FIG Privacy Notice
Private beta · Version 2026-09-08 · Not attorney-reviewed
Who and what this notice covers
This notice describes the current private FIG beta. Dan Fink, an individual based in Wisconsin, currently operates FIG and is responsible for the practices described here. FIG is a product name, not a separate incorporated entity. The standard beta uses test transactions. Explicitly invited read-only bank testers may authorize real account and transaction data through the Bank connection page. No real money moves; never supply real payment cards.
Information processed
When you create or use an account, the service processes your name, email, authentication/session information, charity selections, calculation rules, categories, monthly cap and pause settings. Sandbox connections provide test account and transaction information. For explicitly invited read-only bank testers, authorized connections provide real account and transaction information, including account names, masks, transaction dates, merchants and amounts. Connection identifiers and encrypted access tokens are stored to maintain the feed. Earlier optional test-card setup used Stripe; previously saved provider identifiers and limited test payment-method status/details may remain until account cleanup. New consumer signup does not request a payment card. The hosting, authentication and infrastructure providers may process IP addresses, device/browser information and operational logs.
Purposes
We use this information to authenticate you, save your plan, calculate planned round-ups, display private records, maintain and secure connections, diagnose failures, respond to requests and test the service. Account creation records the document version and beta acknowledgment in account metadata. Operators may send account-specific in-app support or welcome messages. They may inspect relevant signup/sign-in status to answer support questions. These records are not described as an immutable audit trail. We do not sell personal information or use transaction information for third-party advertising. We do not silently post your information to social networks.
Service providers and sharing
Supabase provides authentication and database services; Vercel hosts the web/API; Upstash provides queue and rate-limit infrastructure; Plaid provides sandbox bank linking and authorized read-only bank feeds for explicitly invited testers; Stripe may retain records from earlier optional test payment-method setup; it is no longer part of consumer signup. Necessary provider identifiers and job data pass through these services. An authorized operator may access information to operate, secure or support the beta. We may disclose information when legally required or needed to protect rights and security. No charitable partner currently receives a live gift through this beta.
Optional and future features
Phone discovery and hosted social features are disabled in the current connected-beta configuration. Local practice screens may contain fictional activity. Enabling phone lookup, social sharing, advertising, live bank data, real billing or a giving partner requires an updated review and appropriate notices and choices. There is no address-book upload in this beta.
Security and limits
FIG uses encrypted bank-access tokens, authenticated access and server-side controls intended to protect account data. Provider secrets are not intended for client delivery. No system is perfectly secure. Do not send passwords, bank credentials, payment-card numbers or identity documents in support messages. This notice is not a guarantee against unauthorized access or loss.
Retention and deletion
Data is retained while needed to operate and evaluate the beta and address security, support or legal requirements. You can request account deletion and disconnect a bank feed. Cleanup can involve provider requests and may not be instantaneous; backups and provider-controlled records may follow separate retention schedules. Deletion verification and a documented retention schedule remain beta limitations; contact the operator for the status of a specific request. Disconnecting a feed does not necessarily erase historical ledger records, and signing out does not request deletion. We do not promise an unverified deletion deadline.
Your choices
You may decline bank linking, change or pause your giving plan, stop using the beta and request access, correction or deletion through the beta contact. Available legal privacy rights depend on your jurisdiction; nothing here limits rights provided by law. The beta is for adults 18 and older, not children. We do not seek children’s information.
Contact and changes
Contact Dan Fink through the channel used for your beta invitation for privacy or account questions. Material changes will be identified by a new notice version. This notice has not been attorney-reviewed and is not a finished public-launch privacy policy. For this invited beta, use the invitation channel to reach the operator; do not submit passwords or financial account numbers. A dedicated public contact and jurisdiction-specific review remain outstanding.