Looking for the Beyond Normal Strength app instead? That product has its own policy at beyondnormal.app/privacy.
1. Who we are
SpendCopilot is operated by Beyond Normal. For privacy questions or to exercise your rights, contact patcrouse@gmail.com — the current monitored privacy contact for Beyond Normal and SpendCopilot.
2. What we collect and store
The backend stores a deliberately small amount of data in a single encrypted database (Cloudflare D1). This is the complete inventory:
| Data | Purpose | Notes |
|---|---|---|
| A random account identifier (UUID) | Identify your account | Not derived from any personal detail |
| Passkey public key and metadata (credential id, signature counter, transports) | Passwordless sign-in (WebAuthn) | Public key only — never a password or private key |
| Session tokens and timestamps | Keep you signed in | Expire automatically |
| Plaid Item connection: access token, institution id and name, sync cursor | Connect and sync your bank via Plaid | The access token is a credential to Plaid, not your bank password |
| Consent records (type, policy version, timestamp) | Evidence of your consent | See section 4 |
| Deletion audit records (hashed account reference, timestamps) | Prove a deletion completed | Contains no personal data |
✓ What we do NOT store
- No name or email. A display name entered at sign-up is used only to build the passkey and is not persisted.
- No bank credentials. Bank login happens inside Plaid; we never see it.
- No transaction history at rest. When the app syncs, transactions are fetched from Plaid and passed straight through to your device. The backend does not store your transactions, balances, or account numbers.
3. How we use and share data
- Bank connectivity (Plaid): we use Plaid to link your accounts and fetch transactions on demand. Your use of Plaid is also governed by Plaid's privacy policy. The Plaid access token is stored server-side so your device never handles it.
- AI assistance (Anthropic): the Copilot feature sends the conversation content your device submits to Anthropic's API to generate a response. Provide only what you are comfortable sending.
- We do not sell your data and do not use it for advertising.
4. Consent
We record your consent at the points where data handling begins, and we store the exact policy version you agreed to as evidence:
- Privacy-policy consent — recorded when you create your account.
- Plaid data consent — recorded when you link a bank account.
You can review your consent records at any time via the GET /v1/consent API. When this policy materially changes, the version is bumped and consent is requested again.
5. How we protect data
- Encryption at rest: the database (Cloudflare D1) is encrypted at rest with AES-256-GCM under Cloudflare-managed keys.
- Encryption in transit: all API traffic uses TLS.
- Secrets: API keys and the Plaid secret are stored as Cloudflare Worker Secrets (encrypted), never in source or the database.
- Least data in logs: request logs record only endpoint, HTTP status, and an error class — never tokens, personal data, or financial data.
6. Data retention
In summary: sessions and challenges are purged shortly after they expire; your account data is kept while your account is active and erased when you delete your account; consent and deletion-audit evidence is retained for a limited compliance window.
7. Your rights
Access & transparency
Retrieve your consent records via GET /v1/consent.
Deletion / right to erasure
Delete your account and all associated data via DELETE /v1/account. This erases every record tied to your account across all tables and revokes your Plaid connection at Plaid.
Disconnect a bank
Removing a linked bank revokes the Plaid Item and deletes its stored token and metadata.
When you delete your account you receive a deletion receipt. A de-identified audit record — a hash, containing no personal data — is retained only to prove the deletion occurred.
8. Children
SpendCopilot is not directed to children and we do not knowingly collect data from children.
9. Changes to this policy
Material changes bump the policy version at the top of this page and re-request consent. The version in effect when you consented is stored with your consent record.
10. This website
The sections above describe the SpendCopilot application and its backend. This website (beyondnormal.app) measures page visits using a cookieless analytics beacon so we can tell whether anyone is finding the site. It records the page you viewed, the referring site, your country, and your screen size. It sets no cookies, assigns you no persistent identifier, and cannot follow you to any other site. We cannot identify you from it, and it is never combined with anything from the app.
If you enter your email address in the launch-notification form on this site, we store that address — and which page you signed up from — in order to email you about the thing you asked about. Nothing else. Every message includes a one-click unsubscribe, and unsubscribing is permanent unless you deliberately sign up again.
Contact
Email: patcrouse@gmail.com
Subject: "SpendCopilot Privacy Policy"