Privacy Policy

Last updated: 29 May 2026

This Privacy Policy explains what information Talverra ("we", "us") collects from you, how we use it, and the rights you have over it. It applies to the Talverra mobile app and any future web experience under the talverra.app domain (collectively, the "Service").

Short version: Talverra stores the bills, debts, income, financial goals, and budget you set up — plus, if you connect a bank account or biller, the account names, balances, and transaction history needed to keep your dashboard accurate. We hold this so the app works across your devices and survives reinstalls. We don't sell your data, we don't use it for advertising, and you can delete everything at any time.

1. What we collect

1.1 Account information

When you create an account, we collect:

Email address — to sign you in and contact you about your account.
Display name — only what you choose to enter.
Authentication identifiers — if you sign in with Apple or Google, we receive a stable user identifier from those providers (but not your password).

1.2 Financial information you enter

Talverra is a personal-finance tool. Much of what we store is information you type in directly so the app can track and project your finances over time. That includes:

Bills — name, amount, due date, recurrence pattern, full payment history, and any notes you add.
Debts — creditor name, balance, minimum payment, interest rate (APR), and due day.
Income sources — name, amount, frequency, and day of month you're typically paid.
Financial goals — target amount, target date, category, and progress to date.
Budget targets — your monthly spending targets per category.
Net worth history — monthly snapshots of your overall position over time. The historical record is captured at each point in time; we keep it so your chart shows your real progress.
Retirement plan inputs — target retirement age, monthly contribution, expected return assumption.
Investment positions — holdings you enter manually for accounts that aren't connected via Plaid.
Credit score values you enter or pull from third-party providers.
Payment-method labels — which of your cards or accounts you use to pay each bill.

This information is stored in your own private partition of our backend. No other user can read it, and Talverra staff cannot read it in the ordinary course of business (Firebase security rules enforce per-user isolation server-side; only the project owner, with a specific administrative claim, can access cross-user data, and any such access is logged).

1.3 Information from connected bank accounts (Plaid)

If you choose to connect a bank account through Plaid, Plaid acts as an intermediary between your bank and Talverra. With your consent inside Plaid's flow, Plaid sends us:

The institution name and a masked identifier for each connected account (typically the last four digits of the account number).
The account type (checking, savings, credit card, loan, investment, etc.).
Current balance.
Transaction history (date, amount, merchant or counterparty, category as classified by Plaid).

We cache this information in our backend so your dashboard loads quickly, your bills can be matched against real transactions, and you don't have to relink every bank on every device. We do not receive your bank username, password, or full account number — Plaid handles those credentials directly and never shares them with us. The long-lived Plaid access token that allows ongoing bank reads is held only by our server-side cloud functions, never by the app on your device.

1.4 Information from connected billers (Method Financial)

If you choose to connect a biller through Method Financial, Method acts as an intermediary between your biller (utility, credit card issuer, lender, etc.) and Talverra. Method sends us account-level information about the biller (account name, balance, next payment due, payment history). We do not receive your biller login credentials — Method handles those directly. The Method access token is held server-side only.

1.5 Onboarding answers

When you go through onboarding we ask you what areas of personal finance you want help with, your life situation, and your goals. This is used to personalize the dashboard and recommendations. We may use aggregate, non-identifying versions of these answers to understand what people use the app for.

1.6 Subscription state

If you subscribe to Talverra Plus or Premium, we store your subscription status (active / expired / cancelled), the product you bought, and renewal information. Billing itself runs through Apple or Google — we never see your card number.

1.7 Diagnostic information

Like any modern app, we collect minimal diagnostic information for stability:

Crash reports (no personal data attached).
App version and operating system version.

2. What we do NOT collect

Your bank or biller login credentials. Plaid and Method handle those directly with the institution; the credentials never reach Talverra. The long-lived access tokens that authorize ongoing reads are held only by our server-side cloud functions, not by the app on your device.
Your full account or routing numbers. Plaid and Method only return masked identifiers (typically the last four digits) for display purposes.
Your card numbers. Subscription payments run through Apple Pay / Google Pay.
Location data. We don't ask for it and we don't use it.
Your contacts, photos, or microphone. The app doesn't request these permissions.
Advertising identifiers (IDFA, AAID). We don't track you across other apps.

3. How we use your information

To run the Service — show your bills, calculate your projections, send reminders you've configured.
To improve the Service — in aggregate and de-identified form only.
To contact you — for important account or service notices.
To enforce our Terms of Service and prevent abuse.

We do not sell your information, share it with advertisers, use it for ad targeting, or feed it into AI training data.

4. Where your data lives

Your data is stored in Google Cloud Firestore in the United States (us-central1 region). Authentication is handled by Firebase Authentication. Both are services operated by Google LLC. Their security and privacy practices are described at cloud.google.com/security and policies.google.com/privacy.

If you live outside the United States, your data will be transferred to and processed in the United States. By using Talverra, you consent to that transfer.

5. Third parties we share data with

We share information with a small number of service providers, only as needed to run the Service:

Firebase / Google Cloud (database, authentication, cloud functions) — Google LLC.
RevenueCat (subscription state management) — RevenueCat, Inc. Subscription events flow from Apple/Google → RevenueCat → our webhook. RevenueCat's privacy policy.
Apple / Google — when you sign in with Apple or Google, or pay through their stores.
Finnhub (stock-quote API) — only when you view market widgets. No personal data is sent.
Plaid (bank-account connectivity) — only when you choose to link a bank account. Plaid receives your credentials, returns an access token to our server, and from then on streams account and transaction data to us as you use the app. Plaid's own privacy practices are described at plaid.com/legal.
Method Financial (biller connectivity) — only when you choose to link a biller. Method receives your biller credentials, returns an access token to our server, and streams biller account data to us. Method's privacy practices are described at methodfi.com/legal/privacy.

We do not sell or rent your personal information to anyone.

6. Your rights and choices

6.1 Delete your account

You can delete your account at any time from Settings → Account & Security. When you do, we hard-delete every record we hold about you: bills, debts, income, financial goals, budgets, net worth history, retirement and investment inputs, payment-method mappings, settings, onboarding answers, cached bank account data, cached biller data, transaction history, and registered device tokens. Connected Plaid items and Method accounts are unlinked at the same time so no further data is pulled from your bank or billers. Your top-level account record is kept as a deletion marker (a single timestamp) to prevent re-creating an account with the same email — but no personal data beyond that marker remains.

6.2 Export your data

You can export your bills as a CSV file from Settings → Export All Bills.

6.3 California residents (CCPA)

If you're a California resident, you have the right to:

Know what categories of personal information we've collected about you.
Request deletion of your personal information.
Opt out of the "sale" of your personal information. (We don't sell personal information, so there's nothing to opt out of, but you have the right anyway.)
Be free from discrimination for exercising any of these rights.

To exercise any of these rights, email support@talverra.app from the address tied to your account.

6.4 EU / UK residents (GDPR)

If you're in the European Union, United Kingdom, or Switzerland, you have the rights of access, rectification, erasure, restriction of processing, data portability, and objection. Email support@talverra.app and we'll respond within 30 days.

The legal basis on which we process your data is your consent (you signed up) and the performance of a contract (you're using the Service).

6.5 Push notifications and biometric lock

You can disable bill reminders and other push notifications at any time from Settings → Notifications. You can disable Face ID / Touch ID lock from Settings → Account & Security.

7. Children

Talverra is not directed at children under 13. We don't knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, email support@talverra.app and we'll delete the account.

8. Security

We use Firebase security rules to ensure one user can never read or write another user's data; the rules are enforced server-side on every request. Communications between the app and our backend are encrypted in transit using TLS. Data at rest in our backend is encrypted by Google Cloud (AES-256). The long-lived access tokens that authorize ongoing reads from Plaid and Method are held in Google Secret Manager and are accessible only to our server-side cloud functions, not to the app on your device or to Talverra staff in the ordinary course of business. We rely on Apple, Google, and our underlying cloud providers to maintain the underlying infrastructure security.

No system is perfectly secure, however. If you suspect your account has been compromised, change your password immediately and email support@talverra.app.

9. How long we keep your data

While your account is active — we keep everything described in Section 1 for as long as you're using the Service.
After you delete your account — we immediately delete every category listed in Section 6.1 (bills, debts, income, goals, budgets, net worth history, retirement and investment inputs, payment-method mappings, settings, onboarding answers, cached bank and biller account data, transaction history, and device tokens). The deletion marker described in Section 6.1 stays indefinitely so no one can recreate an account under the same Firebase Auth identity.
Subscription / billing records — kept for as long as legally required for tax and refund purposes (typically 7 years in the US). These are subscription metadata only (Apple/Google in-app purchase events), not your financial data.
Backups — Firebase rolls automated backups for disaster recovery. Backups are encrypted and inaccessible to staff in the ordinary course of business; deleted data is purged from backups within 90 days.

10. Changes to this policy

We'll update this page if we change how we handle your data. If the change is material, we'll let you know in the app and ask you to acknowledge the new version before you continue using Talverra. The "Last updated" date at the top of this page is the source of truth for the current version.

11. Contact us

Email: support@talverra.app

For feedback or feature requests: feedback@talverra.app

This policy was last updated on 29 May 2026. Earlier versions are kept in our source control history.