> ## Documentation Index > Fetch the complete documentation index at: https://recontrol.money/docs/llms.txt > Use this file to discover all available pages before exploring further. # What we store > A plain-language breakdown of every type of data Recontrol holds, and what we do with it. *Last updated 23 October 2026.* ## Data you provide directly | Data | Details | Why | | - | - | - | | **Email address** | From the Google or Apple account you sign in with, or the address you sign in with | Account creation and authentication | | **Display name** | From your sign-in, and changeable in your profile | Identifying you within shared spaces | | **Sign-in** | You sign in with Google, Apple or your email: a six-digit code sent to your address, or a password where your account has one. A password is kept only as a one-way hash we can't read | Authentication | | **Phone number** | Optional | Inviting members to a space by phone | | **Accounts, categories and sources** | Their names, classes and currencies | Core functionality | | **Transaction data** | Amounts, notes, days, and the From and To accounts | Core functionality | | **Plans and alerts** | Budgets, goals and watchlists: their names, amounts, dates, accounts and your own planning figures; and the alerts set on them and on accounts | Planning, and telling the space what you asked to be told | | **Space names** | Names of spaces you create or join | Collaborative workspace management | | **Reporting currency** | The display currency for each space. Defaulted from your device's region when a space is created, and changeable in-app | Display formatting and conversion | | **Chat questions** | The text of questions you ask in [Chat](https://recontrol.money/docs/features/chat.md), never the answers | Understanding which questions people ask so we can build them into the product | | **Feedback** | What you send with **Send Feedback**: its type, your message, whether you'd like a reply, the space you were in, and, if **Include Diagnostics** is on, the app's version, your device or browser platform, and the screen it was sent from. Never anything about your money | Fixing problems and deciding what to build | | **Support messages** | Emails you send to [support@recontrol.money](mailto:support@recontrol.money) | Customer support | ## Data collected automatically | Data | Details | Why | | - | - | - | | **Authentication tokens** | JWT access tokens and refresh tokens | Session management | | **Session identifiers** | Login timestamps and session IDs | Security | | **Country / region** | A two-letter country code from your device's region setting at sign-up (not GPS); omitted if unavailable | Establishing your country/region for regional privacy rights and defaults | | **Device push token** | An Expo push token, device name, and platform, once your phone allows notifications | Sending notifications | | **Notifications** | What Recontrol has told you, and whether you've read it | Your notifications inbox | | **Subscription status** | Whether you hold a subscription and when it renews or expires, an anonymous customer identifier issued by our billing provider, your monthly Chat usage count, and which spaces you have chosen to sponsor | Unlocking paid features and enforcing fair-use limits | | **Product analytics** | Pseudonymous usage events and device/app metadata via PostHog, never your name, email, or financial data. On the phone, on with a switch to turn it off; on the web, off in the EEA and the UK until you turn it on | Improving the app | | **Crash and error reports** | Uncaught app errors and native crashes via PostHog, with the error *type* and code locations only; messages and runtime values are stripped before sending. Covered by the same switch as analytics | Fixing bugs | | **Basic request metadata** | IP address, user-agent string, request timestamps, seen by our API and, for the web app, by Vercel | Server operation, security monitoring, debugging | | **Server-side telemetry** | Traces, metrics and logs from our API: timings, error rates, route names, and opaque internal identifiers such as your user ID. Never names, amounts, balances, emails, or free text | Infrastructure monitoring and debugging | **Analytics is limited and optional.** Recontrol uses one product-analytics tool, **PostHog** (US cloud). It records pseudonymous usage events and crash reports to help us improve the app, and **never** receives your financial data, name, or email. You can turn it off in **Settings** on the phone, or in Profile and settings on the web, and it is disabled entirely on development builds. We use no advertising SDK and no cross-app tracking. ## AI [Chat](https://recontrol.money/docs/features/chat.md) sends your question and the parts of the space's books it needs to answer to **Anthropic** (Claude). When a bank you linked brings a kind of transaction your space hasn't seen before, its merchant names and your category names may go to Anthropic to sort it, never its amount. Both happen only after you turn on **AI features**. We store your Chat question; we never store the answer, and there is no server-side conversation history. Exactly what is sent, what is never sent, and what Anthropic does with it is documented in [AI and your data](https://recontrol.money/docs/data/ai.md). ## Data from connected institutions (optional) If you choose to connect an external financial account, we import data from it **on your behalf, with your consent**. These connections are optional and inactive until you connect an account; adding accounts by hand is always available. We **never** receive your banking or brokerage login credentials. | Connection | What we import | Region | | - | - | - | | **Plaid** (banks) | Account names, types, last 4 digits of the account number, balances, currency, and up to 2 years of transactions (amount, date, description, merchant, pending status), plus your institution's name. Where your bank reports them: an investment account's holdings (each security's name, quantity, price and value); a card's or loan's terms (last statement, minimum payment, due date, interest rate, whether a payment is overdue, and when a loan ends); and payments it has seen repeat (merchant, usual amount, how often, next expected date) | United States & Canada | | **Zerodha** (Kite Connect) | Equity and mutual-fund holdings (ISIN, name, quantity, average price, last price, P\&L) and your Zerodha user ID, name, and email | India | We store an access token for each connection so we can refresh your data. These tokens are **encrypted at rest using AES-256-GCM**, on top of the database's own encryption. You can disconnect at any time, which revokes and deletes the token. See [Security](https://recontrol.money/docs/data/security.md) and [Connections](https://recontrol.money/docs/features/connections.md). ## Subscriptions and payments > [!WARNING] > > **We never see, receive, or store your card or payment details.** Purchases are made entirely inside the Apple App Store or Google Play. Your payment method belongs to your store account. Purchases are processed by **Apple** or **Google** and reconciled through **RevenueCat**, our subscription-management provider. What reaches us is only: whether an active subscription exists, when it expires, and an opaque customer identifier. No card number, no billing address, no transaction amounts. RevenueCat receives an anonymous app user identifier, your device type and operating system, and the store's own purchase receipt or token. It acts as our processor and stores that data in the United States. ## Data we do not collect * Precise or GPS location. The phone records only the coarse country code from your device's region setting at sign-up (see above). The web app reads the country Vercel derives from your IP address on each request, only to decide whether usage analytics start off, and doesn't store it * Device contacts or address book * Photos or camera access * Advertising identifiers (IDFA or similar) * Your bank or brokerage login credentials (sign-in is handled by Plaid or Zerodha; we never see it) * Your card or payment details (handled entirely by Apple and Google) * Audio recordings. Voice questions are transcribed by your device's or browser's own speech recognition, and we receive only the resulting text * Biometric data (the optional app lock uses your device's on-device biometrics; the data never reaches us) ## Where your data lives > [!NOTE] > > **Changed 29 July 2026.** Recontrol's database moved from AWS ap-south-1 (Mumbai, India) to **AWS us-east-1 (Northern Virginia, United States)**. Nothing about what we collect changed, only where it is stored. See the [Privacy Policy](https://recontrol.money/docs/legal/privacy.md#8-data-storage-location-and-international-data-transfers). Recontrol's **database is hosted on Amazon Web Services in the us-east-1 (Northern Virginia, United States) region**, via Nhost. The data you enter, and the data we import on your behalf, is stored at rest in the United States. Our **application/API server is also hosted in the United States** (on Railway), so your data is processed in the same country it is stored in. The web app is served by **Vercel**. **If you are outside the United States**, including in Canada, India, or elsewhere, your data is stored and processed in the United States. We stay accountable for protecting it wherever it is processed. See the [Privacy Policy](https://recontrol.money/docs/legal/privacy.md#8-data-storage-location-and-international-data-transfers) for the full cross-border disclosure and your regional rights. **Plaid processing:** if you connect a bank using **Plaid**, your banking data is processed by Plaid on infrastructure in the **United States** before it reaches us. This only happens if you choose to connect a bank. ## Third-party services | Service | Provider | What they receive | Purpose | | - | - | - | - | | **Nhost** | Nhost | Email, display name, phone number, sign-in identities, session tokens, financial data, and a password hash only for an account made with a password in an earlier version | Authentication, database hosting (PostgreSQL via Hasura) | | **AWS** (via Nhost) | Amazon | All data stored in the database (encrypted at rest) | Cloud storage in Northern Virginia, United States | | **Railway** | Railway | Data in transit through our API (processed, not stored) | Hosting our API server (United States) | | **Vercel** | Vercel Inc. | The web app's requests, including IP addresses, request logs, and data in transit through the web app's own server, including your sign-in session | Hosting the web app at app.recontrol.money | | **Plaid** | Plaid Inc. | Bank account and transaction data, only if you connect a bank | Bank-account aggregation (US/Canada) | | **Zerodha** | Zerodha (Kite Connect) | Investment-holdings data, only if you connect Zerodha | Investment-holdings aggregation (India) | | **Anthropic** | Anthropic PBC | Your Chat question and the parts of the space's books it needs; for sorting, merchant names and your category names. Only after you turn on AI features | Writing Chat's answers and sorting imported transactions (United States) | | **RevenueCat** | RevenueCat, Inc. | An anonymous customer identifier, device type and OS, and the store purchase receipt, only if you subscribe | Subscription management (United States) | | **Apple / Google** (payments) | Apple; Google | Your purchase and payment details, handled entirely by them; we receive none of it | Processing in-app purchases | | **Apple / Google** (speech) | Apple; Google | Spoken audio and vocabulary hints, while a voice question is being dictated on the phone | Converting speech to text (on-device or provider-side, per platform) | | **Resend** | Resend | Your email address and email content | Transactional email, such as space invitations and account-deletion confirmation (US) | | **Expo** (push) | Expo → Apple/Google | Device push token and notification content, once your phone allows notifications | Push-notification delivery (US) | | **PostHog** | PostHog | Pseudonymous usage events, crash reports and device metadata, no financial data; only while analytics are on | Product analytics and error tracking (US cloud) | | **Grafana Labs** | Grafana Labs | Server-side traces, metrics and logs: opaque identifiers, timings and error codes; no names, amounts, or free text | Infrastructure monitoring (Grafana Cloud, United States) | | **exchangerate-api.com** | ExchangeRate-API | Currency codes only, no personal data | Exchange rates | | **Apple / Google** (sign-in) | Apple; Google | Your name and email, from the sign-in you choose | Authentication | We use no advertising services, cross-app tracking, social-media pixels, or data brokers. Our only analytics tool is PostHog (no financial data). If you connect **your own AI tool** on the web, what it reads goes to that tool's provider at your direction. See [AI and your data](https://recontrol.money/docs/data/ai.md#your-own-ai-tool). ## Storage on your device and in your browser The phone app uses: * **Expo Secure Store**, which stores authentication tokens using iOS Keychain / Android Keystore. Not accessible to other apps. * **AsyncStorage**, which keeps session state and cached data locally. * **PostHog local storage**, while analytics are on: a pseudonymous identifier and a small event queue. * **RevenueCat local cache**: your subscription status, so the app knows what you have paid for without a network round trip. * **Your Chat transcript**, held in memory for the session only. The web app uses: * **One essential cookie**, `__Host-rctrl-session`, which holds your sign-in, sealed and encrypted. Page scripts can't read it, it's sent only to app.recontrol.money, and it expires within a day of signing in. * **Preference cookies** for Appearance, money colours and the sidebar's state. * **Browser storage** for preferences such as Hide amounts, the space you last opened, your analytics choice, recent search-box entries and the transaction views you save, and, for up to 30 minutes, the state of a bank or broker connection you're in the middle of. * **PostHog storage**, only while analytics are on. * **Your Chat transcript**, held in memory for the session only. Your short-lived access token is held in memory too, never in storage. None of this is used for advertising or cross-app tracking. ## How long we keep it | Data type | Retention | | - | - | | Account and profile data | Until you delete your account | | Financial data (accounts, transactions, plans) | Until you delete your account | | Imported data (bank accounts, transactions, holdings) | Until you delete it or your account. Disconnecting stops new data and keeps what was imported | | Integration access tokens | Until you disconnect or delete your account; Zerodha tokens also expire daily | | Chat questions | Until you delete your account, or ask us to erase them. Answers are never stored | | Feedback messages | Until you delete your account | | Notifications | Until you delete your account | | Subscription status and usage counters | Until you delete your account. Your monthly Chat usage counter resets on the 1st of each month | | Authentication tokens | Short-lived; expire automatically. Invalidated on sign-out or deletion. The web's session ends a day after sign-in at the latest | | Session data | Duration of the active session | | Server-side telemetry and operational logs | Up to 12 months, then deleted or anonymised. Not linked to individual user profiles | | Support communications | Up to 24 months after last communication | See the [Data Retention and Disposal Policy](https://recontrol.money/docs/legal/data.md) for full detail. ## Who can see your data within shared spaces When you join a shared space, other members of that space can see everything in it, such as its accounts, transactions and plans, according to their role. Your display name and email may also be visible to other members of any space you belong to. Data in one space is never visible to members of a different space. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.