Privacy

One row per user holding what you enter in the calculator: your take-home, the amounts you put against each category, your zip code, your goals, and the share of what's left you choose to set aside. It is keyed to your sign-in account rather than to a browser, which is why your numbers follow you to another device.

Sign-in itself is handled by Privy, our identity provider. We never see or store a password.

There is no path from your browser to our database. Every read and write goes through our server, which first verifies your sign-in token and then scopes the query to your own account. Database-level access is restricted to that server.

Bank connection is optional and uses Plaid. We store 30-day category totals — what your housing, food or utilities came to — and never individual purchases. The access token Plaid issues is held server-side only.

If you create a wallet, we store its address, the label you gave it, and a local receipt log of transfers: amount, timestamp, and a link to the public transaction. We never hold a private key. The wallets are self-custodial, which also means IPA cannot move, freeze, or recover funds in them.

A wallet address only becomes visible to other people when you yourself designate it as where you want to be paid. Joining a circle does not publish your address, and no one is ever shown your balance.

Sharing a summary with a circle is off by default and chosen per circle. When you turn it on, circle members see a fixed, short list: your display name, whether you're on track, your monthly outgoings, the share of your income that survives the bills, and what you send to your zip code. They do not see your income, your individual expenses, your debts, or your goal amounts.

Turning sharing off deletes that shared row rather than hiding it.

The only figure we compute across users is the total your zip code sets aside. The query that produces it never reads anyone's identity, and below five participating people the amount is left out of the result entirely rather than merely hidden — in a one- or two-person zip code, a “community total” would just be one person's own finances.

Choosing a community percentage moves no money. Nothing is collected, pooled, or paid out.

If you give us your email for launch updates, we store that address and whether you confirmed it. It is used for updates about IPA and nothing else, and every message carries a one-click unsubscribe link that needs no account.

Ask us and we will delete your stored numbers. Note that a blockchain transaction, once made, is public and permanent — that is a property of the network, and nobody, including us, can remove it.