in the same country it is stored in. The web app is served by Vercel. If you are outside the United States, including in Canada, India, or elsewhere, your data is stored and processed in the United States. We stay accountable for protecting it wherever it is processed. See the Privacy Policy for the full cross-border disclosure and your regional rights. Plaid processing: if you connect a bank using Plaid, your banking data is processed by Plaid on infrastructure in the United States before it reaches us. This only happens if you choose to connect a bank.

Third-party services

Service	Provider	What they receive	Purpose
Nhost	Nhost	Email, display name, phone number, sign-in identities, session tokens, financial data, and a password hash only for an account made with a password in an earlier version	Authentication, database hosting (PostgreSQL via Hasura)
AWS (via Nhost)	Amazon	All data stored in the database (encrypted at rest)	Cloud storage in Northern Virginia, United States
Railway	Railway	Data in transit through our API (processed, not stored)	Hosting our API server (United States)
Vercel	Vercel Inc.	The web app’s requests, including IP addresses, request logs, and data in transit through the web app’s own server, including your sign-in session	Hosting the web app at app.recontrol.money
Plaid	Plaid Inc.	Bank account and transaction data, only if you connect a bank	Bank-account aggregation (US/Canada)
Zerodha	Zerodha (Kite Connect)	Investment-holdings data, only if you connect Zerodha	Investment-holdings aggregation (India)
Anthropic	Anthropic PBC	Your Chat question and the parts of the space’s books it needs; for sorting, merchant names and your category names. Only after you turn on AI features	Writing Chat’s answers and sorting imported transactions (United States)
RevenueCat	RevenueCat, Inc.	An anonymous customer identifier, device type and OS, and the store purchase receipt, only if you subscribe	Subscription management (United States)
Apple / Google (payments)	Apple; Google	Your purchase and payment details, handled entirely by them; we receive none of it	Processing in-app purchases
Apple / Google (speech)	Apple; Google	Spoken audio and vocabulary hints, while a voice question is being dictated on the phone	Converting speech to text (on-device or provider-side, per platform)
Resend	Resend	Your email address and email content	Transactional email, such as space invitations and account-deletion confirmation (US)
Expo (push)	Expo → Apple/Google	Device push token and notification content, once your phone allows notifications	Push-notification delivery (US)
PostHog	PostHog	Pseudonymous usage events, crash reports and device metadata, no financial data; only while analytics are on	Product analytics and error tracking (US cloud)
Grafana Labs	Grafana Labs	Server-side traces, metrics and logs: opaque identifiers, timings and error codes; no names, amounts, or free text	Infrastructure monitoring (Grafana Cloud, United States)
exchangerate-api.com	ExchangeRate-API	Currency codes only, no personal data	Exchange rates
Apple / Google (sign-in)	Apple; Google	Your name and email, from the sign-in you choose	Authentication

We use no advertising services, cross-app tracking, social-media pixels, or data brokers. Our only analytics tool is PostHog (no financial data). If you connect your own AI tool on the web, what it reads goes to that tool’s provider at your direction. See AI and your data.

Storage on your device and in your browser

The phone app uses:

Expo Secure Store, which stores authentication tokens using iOS Keychain / Android Keystore. Not accessible to other apps.
AsyncStorage, which keeps session state and cached data locally.
PostHog local storage, while analytics are on: a pseudonymous identifier and a small event queue.
RevenueCat local cache: your subscription status, so the app knows what you have paid for without a network round trip.
Your Chat transcript, held in memory for the session only.

The web app uses:

One essential cookie, __Host-rctrl-session, which holds your sign-in, sealed and encrypted. Page scripts can’t read it, it’s sent only to app.recontrol.money, and it expires within a day of signing in.
Preference cookies for Appearance, money colours and the sidebar’s state.
Browser storage for preferences such as Hide amounts, the space you last opened, your analytics choice, recent search-box entries and the transaction views you save, and, for up to 30 minutes, the state of a bank or broker connection you’re in the middle of.
PostHog storage, only while analytics are on.
Your Chat transcript, held in memory for the session only. Your short-lived access token is held in memory too, never in storage.

None of this is used for advertising or cross-app tracking.

How long we keep it

Data type	Retention
Account and profile data	Until you delete your account
Financial data (accounts, transactions, plans)	Until you delete your account
Imported data (bank accounts, transactions, holdings)	Until you delete it or your account. Disconnecting stops new data and keeps what was imported
Integration access tokens	Until you disconnect or delete your account; Zerodha tokens also expire daily
Chat questions	Until you delete your account, or ask us to erase them. Answers are never stored
Feedback messages	Until you delete your account
Notifications	Until you delete your account
Subscription status and usage counters	Until you delete your account. Your monthly Chat usage counter resets on the 1st of each month
Authentication tokens	Short-lived; expire automatically. Invalidated on sign-out or deletion. The web’s session ends a day after sign-in at the latest
Session data	Duration of the active session
Server-side telemetry and operational logs	Up to 12 months, then deleted or anonymised. Not linked to individual user profiles
Support communications	Up to 24 months after last communication

See the Data Retention and Disposal Policy for full detail.

Who can see your data within shared spaces

When you join a shared space, other members of that space can see everything in it, such as its accounts, transactions and plans, according to their role. Your display name and email may also be visible to other members of any space you belong to. Data in one space is never visible to members of a different space.

Your data

Legal

Data you provide directly

Data collected automatically

AI

Data from connected institutions (optional)

Subscriptions and payments

Data we do not collect

Where your data lives

Third-party services

Storage on your device and in your browser

How long we keep it

Who can see your data within shared spaces

​Data you provide directly

​Data collected automatically

​AI

​Data from connected institutions (optional)

​Subscriptions and payments

​Data we do not collect

​Where your data lives

​Third-party services

​Storage on your device and in your browser

​How long we keep it

​Who can see your data within shared spaces

Data you provide directly

Data collected automatically

AI

Data from connected institutions (optional)

Subscriptions and payments

Data we do not collect

Where your data lives

Third-party services

Storage on your device and in your browser

How long we keep it

Who can see your data within shared spaces