Privacy Policy

Who we are

This Privacy Policy describes how Watchtower Money, LLC ("Watchtower," "we," "us," or "our") collects, uses, and protects personal information. Watchtower is a personal finance and budgeting product. This policy covers watchtower.money, the signed-in app at app.watchtower.money, and the Watchtower API that powers them.

We may add, change, or remove features. If a change affects how we handle personal information in a material way, we will update this policy and the date above.

What we collect

We collect only what we need to run Watchtower.

Earlier waitlist emails

We previously collected emails on an early-access waitlist. If we still hold yours, it is in an operations spreadsheet we control. We do not use it for ads. Email privacy@watchtower.money to ask us to delete it.

Account and household

When you create an account, sign-in is handled by Clerk. Clerk holds the login credentials and profile you give it. We store the identifiers we need to run a household: your email, display name, Clerk user id, household membership, and invitation emails you send so someone can join.

Connected financial data

If you connect a bank, you do that through Plaid. We never see or store your bank password. After you connect, we receive and store the data needed for budgeting: accounts and balances, transactions (including the original bank description), categories you assign or that we map, monthly budgets, and related settings such as category rules and alert thresholds.

Plaid also gives our servers a connection token so we can refresh accounts. That token is encrypted before it is saved. The wrapping key is not stored in the same database. In production the wrap is Google Cloud KMS. The token is not sent to your browser and is not written to logs. Details are on our Security page.

Payments

Payment is handled by Stripe. Stripe collects what it needs to charge you: card details, billing email, and invoices. Watchtower does not store card numbers, CVC, or full account numbers.

We store Stripe customer and subscription ids, plan, status, period and trial dates, refund records (including whether the first-payment guarantee was used), and billing events. We use those to decide access, to reconcile with Stripe, and to handle disputes. Names, emails, and phone numbers are not copied onto those billing rows.

Alert notifications

Alerts live in the signed-in app. If you turn on email or text notifications, we use the address or US phone number you give us to tell you that an alert is waiting. Email may include the same evidence you can already see in Watchtower. Texts do not include amounts, merchants, account names, or categories. We store that you opted in, when, and which version of the disclosure you accepted. We also store delivery status (sent, delivered, failed, or opted out) and the provider's message id so we can stop sending after a bounce or a STOP reply.

Email is sent by Resend. Texts are sent by Telnyx (or Twilio if we have to move the US messaging campaign). Those companies see the destination and the message body. They do not get your bank connections or financial data. You can turn a channel off in Settings. Texts: Reply HELP for help. Reply STOP to unsubscribe. Watchtower texts come from a US business number. Message and data rates may apply. Frequency varies.

Usage, device, and errors

Hosts see ordinary web traffic (such as IP address and browser type) to serve pages and keep the service up. The signed-in app may send crash reports to Sentry when that is turned on. Those reports use an opaque user id. They are not supposed to include your email, bank tokens, original statement text, request bodies, or cookies. The marketing site is not on Sentry.

How we use it

We use this information to:

• Create and secure your account and household
• Show balances, transactions, categories, budgets, and alerts
• Refresh connected accounts
• Invite household members you choose
• Charge for the household plan, run trials, and apply refunds
• Decide whether the household can edit, sync, or connect another bank
• Send product email that is part of running the service
• Send optional alert texts you opted into
• Fix bugs, prevent abuse, and keep the service running

We do not sell your personal information or financial data. We do not use it for advertising networks. We do not currently send your transactions to a language model to decide categories or spend totals. Category mapping and budget math are deterministic. If that ever changes, we will say so here first.

How we keep identity off money records

Email, name, and phone number are not copied onto transaction, budget, account, or billing rows. We do not offer support tools in the customer app for looking up your financial data. Your household's data is served only to people in that household. That check happens on the server.

Who we share it with

We share data with companies that help us operate Watchtower, only as needed for their job:

• Clerk: sign-in and account
• Plaid: bank connections. Plaid's own privacy policy applies to the login and data they provide
• Stripe: payment processing, invoices, cards, receipts, and refunds. Stripe's privacy policy applies to what it collects
• Vercel: hosting for the marketing site and product app, plus Vercel Analytics on the marketing site
• Google: waitlist emails we still hold, stored in a spreadsheet we control
• Resend: transactional email (invites, billing, alert mail)
• Telnyx (or Twilio if the messaging campaign moves): optional alert texts
• Sentry: error reports for the app and API when a project key is configured
• Google Cloud: hosting the API and production database (Cloud Run, Cloud SQL), plus Cloud KMS and Secret Manager for connection wrap and application secrets

We may also disclose information if the law requires it, or if we need to protect Watchtower, our users, or the public from fraud or security threats. If Watchtower is ever sold or merged, this information would move with the product under this policy or a successor policy we will post.

Household members you invite can see that household's financial data. That is the point of a shared household. Invite only people you trust.

Cookies

The marketing site uses Vercel Analytics. It is meant to measure traffic without advertising cookies.

The signed-in app uses cookies that are required to run the product: Clerk session cookies so you stay signed in, a theme preference cookie, and short-lived cookies while you accept a household invite. We do not use advertising cookies.

How long we keep it

Waitlist email we still hold is kept until you ask us to remove it.

Account and financial data is kept while your household exists. If you stop paying, we keep history as read-only and we remove bank connections at Plaid. If you disconnect a bank or remove an account, we purge that connection's imported transactions. If you delete your household in the app, we delete that household's accounts, transactions, budgets, and bank connections as designed, and we cancel the Stripe subscription. The Plaid connection token is dropped on disconnect, retire, or household delete. Clerk account deletion is available in settings.

Billing records (Stripe ids, plan, status, dates, refund flags, and billing events) are kept for accounting and disputes even after a household is deleted. They do not include card numbers or copied names and emails. Stripe retains invoices as its business records. We do not delete the Stripe Customer when a household is deleted.

Encrypted database backups and point-in-time recovery logs are kept for 7 days. Application logs on Google Cloud are kept for 30 days. Error reports in Sentry (Developer plan) are kept for 30 days and are not supposed to include books. Vercel request logs are short-lived and are not a backup of your financial data.

A household delete does not wipe those backups instantly. Deleted data can remain in an encrypted backup or recovery log until that 7-day window ages out. The next daily backup is the first one that no longer contains the deleted household.

Your choices

You can:

• Disconnect a bank in the app
• Edit categories, budgets, and household membership in the app
• Turn alert email or texts on or off in Settings → Notifications
• Manage billing in Settings → Billing (owner)
• Delete a household you own, which removes that household's financial data
• Ask us to delete waitlist email, or to export or delete account data we hold

Email privacy@watchtower.money. Tell us the email on the account or waitlist. We will need enough to confirm it is you. Billing questions: legal@watchtower.money. We do not sell personal information, and we do not share it for cross-context behavioral advertising. If a privacy law where you live gives you additional rights (access, correction, deletion, restriction), email us and we will handle the request as that law requires.

Children

Watchtower is for adults who can connect a bank account. It is not directed at children under 18. We do not knowingly collect personal information from children. If you think we have, email us and we will delete it.

Where data is processed

Watchtower Money, LLC operates from the United States. Our processors listed above also run primarily in the United States. If you use Watchtower from another country, you understand your information is processed in the U.S.

Changes

We will post updates on this page and change the effective date. Continued use after an update means you accept the revised policy. If we ever need consent for a new use, we will ask.

Contact

Watchtower Money, LLC

Privacy: privacy@watchtower.money

Billing: legal@watchtower.money

Security: security@watchtower.money

How we handle bank connections is described on Security. Use of the product is also covered by our Terms and Refund and Cancellation policy.