Privacy Policy

The short version

Our applications are built so that your own records stay on your own device. Addtivity Finance keeps your receipts, statements, transactions and balances in a database file on your computer. We cannot read them, because we never receive a copy.

We do not sell personal information — to anyone, for any purpose, at any price. There is no advertising in any of our products, no data broker relationship, and no profile built about you to sell on. Where that is guaranteed by architecture rather than by promise, this document says which it is.

1. Who this covers

This policy is issued by Addtivity Data, LLC ("Addtivity Data", "we", "us"), the controller responsible for the processing described here. It covers:

• This website, addtivitydata.com.
• The Addtivity Command suite — Addtivity Finance, Business Operations, Garden, Contacts, Study and News — on every platform they are published for.

Of those six applications, only Addtivity Finance is released. The other five are in development and have no public users. Where a released application collects something this policy does not already describe, this document is updated before that application ships, not afterwards.

Where a product has its own more detailed policy, that policy governs the product and this one governs everything else. Nothing in a product policy reduces the rights described in section 8.

2. This website

addtivitydata.com collects nothing. There is no account system, no contact form, no newsletter signup, no analytics script, no advertising tag, and no cookie is set by this site. There is no cookie banner because there is nothing to consent to.

Two things happen anyway, and both are named here rather than left implied:

• Hosting logs. This site is served by Netlify, which — like any web host — records standard request data such as IP address, timestamp, requested page and user agent, for delivery, security and abuse prevention. That is Netlify's processing under its own policy. We do not query, export or build a dataset from it.
• Fonts. Typefaces are requested from Google Fonts, so your browser contacts fonts.gstatic.com and Google receives your IP address. The site is designed to render completely without them and they never block the page.

3. Our applications

Addtivity Finance

Stays on your device: receipts, pay stubs, bank and brokerage statements, any images or PDFs of them, the text extracted from them, and your transactions, accounts, balances, budgets, goals and categories. These live in an ordinary database file in your user profile. They are not uploaded, not backed up by us, and not readable by us. If you lose the device we cannot recover them, because we never had them — keep your own backups.

Leaves your device, only in these cases:

• Your account, if you create one. We store your email address, an account identifier, and which devices you have signed in from. This is what lets preferences follow you between devices. Held by Supabase in the United States, with row-level security so your account can read only its own records.
• A bank connection, if you choose to make one. This is opt-in and one-way. You sign in to your bank on Plaid's own page in your own browser — the application never sees and cannot store your bank credentials. We request a single Plaid product, transactions; we do not request payments, transfers, identity or income. There is no code path in the application that can move money. Nothing already in the app is sent out. You can disconnect in Settings, which revokes the connection at Plaid rather than merely forgetting it locally.
• Optional lookups. Some conveniences call the internet when you use them — product images, map geocoding, fuel prices. They send the specific item you asked about and nothing else about you. They are not required.
• Diagnostics. Crash logs are written to a file on your computer and are not transmitted. If you choose to send one to support, that is you sending us a file.

Business Operations, Garden, Contacts, Study and News

These five are in development and not publicly released. They are built on the same foundation as Finance: your working data is held on your own device, and the account record we hold is the same email address, identifier and device list described above.

Two specifics worth stating now rather than at launch:

• AI features are bring-your-own-model. Where an application offers them, you choose the model — one running locally on your own machine, or a third-party service you supply a key for. If you point it at a third-party service, what you send goes to that provider under their policy, not ours. Any key you enter stays on your device and is never transmitted to us. A local model means nothing leaves the machine at all.
• Addtivity News reads published sources, not you. It works from an approved list of publications; it does not build a profile of your reading to target anything at you, because nothing is targeted at you.

Each of these gets its own section here, with specifics, before it is released.

4. What we never do

• We do not sell personal information, and we have not in the preceding twelve months.
• We do not share it with advertisers or data brokers. There is no advertising in any product.
• We do not use your financial or health data to train machine-learning models. Categorisation in Finance runs on your own machine against a fixed list, and what it learns from your corrections stays there.
• We do not read your documents. We cannot; they are not on our systems.
• We do not track you across other companies' websites or apps, and we do not respond to advertising identifiers because we do not use them.

5. Why we process it, and on what basis

• To provide the product you asked for — performance of a contract. Account records, sign-in, preferences, marketplace orders.
• To connect a bank, when you ask — your explicit consent, withdrawable at any time in Settings.
• To keep the service secure and working — our legitimate interest in preventing abuse and diagnosing faults.
• To answer you when you email us — our legitimate interest in responding to correspondence.

Before anything leaves your device for the first time, you are shown what that means and asked to agree. We record what you were shown, which version of that wording it was, and when you agreed — so that if it changes materially you are asked again rather than assumed to have consented to something you never read.

6. Who else processes it

We use a small number of service providers. They act on our instructions and may not use your information for their own purposes.

• Supabase — database, authentication and file storage. United States.
• Netlify — website hosting and request logs.
• Plaid — bank connectivity, only if you connect a bank. Plaid's handling is governed by its own end-user privacy policy, which you accept on Plaid's page during connection.
• Google Fonts — typeface delivery for this website, which discloses your IP address to Google.

We may also disclose information if legally compelled, or to protect the rights or safety of a person — and if a company or product is ever sold or merged, the acquirer is bound by this policy until you are told otherwise.

7. International transfers and storage

Our service providers store data in the United States. If you are in the United Kingdom, the European Economic Area or another region with transfer restrictions, your information may be transferred there. Where required, those transfers rely on Standard Contractual Clauses or an equivalent approved mechanism operated by the provider.

8. Your rights

Depending on where you live, you may have the right to access a copy of your information, correct it, delete it, export it in a portable form, object to or restrict certain processing, and to withdraw consent at any time.

If you are in California, that includes the rights to know, delete, correct and opt out of sale or sharing — and since we do not sell or share personal information, there is nothing to opt out of. We will never charge you for exercising a privacy right, and never treat you differently for it.

In practice, most of your data is already in your possession: Finance and Fitness records are in a standard database file on your own machine, which you can read, copy or delete without asking us. For the account information we hold, contact us at the address in section 12 and we will respond within the timeframe the applicable law requires — and within 30 days in any case.

If you are in the EEA or UK you also have the right to complain to your local data protection authority.

9. Deleting your data and your account

Deleting your records: Addtivity Finance can erase everything it holds from inside the application — the records, the stored images, and any bank connections, revoking those at Plaid rather than only forgetting them locally. Deletion is immediate and permanent; we do not keep a copy.

Deleting your account: to delete your Addtivity Command account and everything associated with it from our systems, email us at the address in section 12 from the address on the account. We will complete the deletion and confirm it. Deletion is permanent and cannot be undone.

We keep account records until you ask us to delete them. Nothing is aged out on a timer, because a receipt from four years ago is still a receipt you may need — and deleting somebody's records on a schedule is not a feature. Hosting logs are retained by our providers on their own standard cycles.

10. Security

Accounts support two-factor authentication using a time-based one-time code from an authenticator app. That is not phishing-resistant — a code can still be read aloud to someone impersonating support, and we would rather say so than let the word "secure" do work it has not earned. Every database row is protected by row-level security so that an account can reach only its own records, and all traffic is encrypted in transit.

No system is perfectly secure. If a breach affects your information we will notify you and the relevant regulator as the law requires.

11. Children

Our products are not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, write to us and we will delete it. Where local law sets a higher age for consent to data processing, we apply that age instead.

12. Contact

Privacy questions, rights requests and deletion requests all go to one place, and are read by a person.

Addtivity Data, LLC
hello@addtivitydata.com

13. Changes

If this policy changes materially we will say so in the affected product rather than quietly updating this page, and where a change affects something you previously agreed to, we will ask again. The version number and effective date at the top of this page always reflect the current text.