Privacy Policy - SmartPockets

CrowDevelopment LLC (“SmartPockets,” “we,” “us,” or “our”) operates the SmartPockets application and website (collectively, the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read this policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

1. Information We Collect

1.1 Information You Provide Directly

When you create an account or use SmartPockets, you may provide us with:

Account registration information such as your name, email address, and password (managed through our authentication provider, Clerk).
Profile information including display preferences, theme settings, and notification preferences.
User-generated content such as custom wallet names, card nicknames, notes, and organizational preferences.
Communications you send to us, including support requests and feedback.

1.2 Financial Data Collected Through Plaid

SmartPockets uses Plaid Inc. (“Plaid”) to connect your financial accounts. When you link a financial institution, Plaid collects and transmits the following data to SmartPockets on your behalf:

Account information: account names, types, balances, official names, and masked account numbers (last 4 digits only).
Transaction data: merchant names, transaction amounts, dates, categories, and pending/posted status.
Liability information: credit card APRs, minimum payments, due dates, credit limits, and balance details.
Recurring transaction streams: subscription and recurring payment patterns detected by Plaid.
Institution metadata: bank or credit union names, logos, and connection status.

Important: SmartPockets never receives, stores, or has access to your bank login credentials (username or password). These are handled entirely by Plaid. We also never receive full account numbers, routing numbers, or Social Security numbers through the Plaid integration.

1.3 Automatically Collected Information

When you use SmartPockets, we may automatically collect:

Device and browser information (device type, operating system, browser type).
Usage data such as pages visited, features used, and interaction patterns.
IP address and approximate geographic location.
Cookies and similar tracking technologies as described in Section 6.

2. How We Use Your Information

We use the information we collect to:

Provide, operate, and maintain the SmartPockets Service, including credit card portfolio management, transaction tracking, and financial organization features.
Process and display your financial data in a unified dashboard, including balances, transactions, liabilities, and recurring payments.
Synchronize your financial data through scheduled syncs and webhook-driven real-time updates.
Generate insights such as spending summaries, category breakdowns, and card optimization recommendations.
Send you notifications related to your account, including payment reminders, annual fee alerts, and security notices.
Improve and develop new features based on aggregated, anonymized usage patterns.
Respond to your support inquiries and communications.
Detect, prevent, and address fraud, unauthorized access, and other security issues.
Comply with applicable legal obligations.

3. How We Store and Protect Your Information

3.1 Data Storage

Your data is stored using Convex, our real-time database provider. Financial data is organized across structured tables including account information, transactions, liabilities, recurring streams, and denormalized credit card summaries. All monetary values are stored as integer milliunits (multiplied by 1,000) to ensure precision.

3.2 Security Measures

We implement a variety of security measures to maintain the safety of your personal information:

Plaid access tokens are encrypted using field-level encryption before storage.
Authentication is managed through Clerk with industry-standard practices including secure session management.
All data transmissions between your device and our servers use TLS encryption.
We implement rate limiting and circuit breakers to protect against unauthorized access attempts.
Webhook payloads from Plaid are verified using cryptographic signatures (JWS verification).
All database queries enforce authentication checks and resource ownership verification.

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

4. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share your information only in the following circumstances:

Service Providers

We share data with third-party service providers who perform services on our behalf:

Plaid Inc. — Financial data aggregation and bank connectivity. Plaid's use of your data is governed by the Plaid End User Privacy Policy.
Clerk — Authentication and user identity management.
Convex — Real-time database hosting and serverless function execution.
Vercel — Application hosting and content delivery.

Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court order or government agency).

Business Transfers

If CrowDevelopment LLC is involved in a merger, acquisition, or asset sale, your personal information may be transferred. We will provide notice before your personal information becomes subject to a different privacy policy.

With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

5. Plaid Integration and Data Access

SmartPockets uses Plaid to provide secure connectivity to your financial institutions. Key details about this integration:

You authorize the connection to each financial institution through Plaid's secure Link interface.
You can disconnect any financial institution at any time through the Settings > Institutions page. Disconnecting an institution permanently removes all associated data (accounts, transactions, liabilities, and recurring streams) from SmartPockets.
You can pause (deactivate) a bank connection without disconnecting it. Paused connections retain your data but exclude it from display and scheduled syncs until reactivated.
SmartPockets performs scheduled data synchronization daily at 2:00 AM UTC for active connections. Additional syncs occur in response to webhooks from Plaid when your financial data changes.
Plaid's own privacy practices are governed by the Plaid End User Privacy Policy. We encourage you to review Plaid's policy independently.

6. Cookies and Tracking Technologies

SmartPockets uses cookies and similar technologies for:

Essential cookies: Authentication session management and security.
Preference cookies: Storing your theme selection, display preferences, and UI settings (e.g., sidebar state).
Analytics cookies: Understanding how you use the Service to improve features and performance.

You can control cookies through your browser settings. Disabling essential cookies may prevent you from using certain features of the Service.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Service. Specifically:

Account and profile data is retained until you delete your account.
Financial data (transactions, liabilities, account information) is retained while the associated bank connection is active. When you disconnect an institution, all associated data is permanently deleted via cascade deletion.
Aggregated, anonymized data that cannot be used to identify you may be retained indefinitely for analytical purposes.

Upon account deletion, we will delete or anonymize your personal information within 30 days, except where retention is required by law.

8. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

Access: Request a copy of the personal information we hold about you.
Correction: Request correction of inaccurate or incomplete personal information.
Deletion: Request deletion of your personal information, subject to certain legal exceptions.
Data Portability: Request your data in a structured, commonly used, machine-readable format.
Opt-Out: Opt out of non-essential communications and marketing emails.
Withdraw Consent: Where processing is based on consent, withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at the address provided in Section 12.

9. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information, including the right to know what personal information is collected, used, and shared, the right to delete personal information, and the right to opt out of the sale of personal information. SmartPockets does not sell personal information. To exercise your California privacy rights, contact us at the address in Section 12.

10. Children's Privacy

SmartPockets is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without verification of parental consent, we will take steps to delete that information promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the “Effective Date” at the top. We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

CrowDevelopment LLC
Santa Cruz, CA
Email: EricCrow@pm.me