Privacy policy · Yesroom

This policy explains what Yesroom (“Yesroom,” “we,” “us”) collects when you use the Yesroom iPhone app, Yesroom on the web (yesroom.app/app), the Yesroom browser extension and yesroom.app (together, the “Service”), how we use it, and the choices you have. For a plain-language summary, see Private by design.

1. Information we collect

Information you give us

Account information. Your email address, or the identifier and relay email address Apple provides if you use Sign in with Apple.
Household information. Budgets, categories, buckets, shopping lists, income and bill confirmations, and the names or initials you choose for household members.
Referral code. If you sign up on the web through a link with a referral code, we store that code on your household so the person who referred you can be credited. It is never changed afterwards.
Messages to us. What you send to support, including your email address.

Information from your bank, through Plaid

When you connect a bank, Plaid Technologies, Inc. collects your login details directly from you. We never receive your bank username or password. We receive an access token, and from Plaid we receive account names and types, balances, and transaction details such as date, amount, and merchant description. Plaid’s handling of your information is described in the Plaid End User Privacy Policy.

Information that stays on your device

If you grant permission, the app reads calendar events and your location on your iPhone to estimate upcoming spending and to recognise when you arrive at a store. Calendar text, event details and precise location are not sent to us or stored on our servers. Only derived, non-identifying results (for example, an estimated amount for a category on a given day) are saved to your household.

If you share a web page to Yesroom, the app opens that page directly from your iPhone, without cookies or sign-in, to read its price. The page address and contents stay on your phone; Yesroom’s servers never receive them.

Information kept in your web browser

If you use Yesroom in a browser, the browser keeps your sign-in, the time you last used Yesroom (so we can sign you out after 30 days without use), a referral code from the link you arrived on until your household is created, and, for up to 30 minutes while your bank’s own sign-in page is open, a short-lived Plaid token so the connection can finish. We use no advertising or tracking cookies.

Information from your use of the Service

Usage and diagnostics. Anonymous event names and crash or error reports, used to improve the app. We configure these to exclude merchant names, amounts, locations and calendar content.
Subscription status. Whether your household has an active subscription and when it ends. Apple, or Stripe for subscriptions bought on the web, processes payment; we do not receive your payment card details.

2. How we use information

To provide the Service: show balances, budgets and verdicts, sync your household, and run the shared list.
To secure the Service, prevent abuse and fix problems.
To process and manage subscriptions.
To respond to you and send service messages, such as sign-in links.
To improve the Service using anonymous analytics.
To comply with the law.

We do not sell your personal information, we do not share it for advertising, and we do not sell, license or transfer location data.

3. How AI is used

We use AI models in limited ways. On your device, a model may read calendar titles to classify events. On our servers, a model may normalise merchant text from your transactions, for example turning a bank’s abbreviated description into a business name. The model receives only cleaned merchant text and does not receive your name, account numbers or amounts. Dollar figures and sentences about your money are produced by code and reviewed templates, not by AI.

4. Who we share information with

We share information only with the service providers that help us run Yesroom, under contracts that limit their use of it:

Plaid, to connect your bank accounts and retrieve your data.
Supabase, our database, authentication and server-function provider.
Apple, for Sign in with Apple, the App Store and subscription payments.
RevenueCat, to manage subscription status and, for subscriptions bought on the web, checkout.
Stripe, to take payment for subscriptions bought on the web.
An AI model provider, for merchant-name normalisation as described above.
Analytics and error-reporting providers, for anonymous usage and crash data.
Email delivery providers, to send sign-in links and service emails.

Members of your household can see the household data described in the app. We may also disclose information if required by law or to protect rights, safety and the security of the Service, or in connection with a merger or sale of the business, in which case this policy’s protections continue to apply to your information.

5. How long we keep information

We keep household data while your account is active. When you delete your account, we remove your data and disconnect your bank connections with Plaid right away. Copies in our providers’ backups are erased as those backups expire. We may keep limited records longer where the law requires it.

6. Your choices and rights

Access and export. Export your transactions, budgets and buckets as CSV in Settings.
Delete. Delete your account in Settings.
Permissions. You can withdraw calendar, location and notification permissions at any time in iOS Settings.
Disconnect banks. Disconnect a bank in the app. You can also manage connections at my.plaid.com.
Other rights. Depending on where you live, you may have rights to access, correct, delete or port your information, or to object to certain processing. Email [email protected] and we will respond within the time the law requires. We will not discriminate against you for exercising your rights.

7. Security

We use industry-standard safeguards, including encryption in transit, row-level access controls so that only your household can read its data, and a vault for bank access tokens that only our server functions can open. No system is perfectly secure, but we maintain a written information-security program and limit access to what is needed.

8. Children

Yesroom is not intended for anyone under 18, and we do not knowingly collect information from children.

9. United States

Yesroom is operated from the United States and your information is processed there. This notice is also intended to serve as our privacy notice for financial-privacy purposes: we collect and use the information described above to provide the Service, and we do not share it with unaffiliated parties for their own marketing.

10. Changes

If we change this policy, we will update the date above and, for material changes, tell you in the app or by email before they take effect.

11. Contact

Questions or requests: [email protected].