Privacy Policy

1. Introduction

DALS Technology, Inc., a New York corporation with its principal place of business in Melville, New York, doing business as Financial Fitness Passport (“FFP,” “we,” “us,” “our”), provides the Financial Fitness Passport website, mobile apps and related services (“App”) only to users in the United States. This Privacy Policy describes collection, use, disclosure, retention and choices for account users, public Penny demo participants, event participants and visitors. We design these practices to meet applicable U.S. state requirements that apply to us, including New York’s SHIELD Act security and breach duties. FFP is a personal-finance education product and is not directed at collecting clinical health records. If a New York health-information privacy law later applies to data we hold, we will update this notice.

This notice is not a substitute for any separate consent required by law. Using the App does not by itself constitute consent to optional advertising, program texts or another processing activity for which we request a separate choice. Our Terms at https://financialfitnesspassport.com/legal/terms govern use; mandatory privacy rights are not waived.

2. Information We Collect

Personal Information

We collect information that you provide directly to us, including:

• Account Information: Name, email address, authentication credentials handled by Firebase Authentication, and account credentials
• Mobile Number (optional): A cell phone number, if you choose to give one, so that Penny can call you or we can text you. You may create and use an account without one. See "Text Messages" in Section 12
• Verification Data: Email verification status and verification timestamps
• Profile Information: User preferences, settings, and customization choices

Financial Information

You may choose to provide sensitive financial data, including:

• Income, savings, and emergency fund amounts
• Debt balances, interest rates, and repayment plans
• Investment account balances and contribution rates
• Insurance coverage details and estate planning status
• Cash flow data (income sources and expense categories)
• Tax information (filing status, deductions, state tax data)
• Employee benefits details (health plan elections, 401(k) match, HSA/FSA enrollment, equity compensation, and other employer-provided benefits)
• Real estate you own, including estimated values and related mortgage balances
• Business interests and their estimated values
• Other valuables you choose to record

AI Inputs & Outputs

When you use our AI-powered features — which include the Penny assistant, the AI Tax Planner, your personalized roadmap, progress interpretation, document and investment statement analysis, the employee benefits analyzer, and analysis of your cash flow, debts, goals and savings — we collect:

AI access and usage allowances depend on the plan and offer shown at https://financialfitnesspassport.com/#pricing and before subscription. No particular AI or calculator feature is promised as free by this policy. The following collection applies whenever you choose to use an available AI feature.

• Questions, prompts, and messages you submit to the AI
• The responses our AI features generate, which are general education, not personal recommendations
• Context data (your financial profile used to personalize AI outputs)
• Chat history and conversation logs
• If you have turned on Account Sync: data from your synced transactions — merchant names, amounts, dates, and the categories those transactions are assigned to — used to answer your questions about your spending
• Notes you write on individual transactions are included in what the AI assistant reads, so it can answer questions about them

Voice Calls with Penny

Voice is optional. Penny uses an AI-generated voice and provides general education, not personal financial, investment, insurance, tax or legal advice. When you have an active advisor link in FFP, Penny is designed to refer specific advice questions to that advisor by name and may show you contact details the advisor or firm has chosen to make available (calendar or booking link, email, or phone). Without an active link, Penny may suggest a licensed professional without naming a particular advisor and does not hand off to a credit union or other institution’s team. Retell AI processes live audio, recognizes speech and turns Penny’s response text into speech. OpenAI generates responses from the question, relevant context and history and handles moderation; our voice service runs on Google Cloud.

Retell audio recording is turned off. FFP stores written transcripts, not call audio. Each transcript turn includes the caller’s recognized words, Penny’s response, user and call identifiers, timestamps and processing status. Session records include the user identifier, browser/phone channel, start/expiry information, end reason, language and a hashed identity code. Phone features also store an encrypted number, its last four digits, verification times and opt-out status; phone-consent records preserve the disclosure version and a hash of its text. These records are held in FFP’s Firestore database, separately from text chat, and associated with your account. The reviewed voice store does not save call audio, a call summary or call duration.

Penny announces transcription and the educational limitation at call start; on-screen consent also describes transcript retention. New York generally permits a party to a call to record or transcribe it with one-party consent (Penal Law §§ 250.00 / 250.05); we participate in the call and disclose transcription before processing. Telemarketing-recording disclosures under GBL § 399-z are addressed in the Terms; Penny calls are placed at your request after consent. Phone calls identify DALS Technology, Inc. and that the call is at your request. A verification text and in-call identity-code check protect phone account access. Written transcripts are designed to expire after six months. Session, phone and consent records have no automatic expiry. Section 6 explains account deletion and required retention. Active Retell agents used for live Penny calls (Penny - English, Penny - Espanol, FFP Penny Demo, FFP Inbound Greeting) are configured for Basic Attributes Only, with no Retell retention period shown for those agents. FFP still stores the written transcript described above. This description does not claim that Retell never stored transcripts or other call data historically.

Authorized FFP staff may review transcripts and text conversations for quality/compliance; review activity is logged. Voice transcripts are not displayed in the App, and individual voice-transcript deletion is not a self-service feature. Request access or deletion at support@financialfitnesspassport.com. This does not restrict applicable access/deletion rights.

For phone calls you provide and verify a US mobile number through a one-time Twilio text. Your number is used for calls you request; program texts require a separate choice. Stop future Penny phone calls in the App, by saying “stop calling me” during a call, or by emailing support. Only you may re-enable calls. Message/data rates may apply.

Voice Demo

You can try a three-minute voice demo with Penny without an account. To start it, we ask for your name and email address. A phone number is optional for a demo in your browser and required if you ask Penny to call you; in that case we first text a one-time code to the number, through Twilio, to confirm it is yours, and we call it once, from (631) 518-3334. We use these details to allow one demo per person and to prevent abuse, and we set a small cookie on your device for the same purpose. If, and only if, you check the separate box, we may also contact you about Financial Fitness Passport by email, and by calls and texts to the number you gave. Checking it is not required to try the demo. In the demo, Penny sees no account information and shares general education only. The call is processed and transcribed as described in "Voice Calls with Penny." To keep out automated sign-ups, the form uses Cloudflare Turnstile, which receives your IP address and information about your browser. We design demo sign-up details and transcript records to expire after 6 months, except that, if you agreed to be contacted, we keep your contact details until you withdraw that consent. If you later create a Financial Fitness Passport account with the same email address and confirm it, we delete your demo details within a day. To withdraw your consent or ask us to delete your demo details, email support@financialfitnesspassport.com.

Events

We host events in person and online, such as webinars, workshops and live social-media sessions. When we invite you or you register, we collect your name, your email address and your reply. We use them to send your invitation, your confirmation, any join link and reminders before the event. If, and only if, you check the separate box, we may also email you about future events and about Financial Fitness Passport. Checking it is not required to attend, and every such email has an unsubscribe link. To keep out automated sign-ups, open registration forms use Cloudflare Turnstile, which receives your IP address and information about your browser. We keep event guest details while we need them to run our events and to keep a record of who attended. If you agreed to hear from us, we keep your name and email address until you unsubscribe. If you unsubscribe from our event emails, we keep a one-way coded form of your email address, not the address itself, so that we don't email you about events again, even after we delete your other event details or your account. To ask us to delete your details, email support@financialfitnesspassport.com.

Uploaded Documents

Features available under the applicable plan may let you upload financial documents — insurance declarations, estate documents, employee benefits guides, investment account statements, and tax returns — for AI-powered analysis. When you upload a document:

• The document is temporarily stored in Firebase Storage solely for the purpose of processing
• The document content is transmitted to OpenAI for AI analysis
• The uploaded file is deleted from our systems when analysis is complete. The analysis and the figures extracted from your document are kept in your account so you can see them again. You can delete them.
• The written analysis is returned to you. Where the document is an investment statement, the holdings we read from it — the securities, quantities and values described under "Account Sync" below — are saved to your account so that your Investing area can show them to you and so that you do not have to upload the same statement again. You can delete them, and deleting your account deletes them.
• Where the document is a tax return, the figures we read from it that your Taxes area uses are saved to your account in the same way, with identifying numbers such as Social Security numbers removed before saving. You can delete them, and deleting your account deletes them.

Payment Information

• Processed by Stripe: Credit card information is collected and processed by Stripe, Inc. We do not store full credit card numbers
• Subscription status, billing history, and payment method type
• Promotional codes used and discount applications
• If you begin a free trial, we record that a trial was started, when it ends, and whether it converted to a paid subscription

Usage Data & Analytics

We automatically collect:

• Device information (type, operating system, browser)
• IP address and approximate geographic location
• App interactions, page views, and feature usage
• Login count and session duration
• With analytics consent on the website, or in the mobile app unless you turn analytics off in Profile settings: PostHog browser events/replay and Google Analytics / Firebase Analytics. Separately, server events are sent to PostHog whether or not browser analytics is allowed, as described in Sections 4 and 11. Native mobile Meta SDK measurement is described separately in Section 11.

Cookies & Tracking Technologies

We use cookies and similar technologies (including browser localStorage) for authentication, security and preferences, and — only with your consent — for analytics and advertising measurement. Section 11 lists them and explains how to change your choice.

3. How We Use Information

We use your data to:

• Operate and improve the App: Provide core features, calculate your Passport Score, generate badge assessments, and track progress
• Provide AI-powered insights: Generate general financial education, coaching, roadmaps, and progress analysis based on the information you provide, using third-party AI engines. These are not personal recommendations.
• Process payments: Manage Pro subscriptions, apply promotional codes, and handle billing
• Communicate with you: Send account notifications, educational content, feature updates, security alerts, and customer support responses
• Analyze trends and enhance user experience: Understand how features are used, identify bugs, and develop improvements
• Provide community benchmarking (on unless you turn it off in Profile settings): Combine data across participating users for community comparisons (Section 13)
• Comply with legal obligations: Respond to subpoenas, prevent fraud, enforce our Terms, and maintain audit logs
• Maintain security: Detect and prevent unauthorized access, abuse, and security threats

4. How We Share Information

Service Providers

We share data with trusted third-party service providers:

• Firebase (Google): Authentication, Firestore database, Firebase Storage, and Analytics
• Stripe: Payment processing and subscription management
• OpenAI: AI-powered features — Penny, the AI Tax Planner, your roadmap and progress interpretation, and document analysis, which processes the content of documents you upload — using OpenAI's API models. For Document Analysis and the Employee Benefits Analyzer, OpenAI receives the text we extract from your uploaded document, not the file itself
• PostHog: Product analytics. We use PostHog to understand how features are used, to identify errors, and to improve the App. On the website, PostHog, including session replay, runs only with your analytics consent; in the mobile app it runs unless you turn analytics off in Profile settings (Section 11). It may receive your account identifier and, when you are signed in, your email address, name, plan and account creation date, and records the actions you take in the App, such as the pages you open and the features you use. With analytics consent on the website, or in the mobile app unless you turn analytics off in Profile settings, we may also store, once, the advertising campaign parameters from the link that first brought you here (source, medium, campaign, content, term, and ad set identifier) on your analytics profile, so later activity can be tied to that first link. We do not store those parameters before that consent. If you allow tracking on iOS, the app may ask Meta for the web address that led to the install and read those same parameters from it. That request is not made if you do not allow tracking. Our servers also send PostHog a limited set of events, identified by your account identifier, whether or not you allow analytics: account and purchase events (such as email verified, trial started, checkout started, completed or abandoned, and subscription cancelled), emails we sent you, and a few feature events (such as fund comparisons, cash-flow setup steps, and whether a question to Penny was about Social Security). These server events never include session replay. PostHog does not receive the financial figures you enter, your uploaded documents, or the text of your conversations with our AI features
• RevenueCat: Subscription management for purchases made inside our mobile app. RevenueCat receives an identifier for your account and the status of your subscription
• SignNow: Electronic signature of agreements with companies and resellers. SignNow receives each signer's email address
• Vercel: Application hosting and deployment infrastructure
• Resend: Sending our emails, including account, billing and event emails. Resend receives your email address and the content of each email we send you
• Twilio: Phone-number verification for the optional "Have Penny call me" feature, and for a phone demo, the one-time code that confirms the number before Penny calls. If you add a phone number, Twilio receives that number and sends it a one-time code by text message. Twilio is used only if you choose to add a phone number or ask Penny to call you for the demo. If you also opt in to text messages (Section 12), Twilio delivers those messages to your number and receives the number and the message text for that purpose only
• Retell AI: Voice calls with Penny, in your browser or by phone. Retell carries the call audio, converts your speech to text and Penny's answers to speech, and, for a phone call, receives the number being called. Retell is not told who you are. It hears Penny’s spoken answers, which may mention figures from your Passport, and receives no other Passport data. Retell audio recording is turned off for the active production agents. Those active agents are configured for Basic Attributes Only (no Retell retention period shown for them). FFP retains the written transcript in its own systems. This does not claim that Retell never stored transcripts historically. Retell is used only if you choose to start a voice call — see "Voice Calls with Penny" above
• Cloudflare Turnstile: A security check on the voice demo sign-up form and on open event registration forms, to keep out automated sign-ups. Cloudflare receives your IP address and information about your browser. Turnstile is used only on those forms — see "Voice Demo" and "Events" above
• Plaid: Bank and financial account connectivity for the optional Account Sync feature — see "Account Sync" below. Plaid is used only if you choose to connect an account
• Google Analytics / Firebase Analytics (Google): Website and app usage analytics — on the website only with your analytics consent; in the mobile app until you turn analytics off in Profile settings
• Meta, TikTok and Reddit: Advertising measurement pixels, and for Meta a purchase report from our servers (Conversions API) — on the website only with your marketing consent; in the iOS app, Meta’s SDK and the server purchase report depend instead on your choice in Apple’s App Tracking Transparency prompt (Section 11)
• Customer relationship management (CRM) provider: We may use a CRM service to manage our contacts, event guests and marketing emails. If we do, it receives your name, your email address, your event replies and whether you agreed to hear from us

These providers are contractually obligated to protect your data and use it only for the purposes we specify.

Account Sync (Bank Connections via Plaid)

In the product this is called the connected accounts feature, referred to in this policy as Account Sync.

Account Sync is optional. Connecting a bank or financial account is never required to create an account or to use any part of Financial Fitness Passport. If you never connect an account, nothing described in this subsection happens and no data is exchanged with Plaid.

If you choose to connect an account, we use Plaid Inc. ("Plaid") to establish and maintain that connection:

• Your credentials go to Plaid, not to us. Your bank username, password, and any multi-factor codes are entered inside Plaid's secure Link interface and are transmitted to your financial institution by Plaid. Financial Fitness Passport never receives, sees, or stores your bank login credentials.
• What we receive. Plaid returns an access credential that identifies the connection, together with information about the accounts you selected: the institution name, account names, types and mask (last digits), and — for the products you have authorized — transaction records (date, amount, currency, description, category, and pending status) and account balances.

  If you later give the separate authorization described below, we also receive, for the accounts you select:

  • For investment accounts: the individual holdings in the account, including each security's name and symbol where reported, its type, the quantity held, its price and market value, its cost basis where reported, and the resulting gain or loss.
  • For loan and credit accounts: the terms your provider reports for the account, including its annual percentage rates and the balances those rates apply to, interest charged, the minimum payment due, and the statement and payment due dates. This applies to credit, student loan, and mortgage accounts.

  We receive this information only for the accounts you choose, and only after you complete the additional authorization for that product.

• What we ask for. A new connection is authorized for transaction data only. Access to liability data and investment holdings is not requested at connection time; if those features are offered to you later, they require a separate, additional authorization from you.
• Purpose. We use this data solely to populate features you asked for — your Cash Flow, debt, and investment records inside your own account. We do not sell it, and we do not use it for advertising. If you use our AI-powered Pro features, transaction descriptions and merchant names from your connected accounts may be processed by our AI provider to generate insights and to answer your questions about your spending. See "Third-Party AI Processing" below.
• Storage and retention. The access credential for each connection is encrypted at rest. Synced records are retained under the same terms as the rest of your financial data (Section 6). You may disconnect an institution at any time. When you disconnect an institution yourself, we instruct Plaid to end the connection, we delete the stored access credential, and we delete the transactions we synced from it. When you delete your account, we delete all of it.
• If your plan ends. If a payment fails, Account Sync stops updating while we retry the payment, and nothing is removed. If your plan ends, your connected institutions stop updating. Everything already imported (transactions, accounts, balances and investment history) stays in your account, and you can still view it. No sooner than 30 days after your plan ends, we disconnect your institutions: we instruct Plaid to end the connections and we delete their access credentials. We email you at least a week before we do this, and again shortly before. Disconnecting does not delete what was already imported. If your plan becomes active again before then, your connections keep working with no need to link your bank again. Information you entered yourself is never affected. You can also disconnect an ended connection and delete what was imported from it.
• Plaid's own practices. Plaid is an independent company and handles your data under its own end-user privacy policy, available at plaid.com/legal. We do not control Plaid's data practices.

When an organization pays for your account

Your subscription may be paid for by an organization rather than by you — an employer, an advisory firm, or another partner organization.

An organization that funds your account can see that you hold one of the seats it pays for. For that purpose it can see your name, your email address, the date you claimed the seat, and whether the seat is currently active. It can release a seat, which ends the subscription that organization is paying for.

A sponsoring organization does not receive your Passport Score, your account balances, your transactions, your goals, your uploaded documents, or your conversations with our AI features, and does not see what you entered or what we found in those categories. Your individual financial details remain yours; ending the sponsorship does not give the organization that detail.

Sponsored programs include Pro, with full Penny. That means only organization programs that sponsor Pro seats — for example employer-sponsored seats, partner-sponsored Pro seats, advisor-firm-sponsored client seats, and firm staff on sponsored Pro — receive full Penny. Employee-subsidized programs and partner discount or full-price programs that do not sponsor Pro stay on Penny Lite unless you subscribe to Pro yourself. There is no separate per-organization Penny toggle; Penny access follows whether the program sponsors Pro.

Separately, a program agreement with a sponsor may allow aggregate or de-identified program reporting (for example participation or engagement summaries). That reporting is defined in the applicable program agreement; it is not individual Passport financial detail, and this Privacy Policy does not promise that employers or sponsors “see nothing.” Organizations that do not fund seats — for example a partner whose audience buys subscriptions directly at a discount — receive no member list at all unless a separate agreement says otherwise.

Sharing with an advisor you invite

You can choose to share parts of your Passport with a financial advisor whose firm uses Financial Fitness Passport. Except for the firm compliance access described below, nothing in this subsection happens unless you share your Passport with an advisor.

• Only when you share. An advisor can see your information only after you grant the advisor access. You choose which areas of your Passport (for example cash flow, debt, insurance, investing) the advisor may view, and whether the advisor may also edit them.
• What the advisor can see. The areas you selected, as you entered or connected them. The advisor also sees a summary of your whole Passport: your name, your overall Passport Score, your level in each area, your monthly income and expenses, and whether you have a will, power of attorney and healthcare proxy. The advisor views them inside the App; we do not send copies out of the App.
• Views are recorded. Each time an advisor opens a Passport you have shared, the App logs that open with a reason code (who opened it, when, the reason given, and which areas were viewed). Firm administrators and compliance viewers can see that access log. Compliance viewers can export a CSV of the rows shown on the loaded page (about fifty rows at a time). There is no PDF export of the access log. You do not have a client screen that shows who accessed your Passport, and the access log is not included in your own account data export. In short: access is logged, and your firm’s compliance team can review and export it. Advisors must use multi-factor authentication when their firm requires it.
• Your advisor's firm. If your account is linked to an advisory firm — for example because you joined through an advisor's invitation — and the firm has turned on compliance access, the firm's administrators and compliance staff can view every area of your Passport, read-only, for supervisory and compliance review, whether or not you have shared it with an advisor. This access lasts while your account is linked to the firm. The firm retains its own supervisory, recordkeeping and examination obligations; Financial Fitness Passport does not replace them, does not custody assets and does not execute trades.
• The advisor's obligations. The advisor's firm is bound by its agreement with us to use your information only to serve you and to protect it. The advisor is not our agent, and the firm's own privacy practices apply to anything you give the advisor directly, outside the App.
• You can stop sharing at any time. Revoke a share in your Profile. Access ends immediately. If the firm's account with us ends, its advisors' access ends too. Revoking a share does not end the firm compliance access described above.

What Penny may show you about a linked advisor

If your account has an active advisor link, Penny may show you that advisor’s name and contact details the advisor or firm has chosen to make available — such as a calendar or booking link, email address, or phone number — when referring advice questions to them. That information is shown to you in the App; it is not a handoff of your Passport data to a credit union or other institution’s general team. Without an active advisor link, Penny does not name a specific advisor.

An advisor relationship does not change anything else in this policy: the advisor does not receive your bank login, your uploaded documents, or your conversations with Penny.

Third-Party AI Processing

Legal Requirements

We may disclose information when required by law or to:

• Comply with legal process (subpoenas, court orders)
• Protect rights, property, and safety
• Prevent fraud or security threats
• Enforce our Terms and Conditions

Business Transfers

During a merger, acquisition, sale, or reorganization of our business, your information may be transferred to the successor entity. We will notify you of any such change.

Aggregated & Anonymized Data

We may share de-identified or aggregated data that cannot reasonably identify you for research, marketing, or analytics purposes.

We Do Not Sell Your Data

We do not sell your personal information to third parties for monetary consideration.

If you allow marketing cookies, the Meta, TikTok and Reddit pixels receive information about your visit (and, for Meta, a purchase report) to measure our advertising. Some U.S. state laws treat this as “sharing” for cross-context behavioral advertising. It happens only with your consent, you can withdraw it at any time in Cookie preferences, and we treat a Global Privacy Control signal as an opt-out of it.

5. Use of Artificial Intelligence and Data Processing

Our AI features use OpenAI API models to generate general educational explanations, scenarios, roadmaps and analyses based on the information you choose to provide, including relevant financial context, prompts, history and extracted document text. The preceding sections describe specific data and processors. FFP’s signed OpenAI agreement and enabled ZDR are described in Section 4.

Optional AI processing is subject to the separate consent presented for those features. You may avoid AI processing by not using AI features; manually entering information and viewing your Passport Score do not themselves send it to an AI provider, as currently described in our service. Withdrawing a choice affects future optional processing, not processing already completed; request help at support@financialfitnesspassport.com. FFP retains its own output/history records as described in Section 6, independently of OpenAI ZDR.

6. Data Retention

We retain personal and financial data as long as your account is active or as needed to:

• Provide Services and support
• Comply with legal obligations (tax records, financial regulations)
• Resolve disputes and enforce agreements
• Prevent fraud and abuse

Inactive accounts. If you have not signed in for 24 months, we may close your account and delete its data. We will email you twice before we do, at least 30 days apart, and signing in at any point before then keeps your account open.

Conversations with Penny. Text chat and voice transcript records are designed to expire after six months. Voice turns carry an expiresAt timestamp six calendar months after creation; text-chat expiry is calculated from message times, with the document-level cap described in our retention design. Deletion after expiry depends on Firestore TTL processing, which is not instantaneous. Account deletion removes those records through the account-deletion process.

Account Deletion

You may request deletion of your account and data at any time by:

• Using the "Delete Account" feature in your Profile settings, or
• Emailing support@financialfitnesspassport.com

When you delete your account, we delete the information in it. This includes what you entered, anything we received from a connected financial account, files you uploaded (such as an advisor photo or logo), your uploaded analysis results, your scores and history, and your conversations with our AI features. Deletion is completed within 30 days; if a step does not finish on its own, our team is alerted and completes it. Account deletion does not delete copies that our service providers keep under their own retention, such as Stripe customer and invoice records, analytics events in Google Analytics, advertising events sent to Meta, TikTok and Reddit, text message delivery logs at Twilio, email delivery logs at Resend, and basic call details at Retell for voice calls with Penny (Retell keeps no transcripts or recordings of them).

After deletion, we retain the limited billing, audit, security and compliance records described below for their stated purposes; some contain identifiers. One retained category is a billing record for tax, accounting and dispute purposes: a billing record showing that a subscription existed, which provider processed it, which product it was for, the dates the subscription started and ended, and its final status. That record is stored under an identifier derived from your account through a one-way function; it does not contain your name, your email address, your account identifier, your payment method, or any financial information from your account.

We also keep a record of actions our staff take on or for your account, such as blocking or unblocking it, verifying your email address, creating the account, resetting your password or two-step verification, signing in as you to help with a support request, creating a checkout link, recording your request to stop Penny phone calls, or deleting the account. Each record includes your account's user ID and, in most cases, its email address (and, for an account that staff created, its name); the staff member who acted; the date and time; and, depending on the action, details such as the plan chosen, the Stripe checkout session ID, or the number and type of sign-in factors reset. Failed attempts to reset two-step verification are recorded too. We keep these records after you delete your account for security, fraud-prevention and dispute-resolution purposes. If you joined an advisory firm through its referral link, the firm's invitation record may also keep your user ID and the time you used it. We also keep activity records that involve an advisory firm, a partner organisation or our compliance team. If you were a member or client of an advisory firm, or shared your passport with one, the firm's activity record keeps entries such as invitations, joining or leaving the firm, role, seat and plan-tier changes, passport sharing and edit-access requests, and each time an advisor or the firm's compliance staff opened your passport. Entries include the user ID and, in most cases, the email address of the person who acted and of the person affected; some also include the passport owner's name, the reason given for opening a passport, and a one-way hash of the network address and browser used. If a partner organisation removed a seat it sponsored for you, its record keeps your user ID and email address, the partner staff member who acted and the date. When our compliance staff read or search your conversations with Penny, or reveal the phone number used for Penny calls, the record keeps your user ID, the staff member and the time, but not the conversation or the number. If we sent you a bulk email, the delivery record keeps a one-way hash of your email address, whether it was sent and when, but not your address or name. We keep these records after you delete your account for the same purposes.

Voice session, phone and consent records

Our current implementation keeps voice-session metadata, encrypted phone/verification/opt-out records and phone-consent evidence without an automatic expiry while the account remains active. The account-deletion implementation removes penny_voice_active, penny_voice_sessions, penny_voice_turns and penny_voice_consents, as well as ordinary text chats and SMS/AI consent events.

Retention criteria and exceptions

We retain necessary billing records for tax/accounting/dispute duties, security/access audit records for fraud prevention and investigation, firm compliance records for applicable supervisory/contractual duties, and suppression/consent evidence to honor choices and demonstrate authorization. We do not describe retained identifiable records as anonymous merely because other billing data is one-way coded. Legal holds may delay deletion of the specific records necessary for the hold. Retained records are restricted to their stated purpose and not used for marketing or unrelated feature personalization.

7. Security

We maintain a data-security program with reasonable administrative, technical and physical safeguards appropriate to our size and the sensitivity of information we handle, consistent with the New York SHIELD Act (GBL § 899-bb). Those safeguards include designating personnel to coordinate security, assessing foreseeable risks, training, vendor due diligence, secure disposal when information is no longer needed, and the technical measures below. New York DFS cybersecurity regulations (23 NYCRR 500) apply to covered DFS-licensed entities; FFP is a consumer financial-education SaaS and is not holding itself out as a DFS-licensed bank, insurer or similar — those rules are noted for awareness only, not as an admission they apply.

We use reasonable technical and organizational measures to protect your data, including:

• Firebase Authentication for authentication and password-security controls
• Encrypted data transmission (HTTPS/TLS)
• Firestore Security Rules to restrict unauthorized access
• Firebase Storage Security Rules for file protection
• Server-side authentication verification via Firebase Admin SDK
• Email verification enforcement before accessing protected features
• Rate limiting on AI API endpoints
• Technical measures to limit demo usage and prevent abuse (these measures do not involve collecting personal financial or account information)
• Comprehensive security headers (CSP, HSTS, X-Frame-Options)
• Regular security audits and dependency updates
• Archival logging with SHA-256 hashing for audit trails

8. Your Rights

Everyone who uses the App can exercise the rights below by emailing support@financialfitnesspassport.com or using the tools in Profile settings, whether or not a law requires us to offer them. We will respond within 30 days and will not treat you differently for exercising a right.

Access & Portability

• Access and download your personal data
• Request a copy of your data in a portable format (JSON export available in Profile)

Correction & Deletion

• Correct inaccurate information
• Request deletion of your account and data

Consent & Opt-Out

• Withdraw consent to data processing
• Opt out of marketing communications
• Opt out of community benchmarking (Profile settings)
• Choose or change analytics and marketing cookies at any time (“Cookie preferences” in the footer, or Profile settings) — see Section 11
• Do Not Sell or Share My Personal Information — we do not sell your personal information, and you can turn off the advertising “sharing” described in Section 4 at any time in Cookie preferences on the website, or in the iOS app by declining tracking in Apple’s prompt or in iOS Settings. We honor Global Privacy Control signals.

Limiting use of sensitive information

Financial account and similar information you enter is sensitive. We use it only to provide the features you asked for, as described in Section 3, and never to infer characteristics about you for advertising.

Authorized agents and verification

You may ask someone else to make a request for you. We will ask for proof that you authorized them, and we may ask you to confirm the request from the email address on your account before we act on it.

Complaints

File a complaint with a data protection authority in your jurisdiction

To exercise your rights, email us at support@financialfitnesspassport.com. We will respond within 30 days.

Appeals and assistance

If we decline a privacy request, you may appeal by emailing support@financialfitnesspassport.com with “Privacy request appeal” and the reason you disagree. We will review and respond within the period required by the law that applies to you, explain the result, and provide any required regulator-complaint route. We verify requests proportionately and do not ask you to send passwords, full payment-card numbers or Social Security numbers by email. The access-request route includes eligible voice transcripts even though they are not visible in the App.

9. Children's Privacy

The App is offered only to US users who are at least 18 and legally able to enter the agreement under applicable law. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13 or permit users under 18.

If you believe a minor has an account or submitted personal information, email support@financialfitnesspassport.com. We will investigate and, if we learn personal information was collected from an ineligible minor, take steps to close the account and delete the information, subject only to applicable legal duties. Do not include unnecessary sensitive information about a child in your initial report. An adult should not create an account for a child or upload a child’s personal documents as a substitute for the eligibility requirement.

10. United States Scope and Processing Locations

FFP currently offers the App only in the United States. We do not solicit accounts outside the United States. Our data is processed in the United States and may be processed in other locations used by our service providers’ infrastructure as described in this policy and their applicable agreements. US-only availability is not a promise that every processor/server is US-only.

US state privacy rights depend on the law and its coverage thresholds/exemptions. We offer the request methods in Section 8 to all users; applicable nonwaivable rights control. Contact support@financialfitnesspassport.com with a question about eligibility or processing location. We do not rely on mere use of the App as a substitute for any required transfer safeguard or separate consent.

11. Cookies & Tracking Technologies

We use cookies and similar technologies, including browser localStorage and sessionStorage. Website browser analytics and advertising tags are controlled by the cookie choices described below. Necessary/functional storage, security/demo abuse prevention, and the separate server events described here are not all controlled by the cookie banner. Native iOS Meta SDK activity is separate from website tags and described below.

Necessary (always on)

• Your sign-in session (Firebase Authentication, stored in your browser's IndexedDB)
• Security and app state: the email address for an email sign-in link, advisor view-as sessions, pending invitation codes, and Penny chat history for the current browser session
• Your cookie choice itself (ffp_consent_v1 in localStorage — not a cookie). When you start a checkout, whether marketing consent is on is sent with it, so that the purchase report described below follows your choice

Functional

• Preferences such as dismissed tips and prompts, onboarding progress, and cached prices (localStorage)
• Referral attribution: when you open a referral link, a first-party cookie (ffp_ref, 30 days) remembers the code so the referrer can be credited when you sign up. It is not shared with advertising networks.

Analytics (on the website only with your consent; in the mobile app until you turn it off in Profile settings)

• PostHog (cookie and localStorage ph_*): page views, automatically captured clicks and interactions, and — where enabled — session replay, with all text and form inputs masked. When you are signed in, events are linked to your account ID, email address, name, plan and account creation date.
• Google Analytics 4 / Firebase Analytics (cookies such as _ga): usage analytics. Google Consent Mode is set to “denied” by default and the Google tag is not loaded until you allow analytics.

Marketing (only with your consent)

• Meta Pixel (cookies such as _fbp, _fbc), TikTok Pixel and Reddit Pixel: measure visits and conversions from our ads
• Meta Conversions API: when you buy a paid plan, our servers may send Meta your email address in hashed form, the Meta click identifiers above, the purchase amount and currency, the page address and an event identifier — only if marketing consent was in force when you started checkout.

Abuse prevention (Penny demo)

The public Penny demo page computes a device fingerprint from browser characteristics (such as browser version, language, screen size, time zone and how your device renders a small test image) to limit free demo usage. It is stored with a usage count and is not used for analytics or advertising.

Your choices

• Open Cookie preferences (also in the site footer and your Profile) to accept or reject analytics and marketing at any time. The choice is stored on this device.
• Withdrawing analytics consent stops PostHog and Google Analytics at once and deletes their cookies on our domain. Withdrawing marketing consent deletes the pixels' cookies on our domain and reloads the page without them. Data already sent to a provider is handled under that provider's own policies.
• If your browser sends a Global Privacy Control signal, marketing stays off and the advertising pixels are not loaded.
• If you turn analytics off in Profile settings while signed in, it stays off on this device and on other devices where you sign in — the cookie banner cannot turn it back on; only the Profile setting can.
• In the mobile app, website advertising pixels are not loaded. The Google tag for Google Analytics / Firebase Analytics is loaded in the app and runs until you turn analytics off in Profile settings. This does not mean the mobile app has no advertising measurement: the iOS app includes Meta’s native SDK, described below. Profile product-analytics choices do not by themselves describe or override iOS ATT permission.
• Separately from cookies, our servers record some account and billing events (for example, subscription changes), including in our product-analytics tool. These are not stored in your browser and are not controlled by cookie preferences.

Native iOS Meta SDK and ATT

This section describes iOS app version 2.9.1 and later. Versions 2.9.0 and earlier started Meta’s SDK shortly after launch, before the tracking prompt, with automatic app-event logging on, and sent an app-open event each time the app was opened, including after tracking was declined (declining turned advertiser-ID collection off); updating to version 2.9.1 or later applies the behaviour described below.

The iOS app includes Meta’s software development kit (SDK). It does not start, and sends nothing to Meta, until you allow tracking in Apple’s App Tracking Transparency (ATT) prompt. Until then, advertiser-ID collection is off. Automatic app-event logging is off at all times; the app sends only the events described below.

If you allow tracking, and you have not opted out of advertising measurement through our privacy choices or Global Privacy Control, the SDK starts. Meta then receives app install and open events and three events: Complete Registration, Start Trial and Purchase. These include the time of the event, an event identifier, the sign-up method (for Complete Registration) and, for Start Trial and Purchase, the price, currency, product and Apple order identifier, together with the device and app identifiers the SDK collects, including the advertising identifier.

If you do not allow tracking, or you have opted out as described above, no events are sent to Meta. For the same three events the app may update Apple’s SKAdNetwork conversion value on your device; Apple, not FFP, may then send an anonymous conversion report that does not identify you or your device.

If enabled, when a free trial started in the iOS app converts to a paid subscription, our server may also report that Purchase to Meta with your email address in hashed (SHA-256) form, the price, currency, product and order identifier. It is sent only if you allowed tracking in the app and have not opted out of advertising measurement.

You can change your tracking choice at any time in iOS Settings. A website cookie choice is not a substitute for your choice in the ATT prompt. Declining tracking does not limit any feature of the app.

Server analytics and identity fields

PostHog server events are separate from browser cookies/replay and are sent whether or not browser analytics consent is allowed. They include the account/purchase/email and limited feature events described in Section 4 (the feature events named there are examples); this includes fund comparison, cash-flow setup and a Social Security question-topic event. These are associated with the account identifier. Browser analytics when enabled may additionally associate events with your name and email, as listed above. These disclosures do not characterize every server feature event as necessary.

12. Email and Text Message Communications

Email

We may send you:

• Transactional emails: Account verification, password resets, billing notifications (cannot opt out)
• Service updates: Feature announcements, security alerts, Terms changes
• Educational content: Financial wellness tips, academy lessons (opt-out available)
• Marketing communications: Promotions, product news (opt-out available)

You can click "unsubscribe" in any marketing email, or email support@financialfitnesspassport.com.

Text Messages

If you give us a mobile number and check the separate text-message box on the signup form or in your Profile, you agree to receive recurring text messages from Financial Fitness Passport. Those messages are account updates, Passport Score changes and educational check-ins from Penny, our AI financial companion. We send up to 4 messages a month. Message and data rates may apply. Consent to receive text messages is not a condition of creating an account or of any purchase.

Reply STOP to any message to stop receiving texts, or turn texts off in your Profile settings. Reply HELP for help, or email support@financialfitnesspassport.com. After you reply STOP you may receive one message confirming that you have been unsubscribed.

Separately from these program messages, if you ask Penny to call you we first text a one-time code to your number to confirm it is yours (see "Voice Calls with Penny" in Section 2). That code is sent whether or not you have opted in to program messages.

We keep a record of your consent (the wording you agreed to, the date and time, and where you agreed) for as long as you have an account, so that we can show it if a carrier asks. Ordinary program-SMS consent records and the mobile number are currently deleted through account deletion. Call-consent evidence is a separate category and is described in Section 6.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Your number is shared only with the service provider that delivers our messages (Twilio, see Section 4) and only to deliver them.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.

Commercial emails include an unsubscribe method and a postal address; transactional notices needed to operate the account may still be sent. Marketing opt-outs are not withdrawn by purchasing a plan or accepting updated Terms.

13. Community Benchmarking

Users with access under their selected plan take part in community benchmarking unless they turn it off in Profile settings. While it is on:

• Your Passport Score and your debt, cash-flow, emergency-fund, insurance and progress figures are combined with other participants' data, and your age, income and state may be used to choose the comparison group
• Comparisons show only averages, medians, percentages and the number of participants, never names, emails or account identifiers. No comparison, average or median is shown for fewer than 5 people; if fewer than 5 match your filters, the comparison uses a wider group
• You can view community averages and compare your progress
• You can opt out at any time from Profile settings

14. Data Breach Notification

If a breach of the security of the system affects private information of a New York resident as defined in the New York SHIELD Act (GBL § 899-aa), we will notify affected residents in the most expedient time possible and without unreasonable delay, and in any event within 30 days after discovery, except as delayed for legitimate law-enforcement needs. We will also notify the New York Attorney General, the New York Department of State and the New York State Police (or use the AG’s breach portal that routes to them), and consumer reporting agencies when required. Notice to you will ordinarily go to your account email and will describe, as required, what happened, the information involved, what we are doing and how you can protect yourself. Inadvertent disclosure by authorized persons that we reasonably determine is unlikely to result in misuse or financial (or, for credential exposure, emotional) harm may be excepted if we document that determination as the statute requires. Substitute notice may be used only as § 899-aa allows. For residents of other states, we notify as those states’ breach laws require.

15. California Privacy Rights (Shine the Light)

California residents may request information about disclosures of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing.

16. Changes to This Policy

We update the Last Updated date when this notice changes and retain the prior version date. If a change materially affects our handling of personal information, we notify you by email or in the App before it takes effect and obtain additional consent where required. A notice update or continued use does not override a previous opt-out or supply a legally required separate consent.

17. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or your data, contact: