Jones Finance Privacy Policy

Effective October 17, 2026

1. Who we are

Jones Finance is a private budgeting app for one household in Ontario, Canada. Brian Jones runs it as a personal project, not a business, and only two people can use it: Brian and his partner. If Brian connects his company's Wise account, it is kept on a Business page only he can see (see "What each person can see").

This policy explains what the app collects, why, who it is shared with, how long it is kept and how to have it deleted. In this policy, "we" means Jones Finance and "you" means either of its two users.

• Effective date: October 17, 2026
• Contact: Brian Jones, bvjones03@gmail.com

2. Information we collect

• From your Google account, when you sign in: your name and email address.
• For the second step of signing in: after Google, the app asks for a code from your authenticator app, one of your passkeys (Face ID, Touch ID, Windows Hello or your phone) or a backup code. For this it keeps the key your authenticator app uses, encrypted; for each passkey, only its public key and when it was added and last used (the fingerprint or face check never leaves your device); and your backup codes only as one-way hashes, so even the app can't read them back.
• From your financial institutions, through Plaid, for the accounts you choose to connect: account names and types, the last four digits of account numbers, balances, transactions (date, amount, description, merchant and category), investment holdings (securities, quantities and values) and, where your institution supports it, credit card or loan details such as statement balances and due dates.
• From bank files you import: when Plaid can't connect a bank (RBC, for now), you can download a transactions file from your bank's website (Quicken, Microsoft Money or CSV) and import it. For every account in the file, the app keeps the same details it would get through Plaid: the account name and type, the last four digits of the account number, transactions (date, amount, description and, when given, the merchant) and, when the file has it, the balance. It doesn't keep the file. If you use the RBC refresh helper on your own computer, it opens a browser window of its own where you sign in to RBC yourself; it then reads your accounts' names, balances and transactions from RBC's online banking in that window (or downloads the files), imports them for you, deletes any files afterwards (or, if an import doesn't finish, keeps them only in a private folder on your computer until you import or discard them), and never sees or keeps your RBC password. It can also download the RBC statements (PDF files) you don't have in the app yet and add them to your documents, private to you, then delete its copies.
• From Wise, if you connect it: you create a read-only token on wise.com and paste it into the app. The app uses it only to read the Wise profiles you choose (your personal profile and, for Brian, his business profile): each balance's name, currency and amount, and its transactions (date, amount, fees, description, merchant and Wise's merchant category). It doesn't keep your name, address or the bank details shown on Wise statements. You can revoke the token on wise.com at any time.
• What you enter yourself: budgets, categories and category rules, notes, which purchases are shared, payments between the two of you, mortgage terms (amount, rate, payment schedule), estimates of your home's value, purchases you mark "Not a double charge", the kinds of reminder you hide on Home, savings goals, tax planning figures (including which purchases are medical expenses or donations), for Brian the invoices he expects his company to be paid, one-off or repeating, and the part of each he expects to pay himself, and investment holdings you import from a Wealthsimple holdings report. The app keeps the holdings from that report, not the file.
• Documents you upload: files you choose to keep in the app, such as tax slips, tax returns, bills, invoices, receipts and statements (including RBC statements the refresh helper adds for you), with the details you add (title, kind, tax year and date). A document can contain sensitive details, such as the Social Insurance Number on a tax slip or full account numbers on a statement or bill.
• Technical information: a cookie that keeps you signed in, a cookie that remembers which second step each device used last (just that word), and standard server logs kept by our hosting provider, such as IP address, browser type and the time of each request.

We never see or store your bank username or password. You enter those in Plaid Link, and they go to Plaid, not to us. A Wise token you paste is stored encrypted, like the keys Plaid gives the app, and is never shown again. Apart from what appears in documents you choose to upload, we do not collect full account or transit numbers, your Social Insurance Number or identity documents. A bank file you import contains full account numbers, but the app keeps only the last four digits and never stores the file. The app keeps each document exactly as you uploaded it. It reads what's inside only when you ask it to read the figures from a tax return or notice of assessment you uploaded (PDFs only): it shows you the figures it found, keeps only the ones you confirm in your tax planning figures, and doesn't keep, log or send anything else it read. The app has no advertising, analytics or tracking cookies.

3. How we use your information

We use your information only to:

• show your balances, spending, budgets and investments
• suggest a category for each transaction, learned only from your own choices and worked out inside the app, never by an outside service
• calculate the shared household split
• produce personal tax planning estimates
• keep your documents in one place for your records and tax preparation
• keep the app secure, fix problems and prevent misuse

What each person can see: you see your own accounts and transactions in full. Accounts you share, such as a joint account, are visible in full to both users. For accounts you keep personal, the other user sees only your spending totals by category, never individual transactions, unless you choose to share that account in full. Brian's business Wise account, if he connects it, is visible only to him on its own Business page and is never counted in the household views, budgets, the split or tax. Documents you upload are visible only to you unless you share them; a shared document can be seen and downloaded by both users. Estimates of your home's value are visible only to you and count only in your own net worth. The invoices and repeating income Brian enters on his Business page are visible only to him, and only the part he expects to pay himself counts, in his own Forecast.

We do not sell your information, use it for advertising, or use it to make credit or other decisions about you.

4. Your consent and choices

• You agree before anything is connected. The app shows you this policy and asks for your agreement before Plaid Link opens, a bank file can be imported or Wise can be connected. You then connect accounts yourself through Plaid Link, which shows Plaid's own consent screen.
• You choose the accounts. Plaid Link lets you pick which accounts to share, and the app then asks you to confirm which of those it may store. Anything you don't approve is discarded. For a bank file, choosing the file is the choice: every account in it is stored as yours, and "Stop storing" leaves an account out of later files too. For Wise, you choose which profiles to bring in; every balance in them is stored as yours, and "Stop storing" leaves one out.
• You can disconnect at any time. On the Connections page, "Stop storing" deletes one account's data and stops collecting it, while the connection stays; "Remove connection" ends the whole connection with Plaid and deletes its data from the app.
• You choose what to upload. You can share or stop sharing a document, and delete it at any time. Deleting a document is permanent.
• You can withdraw your consent completely by deleting all of your data yourself (Settings, "Delete my data"), or by asking us to (see section 8).
• Plaid's role: by connecting an account, you allow Jones Finance and Plaid to access your financial information from your institution on your behalf. Plaid handles that information under the Plaid End User Privacy Policy. Plaid Portal (my.plaid.com) serves US users; in Canada, end a connection with the app's "Remove connection" button, or ask Plaid through Plaid Support to delete what it holds.

5. Who we share it with

We share information only with the service providers that run the app, and only what each one needs:

• Plaid connects to your financial institutions and passes your account data to the app.
• Wise, if you connect it, gives the app your Wise balances and transactions when it asks with your token. The app only reads; it sends Wise nothing about you.
• invoice-generator.com, when Brian creates an invoice in the app, receives what's on that invoice (his business's details as he enters them, the client, the items, amounts and dates) and sends back the PDF, which the app keeps in his Documents, private to him. It says it doesn't store invoice data. Nothing else is sent to it.
• Vercel hosts the app and stores the documents you upload.
• Neon hosts the app's database.
• Google handles sign-in.

Each provider protects your information under its own security and privacy terms. We never sell or rent your information or share it with advertisers or data brokers. We would only disclose it to anyone else if the law required us to.

6. How we protect it and where it is stored

• Every connection to the app is encrypted with TLS 1.2 or higher.
• Stored data is encrypted. Plaid access tokens get an extra layer of AES-256-GCM encryption, with the key kept separately from the database.
• Documents are kept in private, encrypted storage that can only be reached through the app, after it checks that you're signed in and allowed to see that document. Your browser never gets a direct storage address.
• Only the two household members can sign in, using Google accounts protected by 2-Step Verification, and then a second step in the app itself (an authenticator app, a passkey or a backup code) on every new sign-in. After five wrong tries, the second step locks for five minutes. Only Brian can administer the app, and every administrative account uses multi-factor authentication.
• The app's database and your documents are stored in the United States (Ohio), and our providers may also process your information elsewhere outside Canada. While it is there, it is subject to that country's laws, which may allow its authorities to access it.

The full set of safeguards is in the Jones Finance Information Security Policy.

7. How long we keep it

• Account data is kept while the account stays connected. Transactions are kept for no more than seven years from their date.
• When you remove a connection, its connection with Plaid ends and its data is deleted from the app straight away. Removing a bank file connection deletes the accounts and transactions imported from those files straight away. Removing a Wise connection deletes its token, balances and transactions straight away; revoke the token on wise.com to end it there too. When you stop storing an account, that account's data is deleted straight away.
• Documents are kept until you delete them, ask us to delete your data, or your access ends. A deleted document is removed straight away and can't be recovered.
• What the app keeps for your second step is kept while you have access. When you replace your authenticator app, remove a passkey or make new backup codes, the old ones are deleted straight away, and all of it goes with "Delete my data".
• When you use "Delete my data", everything is deleted straight away except one record that the deletion happened (the time and your email address). If you ask us instead, we do it within 30 days and confirm when it is done.
• A record of sign-ins and changes (who did what and when, never account numbers, amounts or document contents) is kept for two years, then deleted automatically.
• When you change several transactions at once, the app keeps which ones and the category and shared tag each had, so you can undo it for 30 minutes; then it's deleted.
• If your access to the app ends, your connections are removed and your data deleted within 30 days. Data from an account the other user still has connected in their own name, such as a joint account, stays under their connection.
• Deleted data can remain in our database provider's encrypted backups for up to 30 days before those backups expire.
• If the app shuts down, all connections are removed and all data is deleted.

8. Your rights and how to reach us

You can ask us to:

• show you the information the app holds about you
• correct anything that is wrong
• delete some or all of your information (you can also delete all of it yourself, in Settings)
• stop using your information, by withdrawing your consent

Email Brian Jones at bvjones03@gmail.com. We respond within 30 days.

9. Changes to this policy

We review this policy every year and whenever the app changes how it handles information. Before a material change takes effect, we tell both users and update the effective date in section 1.