California privacy notice
Your California privacy rights, and how to use them.
If you live in California, the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the CCPA) gives you rights over your personal information. This notice adds to our privacy policy and is our notice at collection.
We don’t sell or share it
No sale of personal information and no sharing for cross-context behavioral advertising, in the last 12 months or now.
No sensitive information
We don’t collect sensitive personal information as the CCPA defines it: no account logins, passwords, full account numbers or SSNs.
Ask to know, correct or delete
Email us from your account’s address. We answer within 45 days, free.
Same service either way
Using your rights doesn’t change your price or what RichDue does for you.
What we collect, and what happens to it
In the last 12 months we collected the categories below. Each card names the CCPA category, gives examples, and says where the information came from, the business purposes we use it for, the service providers we disclose it to for those purposes, and how long we keep it. We collect no other categories.
Identifiers
Contact and account details
- What
- Email address and the name you give
- Account ID, and the ID Apple or Google sends when you sign in with them
- A keyed hash of your IP address on the waitlist, to limit sign-ups per network (not the address itself)
- From
- You · Apple or Google, if you sign in with them
- Why
- Create and secure your account and sign you in
- Send the emails you asked for and service notices
- Stop abuse of the waitlist
- Processed by
- Supabase, Vercel, Resend, Apple, Google
- Kept
- While your account is open. Waitlist entries until the beta ends or you ask us to remove them.
Personal information in Cal. Civ. Code § 1798.80(e) (financial information)
Your money
- What
- Balances, holdings and the accounts you add, with at most the last four digits of an account number
- Transactions you import, screenshot, log or type into the grid, and the categories, notes and rules you set
- Income, budgets, planned events and repeats
- Statement files you upload, while you review them
- From
- You
- Why
- Show your net worth, spending, projection and plans
- Find duplicates, transfers and repeats, and suggest categories
- Processed by
- Supabase, Vercel
- Kept
- Until you delete it or your account. Statement files are deleted automatically 7 days after upload.
Professional or employment-related information
How you’re paid
- What
- Whether you’re paid a salary, bonus, commission, RSUs or as self-employed
- Pay dates and amounts, and the clients you add as income sources
- From
- You
- Why
- Project your income, taxes and cash flow
- Processed by
- Supabase, Vercel
- Kept
- Until you delete it or your account.
Characteristics of protected classifications (age, gender); also personal information in § 1798.80(e)
Optional “About you” answers
- What
- Age band, gender, profession, industry, household income band, metro area, partner and children
- Each is a choice from a fixed list, not free text or a date of birth, and only with your consent
- From
- You, only if you choose to answer
- Why
- Understand, in groups of at least 20 people, who RichDue helps and where to find more people like them
- Processed by
- Supabase, Vercel
- Kept
- Until you delete the answers (which also withdraws your consent) or your account. Not joined to your balances or transactions.
Commercial information
Your plan
- What
- Free, trial or Pro, and trial and renewal dates
- Purchase records from Apple or our payment provider (not your card number)
- From
- You · Apple · Our payment provider
- Why
- Give you the features you paid for, on iPhone and on the web
- Processed by
- Supabase, Vercel, Apple, RevenueCat, Paddle
- Kept
- While your account is open, and billing records for as long as tax and accounting law requires (usually 7 years).
Internet or other electronic network activity
How you use RichDue
- What
- Pages you visit on richdue.com, counted by Vercel without cookies or an ID
- Steps you take in RichDue, with a random ID kept in your browser
- Device type, browser and error reports
- From
- Your browser or iPhone, automatically
- Why
- See which steps work and which confuse people
- Find and fix bugs
- Processed by
- Vercel, PostHog, Sentry
- Kept
- Analytics events up to 1 year. Error reports up to 90 days.
Geolocation data (approximate only)
Rough location
- What
- The state you pick for tax estimates
- Country or region our providers can tell from your IP address. Not your precise location
- From
- You · Your IP address
- Why
- Estimate state tax
- Serve pages and keep the service secure
- Processed by
- Supabase, Vercel, PostHog
- Kept
- Your state, while your account is open. Anything read from your IP address, as long as the analytics or error record it sits in.
Inferences
What RichDue works out
- What
- Projections, insights, suggested categories, detected repeats and estimates
- From
- Calculated from the information above
- Why
- Show them to you, not to profile you for advertising
- Processed by
- Supabase, Vercel
- Kept
- Recalculated as your data changes and deleted with your account.
Identifiers; any other information you choose to include
Messages you send us
- What
- Support emails and feedback, with whatever you include
- From
- You
- Why
- Answer you and improve RichDue
- Processed by
- ImprovMX and Gmail
- Kept
- Up to 2 years after the conversation ends, or sooner if you ask.
Not collected
- Bank usernames, passwords or one-time codes
- Full account or card numbers (we keep the last four digits at most)
- Social Security numbers or government IDs
- Your iPhone screenshots: they are read on your device and only the rows you keep are uploaded
- Your precise location, contacts, photo library or health data
Selling, sharing and sensitive information
- We don’t sell personal information and don’t share it for cross-context behavioral advertising, and haven’t in the last 12 months. That includes the information of anyone under 16.
- We disclose personal information only to the service providers named on each card, for the purpose given, under contracts the CCPA requires.
- We don’t collect sensitive personal information as defined in Cal. Civ. Code § 1798.140(ae). Your financial information is used only to provide RichDue to you, so the right to limit its use doesn’t come into play.
- Optional “About you” answers are collected only with your consent, studied only in groups of at least 20 people, and not used to make decisions about you.
- We honor Global Privacy Control. A browser that sends it is treated as an opt-out of sale and sharing, although we do neither.
Your rights
- Know and access. Ask what personal information we’ve collected about you, where it came from, why, and who we disclosed it to, and get a copy of it in a portable format.
- Delete. Ask us to delete personal information we collected from you, subject to exceptions the law allows (for example, billing records we must keep).
- Correct. Ask us to fix information that’s wrong. Most of it you can fix yourself in the app.
- Opt out of sale and sharing. We do neither, so there is nothing to opt out of; we’d honor the request anyway.
- Limit sensitive information. Doesn’t apply: we don’t collect any.
- No discrimination. We won’t deny you service, charge you a different price or give you a lower quality of service for using these rights.
How to make a request
- Email nathan@richdue.com from the address on your RichDue account (or the one on the waitlist), with “California privacy request” in the subject.
- Say which right you’re using: know, access, delete or correct.
- We confirm we have it within 10 business days and answer within 45 days. If we need longer, we’ll tell you why and take at most 45 more.
Requests are free. You can ask to know or access up to twice in 12 months. For what you can do yourself, see Help › Your data.
How we check it’s you
We match your request to the email address on your account and ask you to confirm from that inbox. For a copy of specific information or a deletion, we may also ask you to sign in and confirm in the app. We use what you give us for verification only for that. We don’t ask for a bank password.
Authorized agents
Someone you authorize can make a request for you. We’ll ask for your signed permission, and may ask you to confirm your identity with us directly, unless the agent holds a power of attorney under California Probate Code §§ 4121–4130.
More
- Shine the Light. We don’t disclose personal information to third parties for their own direct marketing (Cal. Civ. Code § 1798.83).
- Do Not Track. We don’t track you across other sites, so a Do Not Track signal changes nothing here.
- Financial incentives. We don’t offer discounts or rewards in exchange for personal information. Waitlist referrals move you up the invite list; they don’t ask for anyone’s details, because friends sign up themselves through your link.
- Accessibility. If you need this notice in another format, email us and we’ll send it.
Contact
Nhanology, the company behind RichDue · nathan@richdue.com. The full privacy policy covers everything else.