Privacy

Your data isn't our product.

planbend is funded by subscriptions, not by selling, brokering, or monetizing your data. This page describes exactly what we collect, what we do with it, and what would happen if the company were ever acquired.

Last updated: June 2026. We will notify users by email and on this page if material terms change.

What we collect

The minimum we need to make the product work:

✓Your email address (for sign-in and account recovery)
✓An encrypted password hash (we never see your actual password)
✓The financial data you enter — incomes, accounts, balances, ages, goals, projections
✓Product usage events — which features you use, how often, and in what sequence. These events are tied to your account ID when you are signed in so we can understand how the product is used and where to improve it. See "Third-party services" below.

We don't ask for SSNs, full bank account numbers, driver's license numbers, or any other government IDs. We don't connect to your bank, so we never see transactions or balances we didn't ask you to enter manually.

Cookies and tracking

We use cookies and similar browser storage technologies for the following purposes:

✓Authentication. Keeping you signed in between sessions. These are essential and cannot be disabled without breaking the app.
✓Product analytics. PostHog sets cookies to track product usage events across sessions. These cookies are tied to your account when you are signed in. They help us understand how features are used and where users encounter problems.

You can disable cookies in your browser settings. Disabling authentication cookies will prevent sign-in. Disabling analytics cookies will not affect app functionality but will prevent us from counting your usage in product metrics.

What we do with it

✓Run the product. Your data is stored encrypted in Supabase (our database provider, SOC 2 Type II certified). Row-level security ensures only you can read your own data.
✓Improve the product. Usage events help us prioritize what to build and fix. We review these in aggregate. Individual user data is not manually reviewed except when you request support.
✓Email you transactional messages. Sign-up confirmation, password reset, billing receipts, and a short welcome sequence when you first sign up. No marketing emails beyond the onboarding sequence unless you opt in.

What we don't do

✓We don't sell your personal financial data to advertisers, data brokers, marketing companies, or anyone else.
✓We don't share your personal financial data with third parties for their marketing purposes.
✓We don't run ads in the product. No ad tracking pixels, no behavioral ad targeting inside the app.
✓We don't aggregate individual user financial data into a dataset and sell or license it.
✓We don't use your personal financial details to train AI or machine learning models.

Data retention

We retain your data as follows:

✓Account and User Data — retained for as long as your account is active, plus 30 days after termination to allow for export.
✓Usage analytics events (PostHog) — retained for 24 months, then purged.
✓Transactional email logs (Resend) — retained per Resend's standard policy (approximately 30 days for delivery logs).
✓Backup snapshots — retained for 90 days, then overwritten.
✓Billing records — retained as required by applicable tax and accounting law, typically 7 years.

The acquisition question (the honest answer)

Some companies say "we'll never sell your data, ever." That promise can't survive an acquisition — and pretending otherwise is dishonest. Here's how it would actually work:

✓If planbend were acquired, the buyer would inherit our existing privacy policy. They could not retroactively change the terms users agreed to at signup.
✓The buyer could publish a new privacy policy going forward. Under most U.S. privacy laws, users who continue using the service after notice are deemed to consent. Users who don't consent must be allowed to opt out and delete their data.
✓Our commitment: If planbend is ever acquired and the buyer wants to materially change how data is handled, we will give users at least 60 days advance notice by email, plus a one-click data export, plus a free account deletion option. No user will be enrolled in new data uses automatically.
✓We prefer a values-aligned buyer over the highest bidder. What we can do is structure the company to make a misaligned acquisition unattractive and give users a clean exit if the situation changes.

Your rights

✓Export. Download your complete plan as JSON anytime in Settings → Backup Data.
✓Delete. Settings → Delete my account data. We auto-export a backup before deletion so you have a copy.
✓Correction. All your data is editable directly in the app at any time.
✓Access. You can see everything we have about you — it's all on your dashboard.
✓Opt out of analytics. Email hello@planbend.com and we will disable PostHog tracking for your account.

State privacy rights

We honor privacy rights for users in all U.S. states. The following specific state laws apply:

Virginia (VCDPA). As a Virginia company, we comply with the Virginia Consumer Data Protection Act. Virginia residents have the right to: access the personal data we process about you; correct inaccuracies; delete your personal data; obtain a copy of your data in a portable format; and opt out of the sale of personal data or its use for targeted advertising. To exercise these rights, email hello@planbend.com. We respond within 45 days as required by law.

California (CCPA/CPRA). California residents have the right to know what personal information we collect and how we use it, to delete it, to correct it, and to opt out of its sale. We do not sell personal information in the traditional sense. However, certain analytics data sharing may constitute a "sale" under the broad CCPA definition. California residents may opt out by using the "Do Not Sell My Info" link in our footer or by emailing hello@planbend.com.

Other states. We honor equivalent rights for residents of Colorado, Connecticut, Texas, and other states with consumer data protection laws. Contact hello@planbend.com to exercise any state privacy right.

Do Not Sell or Share My Personal Information

To opt out of any sale or sharing of your personal information (including analytics data that may qualify as a "sale" under state privacy laws), email hello@planbend.com with subject line "Do Not Sell." We will process your request within 15 business days.

Children's privacy

planbend is intended only for adults aged 18 and older. The Service is not directed to children, and we do not knowingly collect personal information from anyone under 18 — and never from children under 13, consistent with the Children's Online Privacy Protection Act (COPPA). If we learn that we have collected personal information from someone under 18, we will delete it promptly. If you believe a minor has provided us with personal information, contact us at hello@planbend.com and we will remove it.

Security

✓All data encrypted at rest (AES-256) and in transit (TLS 1.3).
✓Row-level security enforced at the database layer — even in the event of a database compromise, RLS policies prevent cross-user data exposure.
✓Content Security Policy headers enforced on all routes to reduce XSS attack surface.
✓Daily backups with documented recovery procedures.
✓SOC 2 audit is a planned milestone. We will update this page when that process formally begins.

Third-party services we use

✓Supabase — database and authentication hosting. SOC 2 Type II certified. Stores your encrypted plan data and manages sign-in. Privacy policy: supabase.com/privacy
✓Vercel — application hosting. Serves the app and handles deployment. Processes request logs including IP addresses per their privacy policy. Privacy policy: vercel.com/legal/privacy-policy
✓PostHog — product analytics. Receives usage events (which features you use, navigation patterns, errors) tied to your account ID when signed in. PostHog does not receive your financial data and does not sell user data. Privacy policy: posthog.com/privacy
✓Resend — transactional email delivery. Receives your email address and the content of transactional emails (confirmations, onboarding sequence, password resets). Does not use this data for marketing. Privacy policy: resend.com/legal/privacy-policy
✓Finnhub — stock price data (Pro feature only). Receives ticker symbols you enter. No account or personal data is sent to Finnhub. Privacy policy: finnhub.io/privacy
✓Stripe — payment processing (paid tiers). Processes billing information. We never see your full credit card number. PCI DSS Level 1 certified. Privacy policy: stripe.com/privacy

None of these vendors are authorized to use your data for their own marketing, analytics sold to third parties, or any purpose beyond providing us the infrastructure service we pay them for.

Legal process and law enforcement

We may access, preserve, or disclose your information if we believe in good faith that such action is necessary to comply with applicable law, respond to legal process, enforce our Terms of Service, or protect the rights, property, or safety of Planbend LLC, our users, or the public. Where legally permitted and practical, we will notify you of such requests before complying.

Questions or concerns

Email hello@planbend.com — we respond to privacy questions within one business day. If you believe we've mishandled your data, write to us first. We'd rather hear it and fix it.

Planbend LLC · 9816 Coral Bells Ct · Toano, Virginia 23168

Plain-English summary: We collect what we need to run the app and nothing more. We don't sell or share your financial data. We use PostHog to understand how the product is used (tied to your account, not sold to anyone). We use Resend to deliver email. If we're ever acquired, you get 60 days notice plus a one-click export and free deletion. Your data is encrypted, exportable, and deletable at any time. Virginia and California residents have specific rights listed above.