Privacy at Reeve Money

Reeve Money is made by Peach Byte Labs, LLC ("we"). Reeve exists to keep your financial plan, not to monetize your attention or your data. This policy lists what the app and our server actually collect, where it goes, how long we keep it, and who can read it. It is written from the code, and we update it when the code changes.

What we collect

Your Apple sign-in. Sign in with Apple gives us a stable Apple user identifier and an email address (your real one, or Apple's private relay address if you chose to hide it). We never see your Apple password.
Financial data from the accounts you connect, read-only, through Plaid or Apple's FinanceKit: account names (which can include the last four digits of the account number), types, balances, available balances and credit limits; transactions (date, the bank's description, amount, merchant, category, pending status); recurring bills and income; investment holdings (security, shares, value, cost basis); and loan and card details (APR, minimum payment, due and statement dates, statement balance, interest paid, overdue status). FinanceKit data is read on your phone and uploaded to our server so Reeve can work with it. Your bank login is entered only with your bank or Plaid; we never see it.
What you tell Reeve: your plan (pay, employer, pay schedule, equity and vesting, debts, windfalls, standing instructions), the first-run interview and the profile built from it (your goals, what you find hard, your preferences), goals, notes, account nicknames, custom charts, your answers to Reeve's questions, and your chat with Reeve, including Reeve's replies.
What Reeve works out: daily balance history, alerts and the text of each notification, plan proposals and earlier versions of your plan, and a count of the AI usage your account caused.
Feedback you send: your note, the app version, your device model and iOS version, and, when you report a problem with a chat or a proposal, the last few chat messages or that proposal.
Partner invitations: if you invite a partner, their email address, so we can measure demand for shared plans.
Account records: when you agreed to our terms and to the AI consent (and which version), your subscription status from the App Store, and your sign-in sessions (stored as one-way hashes).
Your device's push token, so we can send you notifications.
A home you add: its name, the value or purchase price and month you enter, your 5-digit ZIP code, and which loan it's linked to. We use the first three digits of the ZIP code to pick your area's home price index from the Federal Housing Finance Agency, a public dataset we keep on our own servers. Your ZIP code and home details are never sent to anyone, and we don't ask for your address.
Where you found Reeve. If you installed Reeve after tapping one of our ads in the App Store, Apple tells us which of our ad campaigns it was, or that you didn't come from one. We keep only that and the day we learned it, never who you are to Apple, and we use it only to count which of our ads lead to subscriptions. It is deleted with your account.
Shared costs, if you invite someone or join. When you invite a person to share costs, only what you share with them is copied into a shared space: the bills and charges you split, what each of you owes, payments between you, and anything either of you adds, with who added it. It's encrypted under its own key, which travels in the invite link and lives on your two phones; our server holds that key in memory only while one of you is using Reeve. The other person sees nothing else of yours: no balances, accounts or other spending. An invite works once, expires after 7 days and can be canceled. Either of you can stop sharing at any time; each keeps their own copy of the history, and the shared space is deleted from our server once you each have your copy, or after 30 days. Deleting your account ends any shared space you're in.

No ads in Reeve, no third-party analytics, no tracking, and no cookies, in the app or on this website. We do not store your IP address; it is used in memory only, to slow down abusive traffic.

How it's used

Only to provide Reeve to you: syncing your accounts, applying your plan's rules, answering your questions, sending the alerts and reminders you get, showing your progress and projections, and fixing problems you report. Partner invitations are counted to decide whether to build shared plans; we do not email your partner.

What we never do

We never sell your data. We never share it with anyone for their own purposes. We never use it for advertising. There is no "anonymized data" carve-out.

Who can read your data

Encrypted at rest with a key your phone holds. Your financial data, plan and chat are encrypted on our server under a key that lives on your phone (and syncs through your iCloud Keychain).
While Reeve works for you, the server can read it. Your phone sends the key with each request, and the server keeps it in memory to sync your banks and run your plan. When you first sign up, the server holds a sealed copy of the key until your phone confirms it has it.
One exception, for disconnecting banks. For each bank you connect, our server also keeps a second copy of that connection's Plaid key, sealed with a server key instead of yours. We use it only to disconnect that bank at Plaid, for example after your subscription ends and the app is gone. It is never used to read your data, and it is deleted when the bank is disconnected or your account is deleted.
Someone you share costs with can read what's in your shared space with them, and nothing else.
Support only in a window you open. We can look at your data only if you turn on Settings > Privacy > Support access, for as long as you choose (up to 14 days), and you can close it at any time.
Your sign-in record, email, subscription status, consent records, feedback and partner invitations are kept outside that encryption, on our encrypted server volume, so we can run your account and read your feedback.

Service providers

Each provider acts on our instructions and receives only what its role needs:

Plaid: bank connectivity. Receives your bank login on its own pages, and an internal Reeve user number (no name or email). Plaid's End User Privacy Policy.
Anthropic: the AI model (Claude) behind Reeve's judgment, chat, categorizing and charts. To answer you, it receives the parts of your data the task needs: transactions (the bank's description, amount, category and account name), balances, holdings, your plan and profile, goals, notes, recent notifications, your chat messages and Reeve's recent replies, and the first-run interview. We send no name, email or Apple ID field, but anything you type is sent as you wrote it. Anthropic does not train its models on this data and deletes it within 30 days.
Apple: Sign in with Apple; FinanceKit on your phone; push notifications, whose text (for example an amount and a merchant) passes through Apple's push service; the App Store for subscriptions; Apple Ads attribution; and your iCloud Keychain, which holds your data key.
Fly.io: hosts our server and its encrypted volume in the US (Virginia), and this website. Fly keeps daily snapshots of the volume for 30 days for disaster recovery, and our server logs.

What stays on your phone

Your sign-in token and data key (in the Keychain), a few settings, and a small summary for the home-screen widget (headline, safe-to-spend, balance on hand, upcoming bills, next payday). Signing out removes the token; deleting your account removes the key and the rest.

Server logs

Our logs record requests (path and result, no content and no IP address) and what the server did, which can include bank names, account names, and short pieces of a goal or note Reeve changed for you. Most user references are one-way codes. Logs are kept by Fly.io for a short period and are not linked to your account in any other system.

Retention and deletion

We keep your data while you have an account, so Reeve can show history and long-term progress. If your trial or subscription ends without payment, or you don't start one, Reeve stops updating from your banks, and 7 days later disconnects them at Plaid; to come back, you reconnect each bank once. Reeve keeps your data for 90 days so you can pick up where you left off (30 days if you never started a subscription), then deletes it. We remind you 7 days before it is deleted. The deletion is the same as Delete account below. If you're in a shared space, it isn't affected: your account and the shared space stay so you can keep settling up, while your own data (bank history, budgets, plan and chats) is still deleted on that schedule. An account that only uses shared costs and goes unused for 12 months is archived, and restored when you next sign in. Disconnecting a bank stops collection and deletes that connection's accounts and transactions. Delete account in Settings erases everything at once: bank connections are revoked at Plaid; your financial data, plan, chat, goals, notes, feedback, partner invitations, sign-in and consent records are removed from our systems immediately; and Reeve's Sign in with Apple link to your Apple ID is revoked (if you confirm with Apple when asked). Copies in the 30-day disaster-recovery snapshots and in server logs age out on their own. Plaid keeps what it already collected under its own policy; Anthropic deletes what we sent within 30 days. You can also ask for deletion by email to support@reevemoney.com, and we will act without undue delay.

Waitlist

If you join the waitlist, we store your email address and the date you confirmed it, separately from any Reeve account data. We use it to send one email when Reeve launches on the App Store. We don't sell it or share it, except with the email provider that delivers the message. We also keep a record of your consent: when you signed up, when you confirmed, and which wording of the form you saw, so we can show you agreed. Every email we send has a link to leave the list, which deletes your address; you can also write to support@reevemoney.com.

Your rights

Depending on where you live, you may have legal rights to access, correct, delete or export your data. Whatever the jurisdiction, our practice is the same: deletion is built into the app, and if you email us we will send you a copy of your data, correct it, or delete it.

Security

How the data is protected (encryption, access control, incident response) is in our Information Security Policy.

Who Reeve is for, and changes

Reeve is for adults 18 and over in the United States, and is not directed to anyone younger. If this policy changes materially, the change is dated here and you are asked to agree again in the app.

Contact

Reeve Money is made by Peach Byte Labs, LLC. Questions, requests and reports: support@reevemoney.com.