Tomi · Privacy Policy

Effective date: 2026-06-09

This is the privacy policy for Tomi ("we," "us," or "the Service"). Tomi is a US-based, web-first, read-only personal finance application currently operated as a sole proprietorship by Kyle Speare. We are operating in closed beta. By using the Service you agree to the practices described in this policy.

This policy is a faithful description of how we actually handle information. If a practice changes, we will update this document, change the effective date above, and where the change is material we will notify you in-app or by email before it takes effect.

Canonical source. This document is mirrored at /legal/privacy for reading in the app. The Markdown file at docs/PRIVACY.md is the authoritative text. Keep the route content in sync with this file when editing.

1. Information we collect

We collect only the information we need to operate the Service. The categories below describe everything Tomi receives, derives, or stores about you.

1.1 Information you provide

• Account identity. When you sign up, our identity provider (Clerk) creates an account for you and stores your email address, your name (if you provide it), and your authentication credentials. Tomi does not store your password.
• Profile and settings. Your timezone, default currency, and any in-app preferences you configure.
• User-generated content. Custom categories you create, category overrides on individual transactions, hidden/excluded flags, budgets and goals you define.
• Communications. When you email us at the contact address in § 11, we receive your message and any attachments.

1.2 Information from your bank, via Plaid

To populate your dashboard, you grant Tomi permission to retrieve your banking data through Plaid Inc. ("Plaid"). When you connect an institution, Plaid returns to Tomi:

• A short list of accounts (institution name, account name, account type, account mask — i.e., the last 4 digits of the account number — and current balance at the time of sync).
• Transaction history for those accounts (posted date, authorized date, amount, merchant name, transaction name, Plaid's Personal Finance Category classification, and the pending flag).
• A Plaid-issued access token that lets Tomi retrieve future updates for those accounts on your behalf.

Tomi does not see, store, or transmit your online banking username or password. Those credentials are entered into Plaid's interface and never reach Tomi.

1.3 Information about your use of the Service

• Application logs. Standard request logs (timestamps, IP addresses, user agents) and structured error reports for diagnostic purposes.
• Audit records. Security-relevant actions you take (revoking an institution, exporting your data, deleting your account) and administrative reads of your data by Tomi (which we strictly limit and log — see § 4 and § 5).
• Waitlist signups. If you join the early-access waitlist on our landing page, the email address you submit and the signup date are stored with our identity provider (Clerk) and used for exactly one purpose: contacting you about access to Tomi. Waitlist emails are not shared, not enriched, and not used for any other marketing. To be removed before you ever create an account, email privacy@tomi.money.

1.4 Cookies and similar technologies

We use cookies set by our identity provider (Clerk) to keep you signed in, and a small number of first-party cookies for security state. We do not run third-party advertising or analytics cookies, we do not use cross-site trackers, and we do not load third-party advertising scripts.

For product analytics we use Vercel Web Analytics, a privacy-preserving, cookieless measurement tool that counts page views, aggregate visits, and anonymous interaction events (for example, which frequently-asked question on our landing page gets opened most) without cookies, without cross-site tracking, and without collecting personally identifying information. Page paths that contain identifiers are recorded only as their route pattern (for example, /admin/users/[id] rather than a specific ID), so your data is never embedded in analytics.

1.5 Information we do not collect

We do not collect Social Security numbers, driver's license numbers, government identification numbers, geolocation, biometric data, contacts, photos, health information, or information about minors (see § 8).

2. Sources of information

Information about you comes from three sources only: (a) you, when you create your account or interact with the Service; (b) your bank, via Plaid, when you authorize a connection; and (c) the Service itself, in the form of application logs, audit records, and information derived from the data above (for example, your spending totals by category, which we compute from the transactions Plaid returns).

3. How we use information

We use the information we collect for the following purposes, and no others.

• To operate the Service. Display your accounts, transactions, balances, and derived insights to you.
• To synchronize with your bank. Periodically pull new transaction and balance updates from Plaid using the access token you authorized.
• To secure the Service. Detect and respond to abuse, unauthorized access, and security incidents.
• To comply with the law. Respond to subpoenas, court orders, and other legal process where we have a good-faith basis to do so.
• To communicate with you. Send transactional messages (account confirmations, security notices, responses to your inquiries). We do not send marketing emails.

We do not sell your personal information. We do not "share" your personal information for cross-context behavioral advertising as that term is defined under California law. We do not use your data to train machine-learning models.

4. How we share information

We share your information only with the service providers we need to operate Tomi, only with the categories of data each one needs, and only under written safeguards.

We document our diligence on each of these providers in our Vendor Inventory (see docs/VENDORS.md). Each provider is contractually required to safeguard your information and to use it only on our instructions.

We will also disclose information when we believe in good faith that the law requires it (for example, a valid subpoena), when necessary to investigate or prevent fraud or harm to a user, or in connection with a merger, acquisition, or sale of all or substantially all of Tomi's assets — in which case we will tell you before your data moves to a new owner.

5. How we protect information

We maintain a written information security program (see docs/INFOSEC.md) and a risk assessment that drives our control decisions (see docs/RISK-ASSESSMENT.md). At a high level:

• Encryption. All data in transit between you, Tomi, and our providers is protected by TLS 1.2 or higher. Data at rest in our database is encrypted by Supabase. Plaid access tokens receive an additional layer of encryption via Supabase Vault before they are stored, and are decrypted only ephemerally during a Plaid API call.
• Access control. Every database read of your data is scoped to your user identity by Row-Level Security policies; cross-user reads are not possible through our application. Administrative access is limited to a single designated person, requires multi-factor authentication, and every administrative read is logged.
• Auditing. We keep an audit log of security-relevant events (institution disconnects, data exports, account deletions, administrative reads) and review it during incident response.
• Rate limiting. Per-route per-user rate limits protect against scraping and abuse.
• Vulnerability management. We track and patch dependency vulnerabilities and follow advisories for our platforms.
• Incident response. We maintain an incident response plan (see docs/INCIDENT-RESPONSE.md) and a process for notifying affected users and regulators where required.

No system is perfectly secure. We commit to handling your information with care commensurate with its sensitivity, but we cannot guarantee absolute security.

6. How long we keep information

We keep your information while your account is active. Specific retention rules:

When you delete your account, we soft-delete your profile and rename the email address to a synthetic value so the address can be reused by a future sign-up, while preserving the original email in the audit record for the audit retention window. A scheduled job hard-deletes soft-deleted profiles after the retention window.

7. Your choices and rights

You can exercise the following rights at any time from within the Service. Where the Service does not yet offer a self-service control, contact us at the address in § 11.

7.1 Access and portability

You can download a copy of all of the data Tomi holds about you, in a machine-readable JSON format, by clicking Download my data at /dashboard/settings. The export covers your profile, settings, connected institutions (without access tokens), accounts, transactions, categories, budgets, goals, insights, and subscription state. We log the export in the audit record.

7.2 Revocation of bank authorization

You can revoke Tomi's authorization to access a specific institution at any time from /dashboard/settings by clicking Disconnect next to the institution. Tomi will instruct Plaid to remove the connection, delete the corresponding access token, and delete the accounts and transactions associated with the institution from our database.

7.3 Deletion

You can delete your Tomi account at any time from /dashboard/settings. We will disconnect every institution, delete the corresponding tokens and data, and remove your identity record from our identity provider. The deletion includes a soft-delete window during which audit records are preserved for compliance purposes.

7.4 Correction and other rights

Most data you see in Tomi is sourced from your bank via Plaid; corrections to that data are made at the source. To correct profile information (name, email), update your account settings. To exercise any other right — access to specific records, restriction, objection, opt-out from a specific use — email us at the address in § 11. We will respond within 45 days of receiving a verifiable request, or sooner where the law requires.

7.5 State-specific rights

Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws may have additional rights under those laws (for example, the right to designate an authorized agent, the right to non-discrimination for exercising your rights, and the right to appeal a denied request). We honor those rights. To exercise them, email us at the address in § 11 and identify your state of residence.

7.6 We do not sell or share

We do not sell your personal information for money or other valuable consideration. We do not share your personal information for cross-context behavioral advertising. Because we do neither, opt-outs under the California "Do Not Sell or Share" right are not applicable to Tomi, but we honor a Global Privacy Control signal where we detect one and will treat it as confirmation that you have opted out of sale and sharing, even though we conduct neither.

7.7 Verification

For deletion, export, and other rights requests, we must verify that the request comes from you. For account-holders, the in-app controls verify you through your Clerk session. For email requests, we will ask you to confirm details only the account holder would know.

8. Children

The Service is not directed to children under 13, and we do not knowingly collect information from children under 13. The Service is also not intended for users under 18; we require account-holders to be at least 18 years old per our Terms of Service. If you believe a child has provided us information, contact us at the address in § 11 and we will delete the information.

9. International users

The Service is currently intended for users physically located in the United States. We do not operate in the EU or UK; the Service is not directed to users in those regions. If you access the Service from outside the United States, you do so on your own initiative, and you understand that your information will be processed in the United States, which may have data protection laws different from those of your country.

10. Changes to this policy

We may revise this policy from time to time. When we do, we will update the effective date at the top of this document. If a change is material, we will notify account-holders in-app or by email before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the revised policy. We keep a change log at the bottom of this document.

11. How to contact us

For privacy questions and general inquiries related to this policy, contact us at privacy@tomi.money.

For data-rights requests — access, deletion, correction, portability, revoke Plaid authorization, or any other right listed in § 7 — contact us at dsr@tomi.money. Our full intake and response process is documented at docs/DSR-PROCESS.md in our public repository; the summary is:

• We acknowledge your request within 10 business days of receipt.
• We complete verifiable requests within 45 days of receipt. We may extend once by up to 45 additional days when reasonably necessary and will tell you before the original deadline.
• For requests that arrive from your account's registered email address, that address is our verification factor. For requests from a different address, we will ask you to re-send from the account address or authenticate through the Service.

If you prefer to use the self-service surface, most of these rights are already fulfilled instantly at /dashboard/settings (Download my data, Delete account, Disconnect a bank connection).

12. Change log