Privacy

What The Family Pace stores

• Your account — name, email address, and a password hash (scrypt). The password itself is never stored and cannot be recovered from the hash.
• Your ledger — transactions with their dates, amounts, and the descriptions your bank printed; the accounts they belong to; balances and credit limits you enter; and the statement files you import, recorded as batches so an import can be undone.
• Your plans — goals, expected income, planned purchases, and the chart lines you configure.
• Your household — who you plan with, their role, and pending invitations.
• Sessions — a signed cookie in the browser; on the phone, a short-lived access token plus a long-lived refresh credential of which only a SHA-256 hash is kept, labelled with the device name you give it.

Data arrives one of two ways: you upload a statement, or you link a bank and transactions are pulled from it. Nothing is collected in the background about how you use the app.

No advertising, no analytics

The Family Pace contains no analytics, no telemetry, no advertising, and no third-party tracking of any kind — not disabled by a setting, simply absent from the code. Your data is never sold, rented, or shared for marketing, and nobody is profiled with it.

Who else ever sees it

Four companies, each for one job, and none of them receive more than that job needs.

• Plaid — only if you choose to link a bank. You sign in to your bank on Plaid’s or your bank’s own screen; The Family Pace never sees your banking credentials. Plaid returns a long-lived access token, which is stored encrypted (AES-256-GCM), and the transactions and balances that token grants. Disconnecting a bank in The Family Pace removes the connection at Plaid too. If you never link a bank, Plaid receives nothing.
• Anthropic — optional, and only when merchant classification by AI is switched on for the server. It receives a normalized merchant name and nothing else — the word trader joes, not what you spent, when, from which account, or who you are. That is enforced rather than promised: the outbound call accepts only strings matching a normalized-name format and rejects anything else, so an amount or a date cannot travel through it even by mistake.
• Railway — hosts the application and the managed PostgreSQL database in which everything above is stored, in the United States.
• Cloudflare — answers DNS for this domain. Proxying is switched off, which means Cloudflare resolves the address and does not receive the contents of your pages or your data.

Sharing inside a household

A household is the people who plan together. In the family view, members see each other’s accounts and transactions — that is the feature, and it is worth being clear that it is not partial: joining a household means the other members can see the spending you own. Roles limit who can change things (an owner manages members, an editor edits the budget, a viewer only reads), not who can see them. Your own rows stay yours: leaving a household simply removes them from its view rather than transferring them.

Bank credentials are the exception and are never shared. A connection belongs to the person who made it; no other member can refresh, re-authenticate, or remove it.

How it is protected

• Everything travels over HTTPS. Plain HTTP is redirected, never served.
• Passwords are hashed with scrypt; the session cookie is http-only, same-site, and secure.
• The phone holds a 15-minute access token and a refresh credential in the iOS Keychain. The refresh credential rotates on every use, and presenting an already-used one revokes that device’s whole chain — the response to a stolen token is automatic.
• Every query is scoped on the server to the signed-in user. An account id sent by a client is never trusted without being checked against that user first.
• Plaid access tokens are encrypted at rest with a key derived from the server’s secret, so a database copy on its own does not yield a working bank connection.
• On the phone you can turn on App Lock: Face ID or Touch ID with your passcode as the fallback, and the screen is covered whenever the app leaves the foreground so balances do not appear in the app switcher.

No system is beyond compromise, and The Family Pace is run by a very small operation. What that buys you is fewer people with access; what it costs you is that there is no 24-hour security team. Both are true and you should know them.

Keeping and deleting

Data is kept until you delete it — there is no automatic expiry, because a finance planner whose history quietly vanished would be worse than useless.

From the iPhone app you can delete your account yourself, in Settings. It is a real deletion, not a flag: your transactions, accounts, plans, sessions, and household are removed, and any bank connections are removed at Plaid first so nothing is left alive upstream. It cannot be undone.

On the web this is not built yet. Until it is, email support@thefamilypace.com from the address on your account and it will be done by hand. Smaller requests — a copy of your data, or correcting something — go to the same place.

Deleting your account does not reach Plaid’s own records of your bank connection beyond removing it; Plaid’s retention is theirs, and their policy is at plaid.com/legal.

Children

The Family Pace is not intended for children, and accounts are not knowingly created for anyone under 16.

Changes

If this policy changes, this page changes with it and the date at the top moves. If a change affects what leaves the server or who receives it, you will be told rather than left to notice.

Contact

support@thefamilypace.com — for anything on this page, and for the requests above. See also Support.