ToFi.
Privacy Policy
Effective 11 August 2026
ToFi brings your bank, credit card, and brokerage accounts into a single view. Doing that means handling financial information, so this policy sets out exactly what is collected, where it goes, and what it is used for. It is written to describe what the app actually does rather than to reserve rights we do not exercise.
The short version. ToFi collects your email address, the financial account data you choose to connect, and the categories, budgets, and notes you create. It never sees your bank username or password. There is no advertising, no tracking, and no analytics SDK in the app. Your information is never sold, rented, traded, or shared for marketing.
Information we collect
Account identity
When you sign in with Google, we receive your name and email address and store them to identify your account. We never receive your Google password.
Financial account data
ToFi uses Plaid to connect to financial institutions. When you link an account we receive, and store:
- Account names, types, and current balances
- Transactions, including date, amount, merchant name, and category
- Investment holdings and investment transactions, for brokerage and retirement accounts
- The name of the institution the account belongs to
Your bank credentials are entered inside Plaid Link and go directly to Plaid and your bank. ToFi never receives, sees, or stores them. Plaid's handling of that information is governed by its own privacy policy, at plaid.com/legal.
Plaid developer credentials
ToFi runs your bank connections under your own Plaid developer account, so the app stores the Plaid Client ID and secret you provide. The secret is encrypted at rest with AES-256-GCM and is used only to make Plaid API calls on your behalf.
Content you create
Categories and subcategories, budgets, notes and renames you apply to transactions, reimbursement and transfer markings, and the merchant rules ToFi builds from your corrections.
What we do not collect
ToFi requests no device permissions. It does not access your location, contacts, photos, camera, microphone, calendar, or health data. It contains no advertising SDK, no attribution SDK, and no third-party analytics or crash-reporting SDK. It does not use the advertising identifier (IDFA) and does not track you across other companies' apps or websites.
How your information is used
- To show your balances, transactions, budgets, and net worth
- To categorize transactions and improve that categorization from your corrections
- To detect transfers between your own accounts and credit card payments, so they are not double counted as spending
- To keep you signed in
- To diagnose problems you report to us
We do not use your financial data to build advertising profiles, and we do not perform automated decision-making that produces legal effects.
Service providers
ToFi shares information only with the providers needed to operate the service, and only for that purpose:
- Plaid — connects to financial institutions and supplies account data
- Supabase — authentication and database hosting
- Vercel — hosts the ToFi API
- Google — sign-in
- Expo — application builds and updates
- Netlify — hosts this website
We do not sell, rent, trade, or otherwise provide your personal information to third parties for their own commercial purposes. We may disclose information if required by law or to protect the safety and rights of our users.
Security
Data is encrypted in transit with TLS. Plaid access tokens and your Plaid secret are encrypted at rest. Your session is held in the iOS Keychain on your device. Access to production data is limited to those who need it to operate the service. No system is perfectly secure, and we cannot guarantee absolute security.
Retention and deletion
We keep your information for as long as your account exists. You can disconnect an institution at any time from Settings, which removes its accounts and transactions and revokes ToFi's access to it.
To delete your account entirely, open Settings → Delete Account in the app. This is immediate and cannot be undone: we delete your account, your categories, budgets, notes, transactions, and holdings, and your saved Plaid credentials, and we revoke ToFi's access to every institution you linked. Backups are purged on their normal rotation, within 30 days. If you would rather we did it for you, email tofi.wallet@gmail.com.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to certain processing. Email us and we will act on your request. We will not discriminate against you for exercising these rights.
Children
ToFi is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has provided us information, contact us and we will delete it.
Changes
If this policy changes materially we will update the effective date above and notify you in the app before the change takes effect.
Contact
Questions about this policy or your data: tofi.wallet@gmail.com.