GRXFFN

Privacy Policy

Effective date: August 5, 2026

This Privacy Policy explains how Zackery Griffin ("we", "us", "our") collects, uses, and protects information when you use Grxffn Budgeting at grxffn.com/budgeting and the grxffn.com website (together, the "Services"). If you do not agree with this policy, please do not use the Services.

1. Who is responsible for your data

  • Owner: Zackery Griffin (sole proprietor)
  • Location: California, United States
  • Contact: [email protected]

We are the data controller for personal information collected through the Services.

2. What we do not collect

This section comes first because it is the point of the product.

  • No bank connections. We do not link to financial institutions, we do not use aggregation services such as Plaid, and we never ask for your online banking username or password. No transaction feed is imported on your behalf.
  • No full card numbers. The app asks only for a nickname, an optional last four digits, and an optional cardholder name and expiry so you can tell your cards apart. Never enter a full card number.
  • No advertising or tracking. We do not run ads, we do not use advertising or cross site tracking cookies, and we do not share your data with ad networks or data brokers.
  • No product analytics. We do not currently run any analytics or session recording tool in the app.
  • No sale of personal data. We do not sell or share your personal information, as those terms are defined under California law.
  • No model training. Your data is not used to train machine learning models, by us or by our providers.

3. Information you provide

  • Account information. Your email address and a password. Passwords are stored only as secure hashes by our authentication provider, and we never see them.
  • Profile details. First and last name, an optional profile photo, and your chosen accent color.
  • Financial entries. Everything you type into the budget: incomes, expenses with dates, amounts, categories, descriptions, and personal or business labels, card nicknames and starting balances, card and loan payments, budgets and their limits, subscriptions and their schedules, savings sources and goals, and loans with balances, rates, and payments.
  • Household information. Your household name, its invite code, who belongs to it, and pending requests to join it.
  • Statement text. If you upload a statement file, its text is read in your browser and the transaction lines are sent for parsing as described in Section 5.
  • Messages you send us. Anything you include when you contact us by email.

Financial entries are sensitive by nature. Everything in this policy is written with that in mind.

4. Information collected automatically

Because we run no analytics, this is limited to what is technically required to operate the Services:

  • Authentication tokens kept in your browser's local storage so you stay signed in.
  • Standard server and security logs held by our infrastructure providers, which may include IP address, request times, and error details, used to keep the Services running and to investigate abuse.

5. Ava and statement processing

The app includes an assistant named Ava that turns plain language and statement text into proposed entries. This is the one place where your information leaves our own infrastructure, so it is worth being precise.

  • What is sent. Only the text you submit: the sentence you type, or the transaction lines extracted from a file you uploaded. Along with it we send context needed to interpret it, namely your card nicknames, savings source names, the recent messages in that chat, your first name, and today's date.
  • Where it goes. To a processing function we operate, and from there to Anthropic, which runs the language model that reads the text. Anthropic processes it to return a result and does not use it to train models.
  • Files stay on your device. A statement file you upload is read and parsed inside your browser. The file itself is never uploaded to us. Only the transaction text is sent for parsing.
  • What Ava cannot do. Ava has no access to your database. She returns proposed entries, and your app writes them under your own account after you pick the account to file them under.
  • Your choice. Ava is optional. If you never open the chat and never upload a statement, no financial text is sent to any language model.

6. How we use your information

  • To provide the Services: to store your entries and render your budget, charts, and projections back to you and your household.
  • To operate accounts: to sign you in, verify your email, reset your password, and manage household membership.
  • To keep the Services secure: to investigate errors, prevent abuse, and protect accounts.
  • To respond to you when you contact us.
  • To comply with legal obligations and enforce our Terms of Service.

We do not send marketing email.

7. Household sharing

A household is a shared space. Every member can see and edit all of that household's financial data, including entries created by other members, and can see other members' names and profile photos. Joining requires the household owner's approval, and the owner can remove a member at any time.

Choose household members accordingly. If you leave or are removed, the household's data stays with the household, including entries you created.

8. Legal bases (EEA and UK users)

  • Performance of a contract, to provide the Services you asked for.
  • Legitimate interests, to secure the Services and prevent abuse, where not overridden by your rights.
  • Consent, where required, which you may withdraw at any time.
  • You may lodge a complaint with your local supervisory authority.

9. Service providers

We use a small number of providers, each acting on our behalf and permitted to use your information only to operate the Services:

  • Supabase. Authentication, database, and file storage. This is where your account and all budget data live. Supabase is a United States provider.
  • Anthropic. The language model behind Ava, which receives only the text described in Section 5.
  • DigitalOcean. Hosting for the website and app.

We may also disclose information if required by law or legal process, to enforce our Terms, or to protect the rights, property, or safety of our users or others.

10. Profile photos

Profile photos are stored in a public storage bucket, which means the image URL is reachable by anyone who has it. The address contains a random identifier and is not listed or linked publicly, but you should treat a profile photo as public rather than private.

11. Cookies and local storage

We use local storage for your authentication session and for small display preferences such as your accent color and whether a panel is expanded. These are strictly necessary or purely cosmetic. We use no advertising or cross site tracking cookies. If that ever changes, we will update this policy and ask for consent where required.

12. Data retention

  • Account, profile, and budget data are kept while your account is active.
  • Entries you delete are removed from the live database immediately.
  • Backups may retain deleted content for up to 30 days before being overwritten in the normal course of operations.
  • Server and security logs are kept by our providers for a limited period, generally no more than 12 months.
  • Text sent to Ava is retained by Anthropic only briefly for abuse monitoring under their policies, and is not used for training.

13. Your rights and choices

  • Access and export. Request a copy of your household data by email.
  • Correction. Edit your profile and any entry directly in the app.
  • Deletion. Delete individual entries in the app, or email us to delete your account entirely.
  • Restriction and objection. Depending on where you live, you may have rights to restrict or object to certain processing.

To exercise any of these, email [email protected]. We may need to verify your identity first. Requests may take up to 30 days.

14. California residents

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what is collected and how it is used, to access specific pieces of personal information, to request correction or deletion, to limit the use of sensitive personal information, and to be free from discrimination for exercising these rights.

Financial information is treated as sensitive personal information. We use it only to provide the Services to you, which is the purpose you provided it for. We do not sell or share personal information as those terms are defined under the CCPA and CPRA.

15. Children

The Services are intended for adults aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has created an account, contact us and we will remove it.

16. International transfers

The Services are operated from the United States, and our providers store data on United States servers. If you use the Services from elsewhere, your information will be transferred to and processed in the United States, where data protection law may differ from your own. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses in our agreements with providers.

17. Security

We use reasonable technical and organizational measures to protect your information, including encrypted connections, password hashing handled by our authentication provider, and database access rules that scope every query to your own household so one household can never read another's data. No system is perfectly secure, and we cannot guarantee absolute security.

You can help by using a password unique to this service and by keeping your household membership limited to people you trust.

18. Automated decision making

We do not use your personal information to make automated decisions that produce legal or similarly significant effects. Ava proposes entries for your review and does not decide anything on your behalf.

19. Changes to this policy

We may update this policy. When we do, we will change the effective date above, and for material changes we will provide additional notice in the app. Continuing to use the Services after an update means you accept it.

20. Contact