Privacy at Reeve Money

Reeve Money is made by Peach Byte Labs, LLC ("we"). Reeve exists to keep your financial plan, not to monetize your attention or your data. This policy lists what the app and our server actually collect, where it goes, how long we keep it, and who can read it. It is written from the code, and we update it when the code changes.

What we collect

Your Apple sign-in. Sign in with Apple gives us a stable Apple user identifier and an email address (your real one, or Apple's private relay address if you chose to hide it). We never see your Apple password.
Financial data from the accounts you connect, read-only, through Plaid or Apple's FinanceKit: account names (which can include the last four digits of the account number), types, balances, available balances and credit limits; transactions (date, the bank's description, amount, merchant, category, pending status); recurring bills and income; investment holdings (security, shares, value, cost basis); and loan and card details (APR, minimum payment, due and statement dates, statement balance, interest paid, overdue status). FinanceKit data is read on your phone and uploaded to our server so Reeve can work with it. Your bank login is entered only with your bank or Plaid; we never see it.
What you tell Reeve: your plan (pay, employer, pay schedule, equity and vesting, debts, windfalls, standing instructions), the first-run interview and the profile built from it (your goals, what you find hard, your preferences), goals, notes, account nicknames, custom charts, your answers to Reeve's questions, and your chat with Reeve, including Reeve's replies.
What Reeve works out: daily balance history, alerts and the text of each notification, plan proposals and earlier versions of your plan, and a count of the AI usage your account caused.
Feedback you send: your note, the app version, your device model and iOS version, and, when you report a problem with a chat or a proposal, the last few chat messages or that proposal.
Partner invitations: if you invite a partner, their email address, so we can measure demand for shared plans.
Account records: when you agreed to our terms and to the AI consent (and which version), your subscription status from the App Store, and your sign-in sessions (stored as one-way hashes).
Your device's push token, so we can send you notifications.

No advertising, no third-party analytics, no tracking, and no cookies, in the app or on this website. We do not store your IP address; it is used in memory only, to slow down abusive traffic.

How it's used

Only to provide Reeve to you: syncing your accounts, applying your plan's rules, answering your questions, sending the alerts and reminders you get, showing your progress and projections, and fixing problems you report. Partner invitations are counted to decide whether to build shared plans; we do not email your partner.

What we never do

We never sell your data. We never share it with anyone for their own purposes. We never use it for advertising. There is no "anonymized data" carve-out.

Who can read your data

Encrypted at rest with a key your phone holds. Your financial data, plan and chat are encrypted on our server under a key that lives on your phone (and syncs through your iCloud Keychain).
While Reeve works for you, the server can read it. Your phone sends the key with each request, and the server keeps it in memory to sync your banks and run your plan. When you first sign up, the server holds a sealed copy of the key until your phone confirms it has it.
Support only in a window you open. We can look at your data only if you turn on Settings > Privacy > Support access, for as long as you choose (up to 14 days), and you can close it at any time.
Your sign-in record, email, subscription status, consent records, feedback and partner invitations are kept outside that encryption, on our encrypted server volume, so we can run your account and read your feedback.

Service providers

Each provider acts on our instructions and receives only what its role needs:

Plaid: bank connectivity. Receives your bank login on its own pages, and an internal Reeve user number (no name or email). Plaid's End User Privacy Policy.
Anthropic: the AI model (Claude) behind Reeve's judgment, chat, categorizing and charts. To answer you, it receives the parts of your data the task needs: transactions (the bank's description, amount, category and account name), balances, holdings, your plan and profile, goals, notes, recent notifications, your chat messages and Reeve's recent replies, and the first-run interview. We send no name, email or Apple ID field, but anything you type is sent as you wrote it. Anthropic does not train its models on this data and deletes it within 30 days.
Apple: Sign in with Apple; FinanceKit on your phone; push notifications, whose text (for example an amount and a merchant) passes through Apple's push service; the App Store for subscriptions; and your iCloud Keychain, which holds your data key.
Fly.io: hosts our server and its encrypted volume in the US (Virginia), and this website. Fly keeps daily snapshots of the volume for 30 days for disaster recovery, and our server logs.

What stays on your phone

Your sign-in token and data key (in the Keychain), a few settings, and a small summary for the home-screen widget (headline, safe-to-spend, balance on hand, upcoming bills, next payday). Signing out removes the token; deleting your account removes the key and the rest.

Server logs

Our logs record requests (path and result, no content and no IP address) and what the server did, which can include bank names, account names, and short pieces of a goal or note Reeve changed for you. Most user references are one-way codes. Logs are kept by Fly.io for a short period and are not linked to your account in any other system.

Retention and deletion

We keep your data while you have an account, so Reeve can show history and long-term progress. Disconnecting a bank stops collection and deletes that connection's accounts and transactions. Delete account in Settings erases everything at once: bank connections are revoked at Plaid; your financial data, plan, chat, goals, notes, feedback, partner invitations, sign-in and consent records are removed from our systems immediately; and Reeve's Sign in with Apple link to your Apple ID is revoked (if you confirm with Apple when asked). Copies in the 30-day disaster-recovery snapshots and in server logs age out on their own. Plaid keeps what it already collected under its own policy; Anthropic deletes what we sent within 30 days. You can also ask for deletion by email to support@reevemoney.com, and we will act without undue delay.

Waitlist

If you join the waitlist, we store your email address and the date you confirmed it, separately from any Reeve account data. We use it to send one email when Reeve launches on the App Store. We don't sell it or share it, except with the email provider that delivers the message. We also keep a record of your consent: when you signed up, when you confirmed, and which wording of the form you saw, so we can show you agreed. Every email we send has a link to leave the list, which deletes your address; you can also write to support@reevemoney.com.

Your rights

Depending on where you live, you may have legal rights to access, correct, delete or export your data. Whatever the jurisdiction, our practice is the same: deletion is built into the app, and if you email us we will send you a copy of your data, correct it, or delete it.

Security

How the data is protected (encryption, access control, incident response) is in our Information Security Policy.

Who Reeve is for, and changes

Reeve is for adults 18 and over in the United States, and is not directed to anyone younger. If this policy changes materially, the change is dated here and you are asked to agree again in the app.

Contact

Reeve Money is made by Peach Byte Labs, LLC. Questions, requests and reports: support@reevemoney.com.