Privacy policy

Account details. Your email address and a password (stored only as a secure hash by our authentication provider). If you fill in your profile during setup, we also keep what you tell us, such as whether you use Squared for personal money, a business, or both.

Financial data from connected accounts. When you connect a bank, card, or brokerage through Plaid, we receive account names, types, the last four digits of account numbers, balances, transactions (amount, date, and the description your bank provides), and investment holdings. We never receive your bank username or password.

Things you add or change. Manual accounts, categories you assign, rules you create, budgets, notes, and questions you ask the assistant.

Technical data. Basic server logs (such as request times and errors) kept by our hosting provider to run and secure the service, and a record of each sync so we can tell when a connection stops working.

We use your information only to run Squared for you:

• Show your balances, net worth, cash flow, and investments
• Categorize transactions and separate business from personal spending
• Detect income, transfers, refunds, and recurring charges
• Answer questions you ask the assistant about your own data
• Keep connections in sync and tell you when one needs attention
• Secure your account, prevent abuse, and fix problems
• Send you account emails, such as confirmations and password resets

We don’t send marketing email without your permission.

We do not sell your personal or financial information, and we never will. We don’t rent it, trade it, or share it with advertisers or data brokers, and we don’t use it to show you ads. There are no advertising or third-party analytics trackers on Squared.

We share data only with the service providers that make Squared work, only what each one needs, and only to provide the service to you:

• Plaid connects your financial accounts. Plaid’s handling of your data is covered by the Plaid End User Privacy Policy.
• Anthropic provides the AI that categorizes transactions and powers the assistant. For categorization we send a transaction’s description, amount, date, and the name and type of its account, and only when your own rules and past categorizations can’t already decide it. Under Anthropic’s commercial terms, data sent through its API is not used to train its models.
• Supabase hosts our database and handles sign-in.
• Vercel hosts the website and servers.
• Twelve Data and CoinGecko provide market prices. We send them ticker symbols only, never your name, balances, or quantities.

We may also disclose information if the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or sale of Squared, in which case this policy would continue to apply to your data.

• Bank connections are read only. Squared cannot move, send, or withdraw money.
• Data is encrypted in transit and at rest.
• The keys that let us read your connected accounts are stored encrypted and are never sent to your browser or phone.
• Every record is locked to your account in the database itself, so one user cannot read another’s data.

No system is perfectly secure. If we learn of a breach that affects your information, we will tell you and do what the law requires.

• Disconnect any bank from the Accounts page. We stop reading it and remove the connection at Plaid.
• Correct your data. Categories and details you edit are yours and are never overwritten by a sync.
• Delete your account from Settings, on the web or in the app. We remove every bank connection at Plaid and permanently delete your account and all of its data.
• Ask for a copy of your data, or ask any privacy question, by emailing privacy@sqrd.money.

Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act. We honor them for all users, and we will never treat you differently for using them.

We keep your data while your account is open. When you delete your account, your data is deleted from our database right away. Copies in routine backups and hosting logs expire on their normal schedule, typically within 30 days.

We use cookies only to keep you signed in, and your browser’s local storage only to remember preferences such as light or dark mode. No advertising or tracking cookies.

Squared is not meant for anyone under 18, and we don’t knowingly collect information from children under 13. If you believe a child has given us information, contact us and we will delete it.

If we change this policy, we’ll update the date at the top. If a change affects how your data is used or shared in a meaningful way, we’ll tell you by email or in the app before it takes effect.

Questions about privacy or your data: privacy@sqrd.money. See also our terms of service.