Legal

Privacy Policy

Effective date: October 4, 2026  ·  The Path Out LLC

This policy explains how The Path Out LLC handles information when you use TPO Budget, its website, and the bank-sync gateway operated for the app. TPO Budget is local-first. It performs an automatic update check, and some optional features send specific data to The Path Out LLC or to services you choose.

Information stored on your device

Accounts, balances, transactions, budgets, categories, merchants, recurring schedules, goals, planning data, app settings, privacy audit records, and assistant history are stored in the app's encrypted local database. The database uses SQLCipher encryption, and its key is kept in the platform Keychain or Keystore with device protection. Provider API keys are stored separately in the platform's secure credential storage.

The Path Out LLC does not receive the contents of that database by default. Information leaves the device only through the automatic update check or when you use an optional feature described in this policy. Information imported from Plaid or Apple FinanceKit is treated like information you entered manually and can later be included in an export, backup, Household Sync transfer, or an approved AI-Enhanced aggregate.

Permissions and why we ask

The app requests a permission only when it is needed for a feature you use:

• Face ID, Touch ID, or device authentication — to unlock the app and its local encryption key.
• Camera — to scan a Household Sync QR code or take a wallpaper photo. TPO Budget does not upload that photo.
• Photo Library — to select an in-app wallpaper. The selected photo remains in the app's local storage.
• Microphone and Speech Recognition — for voice input. TPO Budget does not retain microphone audio. The operating-system speech service processes audio under the platform provider's terms.
• Local Network — for optional Household Sync between two devices on the same network.
• FinanceKit — for read-only access to the Apple Wallet accounts and transactions you select.
• iCloud — to create, list, restore, and delete the encrypted backups you request.

You can change system permissions at any time in your device settings.

Bank sync and our Plaid gateway

Bank sync is optional. If you connect a bank, Plaid Link lets you select an institution and accounts and authorizes TPO Budget to retrieve account details, balances, and transactions. Plaid or your financial institution receives the sign-in information you enter during that flow; TPO Budget does not receive your online-banking password. Plaid also receives a random per-install identifier from TPO Budget and may collect financial, contact, device, and usage information directly as described in Plaid's End User Privacy Policy. TPO Budget requests Plaid's Transactions product. Sync uses cached balances; eligible checking and savings accounts may receive automatic live Balance checks within the subscription allowance.

Requests pass through an authenticated gateway operated by The Path Out LLC so Plaid developer credentials and long-lived access tokens are not shipped in the app. The gateway relays Plaid account, balance, and transaction responses in memory and does not persist or log those response bodies. Imported records are stored in the encrypted database on your device.

The gateway retains the following information:

• Installation authentication record: a random installation identifier, public key, one-way authentication-token hash, platform, app version, attestation status, status, and registration and last-seen timestamps.
• Plaid credential record: the Plaid Item ID and access token, plus status and creation, update, and removal-request timestamps. Access tokens are encrypted at rest with AES-256-GCM and scoped to the authenticated installation and Item. The token is never returned to the current app.
• Webhook status: the Plaid Item ID, webhook type and code, and receipt time for an unread Plaid change notification. The financial response is fetched only when the app next syncs.
• Optional bank-sync access and billing record: a hashed Apple purchaser identity, authenticated installation bindings, purchase environment, access status and expiry, bank connection ownership and removal state, monthly connection and Balance-check counts, request reservation identifiers and outcomes, and invited-tester funding metadata. The Apple identity needed for current subscription lookups is encrypted at rest. Apple-signed purchase proofs are processed in memory and are not retained. Notification identifiers are hashed to prevent duplicate processing and retained for 90 days. Records older than 90 days are purged at server startup and hourly. These records do not contain your bank balances or transactions.
• Operational request log: timestamp, HTTP method, route pattern, response status, installation identifier, and request duration. The reverse proxy can also record ordinary network metadata such as IP address, protocol, host, requested URL, and User-Agent. Request and response bodies, authorization headers, Plaid secrets, access tokens, account IDs, balances, and transactions are excluded; sensitive proxy headers are redacted.

An active Plaid token remains in the encrypted gateway vault while its bank connection is active. Disconnecting asks Plaid to remove the connection and seals the token so it can be used only to retry removal. The token is deleted as soon as removal succeeds and, if removal continues to fail, no later than seven days after the request. After that, you may need to remove the connection through Plaid Portal. Wipe Local Database asks the gateway to erase every Plaid token associated with that installation, but it does not itself guarantee deletion of the corresponding connection or data held by Plaid; disconnect first or use Plaid Portal if you also want Plaid to remove it.

Installation authentication records remain while the installation is registered. Inactive records are reviewed at least annually and deleted when they are no longer needed for authentication, abuse prevention, security investigation, or legal obligations. Operational logs are retained for no more than 30 days, except for a documented security incident or legal hold. Encrypted gateway backups are retained for no more than 28 days; a documented manual recovery snapshot may be kept for up to 30 days. Pending webhook records remain until consumed or administratively deleted. You may request deletion of Company-held installation, credential, webhook, and eligible log records as described under Your rights and choices.

Optional bank-sync purchases

Apple handles payments and purchase restoration. When you choose bank sync, the app sends an Apple-signed purchase proof to our authenticated gateway. We verify it with Apple and request current subscription status to activate, restore, renew or end access across your devices. We do not receive your payment card details. Purchaser identifiers, device bindings and usage metadata link optional bank access to your purchase; they are used for access, shared limits, fraud prevention and resolving uncertain provider charges, not advertising.

Access and usage records are retained while needed to verify access, enforce shared allowances or resolve outstanding billing and bank-removal exposure. We review inactive records at least annually and remove records no longer needed for those purposes or legal obligations. Deleting local app data alone does not erase an outstanding server billing or removal record. Contact us through the rights and choices process below to request eligible deletion.

An uninvited Apple Sandbox purchase enables a sample-data demo, not a real bank connection. The demo uses its own on-device database and is wiped on exit; it does not read or modify your saved financial database. Real-bank testing requires a verified Sandbox purchase and an owner-issued invitation.

Apple FinanceKit

On supported iOS versions, you may authorize read-only access to selected Apple Wallet accounts and transactions. Apple provides those records directly to the app, which stores them in the local encrypted database. TPO Budget does not send the raw FinanceKit response to The Path Out LLC. Once imported, FinanceKit-derived records may be included in user-directed backups, exports, Household Sync, and the tokenized or rounded AI-Enhanced summaries described below.

AI-Enhanced assistant

Guardian runs on the device unless you configure your own API credentials for OpenAI, Anthropic, OpenRouter, Groq, or a custom HTTPS endpoint and then explicitly enable AI-Enhanced. Saving or changing a provider verifies the credential with a technical test, disables AI-Enhanced, and revokes prior cloud approvals. It does not authorize personal or financial data transmission. Provider keys remain in device secure storage until you remove them; The Path Out LLC does not receive, proxy, or store these AI requests or keys.

Enabling AI-Enhanced presents one provider-specific disclosure and grants both of the following data uses together:

• Request interpretation: the typed question exactly as entered or the normalized on-device voice transcript; locale and supported actions; up to five recent merchant names and five category names; up to three shortened recent assistant exchanges, which can contain amounts; and the visible item's label, type, screen, and internal record identifiers. A merchant or account name written in the question is included exactly as written. These fields are not tokenized or rounded.
• Financial answers and insights: the current date and reporting currency; account type and asset or debt status; tokenized account, goal, merchant, and custom-category names; rounded balances, minimum payments, budgets, spending, recurring income and expenses, net worth, savings goals, and debt-payoff projections; interest rates; standard category names; recurring frequency; goal progress and month-level deadlines; and up to 12 months of monthly cash-flow and category aggregates. Up to five recent financial-answer exchanges may be included with names tokenized and currency figures rounded.

Individual transaction rows, account numbers, bank credentials, and Plaid access tokens are excluded from the financial-summary payload. Tokenization replaces a name with a session-scoped label; it is a data-reduction measure, not a promise of legal anonymization. Rounded figures remain financial information.

After you enable AI-Enhanced, opening Today may automatically request one cached proactive Guardian brief per day using the financial summary, even if you did not ask a new question. Other cloud requests interpret a question or compose an answer you requested. Provider responses are treated as suggestions, and any database write still requires local confirmation.

Requests go directly from your device to the configured recipient. OpenRouter is a gateway and may pass the request to the upstream provider serving your selected model. A custom endpoint may also forward requests elsewhere. Each recipient may retain prompts, outputs, identifiers, and usage metadata, and may use them under its own settings and policies. Some models or account tiers may permit model training. Review the current provider terms before enabling: OpenAI data controls, Anthropic retention, OpenRouter privacy, and Groq data controls. Your custom endpoint operator is responsible for its own notice and practices.

Selecting On-Device Only blocks interpretation, financial-answer, and proactive- brief requests and revokes both approvals. Removing the provider also deletes its locally saved configuration. Turning AI-Enhanced off does not delete data a provider already received; use that provider's controls for provider-held data.

ElevenLabs voice synthesis

ElevenLabs voice is a separate optional approval available only while AI-Enhanced is enabled. If you add your own ElevenLabs key and approve the disclosure, the app sends the exact text Guardian will speak plus the selected voice and model settings to ElevenLabs. Spoken text can contain unrounded amounts, merchant names, account names, balances, and category totals. The API key is sent in the authentication header. No microphone audio, bank credential, account number, or transaction-history table is included in that synthesis request.

TPO Budget temporarily caches the generated audio on the device for playback and deletes that local file afterward. ElevenLabs may retain text, audio, and request metadata under its Privacy Policy and the controls available for your account. Selecting On-Device Only immediately blocks new ElevenLabs requests, stops active ElevenLabs playback, revokes this approval, and returns speech to the device voice. The saved key remains until you remove the ElevenLabs configuration. Revoking approval does not delete information ElevenLabs already received.

Backups, exports, and Household Sync

• iCloud backup: when you request a backup, the app uploads the SQLCipher-encrypted database and a separate copy of its database key encrypted with AES-256-GCM using a key derived from your backup password. Both files are stored in your private iCloud container. The Path Out LLC does not receive the backup or password. The backup remains until you overwrite or delete it in the app or remove TPO Budget data from iCloud. Apple processes the encrypted files under its own iCloud terms and privacy policy.
• Password-encrypted data export: the app can create an AES-256-GCM encrypted JSON file containing portable accounts, transactions, budgets, recurring items, goals, assets, custom categories, rules, splits, strategy settings, debt-plan settings, and transfer records. Your password and plaintext stay on the device. The temporary app copy is deleted after the share sheet closes; a copy saved or sent to another destination remains there until you delete it.
• Local ZIP backup: this same-device restore bundle contains plaintext transaction and account CSV files, a SQLCipher-encrypted database file without its device key, and a README. Anyone who can open the ZIP can read the CSVs. The temporary app copy is deleted after the share sheet closes; a shared or saved copy remains under the recipient's or storage provider's control.
• CSV, report, and diagnostics exports: these are created only when you request them and are passed to the operating-system share sheet. A CSV or report may be readable and contain the fields shown in the export flow. Password-protected diagnostics use the encrypted-export format. The destination you select controls its copy.
• Recovery snapshots: before a restore, import, or database migration, the app may keep a limited number of complete SQLCipher-encrypted recovery snapshots in its private on-device storage so you can roll back a failed or mistaken operation. The app retains at most two pre-restore snapshots and the newest pre-migration snapshot. Wipe Local Database deletes and verifies removal of the app-managed snapshot directory before wiping the live database.
• Household Sync: when you pair two devices on the same local network, the app sends supported financial records over an encrypted peer connection. The Path Out LLC does not relay the transfer. The receiving device keeps its synchronized copy until it is deleted there.

Wipe Local Database affects the app's current local database and app-managed recovery snapshots. It deliberately does not delete iCloud backups or files you exported, shared, or copied elsewhere, so those files remain recoverable. Delete those copies separately when you no longer want them.

Live investment pricing

If you enable live pricing, the app sends only requested ticker symbols or coin IDs to the configured public market-data source, which may include Yahoo Finance, Stooq, or CoinGecko. It does not attach account names, balances, position quantities, or transaction history. The provider receives ordinary network metadata and applies its own policy.

App updates and diagnostics

On startup, TPO Budget automatically asks Expo's update service whether newer app code is available. This check cannot be turned off inside the app. It sends the platform, app version, release channel, current update identifier, a random per-install update identifier, and, when the previous run ended in a fatal error, the stored error message. It does not intentionally attach the financial database. Expo processes the request under its Privacy Policy.

TPO Budget does not include a third-party analytics or crash-reporting SDK. Apple may provide App Store or TestFlight diagnostics according to your device settings and Apple's policy. Local privacy, performance, and error logs stay on your device unless you explicitly export them. Review a diagnostics export before sharing it.

Website waitlist

If you join the waitlist, The Path Out LLC stores your email address to send the confirmation and launch notice. The website stores the address in its waitlist database and sends it to a separate The Path Out mailing system used to deliver those messages. The website record remains until you unsubscribe or The Path Out LLC deletes it in response to a verified request; sending the launch notice does not automatically delete that record.

The confirmation contains a one-click unsubscribe link. Using it immediately deletes the website waitlist record and makes a best-effort request to delete the matching address from the separate mailing system. If that synchronization fails, the mailing-system copy may remain. You may request verified deletion from all systems controlled by The Path Out LLC by emailing us; we aim to complete that request within 30 days unless law permits or requires a different period.

Retention and deletion

• On-device records: retained until you delete them, wipe the local database, or uninstall the app, subject to the operating system's handling of secure credentials. Use the provider-removal controls before uninstalling if you want saved AI keys removed and use bank disconnect if you want Plaid removal requested.
• Company gateway records: retained and deleted on the schedules in the Bank sync section. A legal hold, fraud inquiry, or security incident may require limited records to be kept longer.
• Backups and exports: retained until you or the destination provider deletes them. Deleting the app or wiping its local database does not recall copies outside the app.
• Cloud AI and other providers: retained independently under the provider account, settings, contract, and privacy policy. Turning off a TPO Budget feature prevents future app requests but does not erase a provider's existing copy.
• Privacy or support correspondence: retained for up to 24 months after the request closes unless law requires otherwise. We do not ask you to send financial records for a privacy request.

Your rights and choices

• Use the app without Plaid, FinanceKit, cloud AI, ElevenLabs, iCloud backup, Household Sync, or live market pricing.
• Turn off AI-Enhanced or ElevenLabs approval in Settings and remove saved provider credentials separately.
• Disconnect each linked bank in Settings and use Plaid Portal for connections Plaid still retains.
• Delete individual local records or use Wipe Local Database to remove the local financial database and app-managed recovery snapshots.
• Delete iCloud backups in the app or through iCloud storage settings and delete exported files from every destination where you saved or shared them.
• Export supported data in CSV or password-encrypted form.
• Request access to or deletion of information held by The Path Out LLC by emailing contact@thepathout.com. We may ask for limited information needed to verify the installation or request. We aim to complete a verified deletion request within 30 days unless law permits or requires a different period.

Requests to The Path Out LLC do not automatically delete information controlled by Apple, Plaid, an AI provider, ElevenLabs, an export recipient, or another third party. Use that provider's controls or contact it directly as well.

Security

• Local database: SQLCipher AES-256-CBC with HMAC-SHA512 page authentication.
• Portable encrypted exports and iCloud key escrow: AES-256-GCM with password-based key derivation.
• Plaid credential vault: AES-256-GCM authenticated encryption with a unique initialization vector and installation-and-Item binding.
• Transport: network integrations use HTTPS/TLS; Household Sync uses an encrypted peer channel on the local network.
• Data minimization: the Plaid gateway excludes request and response bodies from operational logs and does not persist relayed financial response content.

No storage or transmission method is perfectly secure. Keep your device, backup passwords, API keys, and exported files protected and report suspected problems to the contact below.

Children

TPO Budget is not directed to children under 13, and The Path Out LLC does not knowingly collect personal information from children under 13. Plaid's service has its own eligibility rules.

Changes to this policy

We will update the effective date when this policy changes. Material changes to app data handling will also be reflected in the app's disclosures or release notes as appropriate. Provider policies and settings may change independently, so review them before enabling or continuing to use an optional service.

Contact

The Path Out LLC is responsible for the Company-held information described here. Questions, privacy requests, or deletion requests:  contact@thepathout.com