Privacy policy

Last updated: October 23, 2026

Envolo ("we," "us," or "our") operates the Envolo mobile application (the "App"). This Privacy Policy explains how we collect, use, store, and protect your information when you use the App.

1. Information we collect

a. Account information

When you create an account, we collect your email address and password, or account profile information (name and email) if you sign in with Google or Apple.

b. Financial profile information

During onboarding and use of the App, you may provide: annual salary or hourly rate; U.S. state of residence; tax filing status; pay frequency; job title and employer name; signing bonus, annual bonus, RSU/equity, and commission details; 401(k) contribution and employer match percentages; Roth IRA and mega-backdoor Roth contributions; health, dental, vision, and HSA deduction amounts; monthly rent and debt payments; emergency fund balance; savings goals; and retirement planning details such as birth year, retirement age, and investment balances.

c. Bank and investment account data (via Plaid)

If you choose to link your accounts, we use Plaid, Inc. ("Plaid") to access data from your financial institutions. For bank and credit card accounts, we receive account names, types, the last four digits of account numbers, balances, and up to about four months of transaction history, including amounts, dates, merchant names, and categories. For brokerage and retirement accounts, we receive account balances, holdings, and retirement contributions. Envolo can only read this data. It cannot move money. We do not receive or store your bank login credentials; those are handled entirely by Plaid. Your use of Plaid is also subject to the Plaid End User Privacy Policy.

d. Uploaded documents

You may upload offer letters or pay stubs for AI-powered parsing. These documents are sent to our AI service provider for processing and are not stored on our servers after parsing is complete.

e. Device and usage information

The App does not include analytics or advertising tools, and we do not collect advertising identifiers or device fingerprints. Like any internet service, our hosting providers process your IP address to deliver requests and may keep it briefly in service logs for security and troubleshooting. The App stores authentication tokens securely on your device using the platform keychain (iOS Keychain / Android Keystore).

2. How we use your information

We use the information we collect to: calculate your take-home pay and tax withholdings; generate personalized monthly budgets using AI; track your spending against your budget; calculate your Financial Score; project your future net worth; compare job offers; recommend credit cards based on your spending patterns; power the AI financial assistant ("Ask" feature); and authenticate your account and maintain your session.

3. Third-party service providers

We share data with the following service providers, solely to operate the App:

• Supabase — authentication and secure database hosting for your profile and linked account records.
• Railway — hosting for our API servers, which process requests between the App, Plaid, and our AI provider.
• Plaid — bank and investment account linking and data retrieval. Plaid acts as an intermediary between you and your financial institution.
• Anthropic (Claude AI) — AI-powered budget generation, document parsing, job offer comparison, and the Ask financial assistant. When you use these features, we send Anthropic the information that feature needs, such as your income, budget, spending totals by category, and upcoming bills. We do not send raw transaction lists, account numbers, or bank credentials. Under Anthropic's commercial terms, this data is not used to train its models.
• Google — if you choose Google Sign-In for authentication.
• Apple — if you choose Sign in with Apple for authentication.

4. Data storage and security

Your profile data is stored in a secure, hosted PostgreSQL database provided by Supabase. Plaid access tokens are stored only on our servers and are never sent to the App. Your transactions pass through our servers when they sync but are not stored there; we store only your spending totals by category and the time of your last sync. Your full transaction history, budget, and preferences are stored on your device. Authentication tokens are stored in your device's secure keychain. We use HTTPS encryption for all data in transit and rate limiting on our API.

5. Data we do not collect or share

We do not sell, rent, or trade your personal information, and we do not share it for cross-context behavioral advertising. We do not use tracking pixels, cookies, or cross-app tracking. We do not share your data with data brokers or advertisers.

6. Credit card recommendations

The App may recommend credit cards based on your spending patterns. These recommendations may contain links to credit card application pages. We may receive compensation if you apply through these links, but this does not affect the recommendations shown to you or the data we collect.

7. Data retention and deletion

We retain your data for as long as your account is active. You can disconnect a linked account at any time, which revokes our access to it through Plaid. You may delete your account and all associated data at any time in Profile by selecting Delete account, or by contacting us at the email below. When you delete your account, we revoke Plaid access for every linked bank and investment account, delete your profile and linked account records from our servers, and remove your login. Locally stored data on your device can be cleared by uninstalling the App.

8. Children's privacy

The App is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from minors. If we learn that we have collected information from a child under 18, we will promptly delete that information.

9. Your rights

Depending on your jurisdiction, you may have the right to: access and receive a copy of your personal data; correct inaccurate data; request deletion of your data; object to or restrict certain processing; and withdraw consent at any time. To exercise these rights, contact us using the information below. We will not treat you differently for exercising them.

California residents. Under the California Consumer Privacy Act, you have the right to know what personal information we collect, use, and disclose; to request deletion or correction of it; and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined in that law. The categories of information we collect and the providers we disclose it to are listed in sections 1 and 3.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date above and, where appropriate, providing notice within the App. Your continued use of the App after changes constitutes acceptance of the updated policy.

11. Contact us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at chaptrauth@gmail.com.