Your data is yours

Who is responsible for your data

MoMoFi is operated by MoMoFi, LLC, a Texas limited liability company, which is responsible for the personal information described in this policy. In this policy, "we", "us", "our" and "MoMoFi" mean MoMoFi, LLC.

What we collect

Account data

• Email address (sign-in identifier, password reset, recovery alerts)
• Your password, stored only as a scrambled, one-way value, never the password itself
• Display name (the label that shows up in the sidebar and on receipts; no public visibility)
• Optional recovery email and/or phone for security alerts
• Your two-factor authentication setup, stored encrypted
• Passkey credentials, if you set up biometric sign-in: the secret stays on your device; we only keep the part needed to verify you

Financial data you enter

Transactions, accounts, budgets, goals, categories, debt profiles, receipts, etc. (anything you type or attach). This is your data. We store it; we never share or sell it; we never use it to train external models or target advertising.

Bank-link data (paid plans only, if you opt in)

When you connect a bank account through Plaid, Plaid hands us a secure access token, which we store encrypted. Your bank login credentials never touch our servers. They go directly into Plaid's secure connection flow. Plaid's privacy policy and your bank's policies also apply to that data. Bank linking is off until you enable it on a paid plan.

Device & usage data

• Device / browser: basic browser and device info, used to label a passkey ("Chrome on Mac") and to fill in context when you send in-app feedback (the page you were on, your browser, and your screen size).
• Usage: which features you use and when, so the product can run (e.g. keeping streaks and journey progress, surfacing the right prompts, and diagnosing issues). We do not build advertising or behavioural profiles from this.

Operational data

• IP address and approximate (city-level) location, recorded on security events (sign-ins, password changes, two-factor/passkey changes). Used only to show "where was that login from?" in your account-activity log.
• Basic request logs (which pages were requested and whether they succeeded): short-lived, for debugging and preventing abuse.

How we use your data

We use your data for one purpose: to provide and operate MoMoFi. Concretely, that means we use it to:

• run the core features (record and show your finances, budgets, goals, calendar, insights, and so on);
• authenticate you and keep your account secure (sign-in, two-factor, passkeys, the security log);
• process your subscription, through Stripe;
• send transactional email (verification links, security alerts, password resets, account-change notices);
• debug problems, prevent abuse, and meet legal obligations.

That's the whole list. We do not use your data for advertising, profiling, or resale, and we do not train any AI / ML model on it.

What we don't do

• We don't sell your data. Not to anyone.
• We don't share your financial data with third parties (except the processors below that strictly need it to make the product work).
• We don't embed third-party analytics, tracking pixels, or session-replay tools on the authenticated app.
• We don't load fonts or scripts from anywhere we haven't explicitly allowed.
• We don't use your transactions to train or fine-tune any AI / ML model.

Sharing you control

Some features let you share specific things with people you choose. This is different from the promise above (which is about outside companies); it's sharing you turn on, and can turn off, yourself.

• Inside your household: other members see only what you mark as shared. You can keep any account, goal, or budget private, and the household aggregate leaves your private items out.
• Family pledges (any household with a student account): if you invite a relative to support a student's savings goal, they see that goal's name, the student's first name, and the pledges made to it, and nothing else from your household. Likewise, a goal you pledge to in another household shows you only that goal and your own pledge.

Third-party processors

These are the only third parties that touch your data so the product can do its job. The list is deliberately short, and we keep it current. Material changes are announced per "Changes to this policy" below.

• Stripe: subscription billing. Stripe receives your billing email, your subscription's line items, and your payment-method data. They never see your in-app financial records.
• Plaid (optional): bank linking, only if you choose to connect a bank on a paid plan. Plaid sees the bank credentials you enter into their flow and the transaction/account data they return to us. Not engaged at all unless and until you turn on bank linking.
• Sentry: tells us when something in the app breaks. Error reports describe the failure and where in our code it happened. We remove email addresses, names, IP addresses and anything that looks like a password or access key before a report leaves our servers.
• Hosting provider: runs the servers that MoMoFi and your data live on.
• Backup storage: keeps copies of our data and your receipt images so we can recover from a failure. The copies are encrypted before they leave our servers, so the storage provider can't read them.
• MaxMind GeoLite2: city-level geolocation for security-event log entries. Downloaded weekly as a database; there are no per-user calls to MaxMind.
• Postmark: sends our email (verification links, password resets, alerts, the monthly review). Postmark receives your email address and the message itself. If a message bounces or is marked as spam, Postmark tells us so we can stop sending to that address.

Cookies and storage

We use a small number of strictly necessary cookies (no advertising or tracking cookies, and no third-party cookies):

• A sign-in cookie that keeps you logged in. Without it you can't stay signed in.
• A security cookie that stops other websites from submitting your forms on your behalf.
• A short-lived cookie that carries one-time on-screen messages (like "Saved") across a page change.

Email communications

Transactional email (verification, password reset, security alerts, account-change notifications) is part of running your account. Optional notification email (a low-balance or upcoming-payment alert, or your monthly family review) only ever goes to a verified address and is controlled in your notification settings, where you can turn it on or off any time. Every optional email also has an unsubscribe link that stops that kind of email straight away, without signing in. If email to you bounces or is marked as spam, we stop optional email to that address, and if it bounced we show you a notice in the app so you can check it. Apart from one reminder about a month after a free trial ends, we don't send marketing email to your account address unless you ask for it. That reminder has an unsubscribe link too.

Data retention

We keep data only as long as we need it to run the service or to meet a legal obligation. The specifics:

• While your account is open: we keep everything you record, for as long as you keep the account. Nothing is ever deleted just because it is old. Older records may be stored separately from your recent activity so the everyday screens stay quick, and they remain yours and remain available to you. On the Free plan some charts only draw the last few months, and the earlier months are still saved and appear if you upgrade.
• After you delete your account: deletion starts a 30-day grace period. You can sign back in and cancel during it. After day 30, your financial records and personal data are permanently deleted.
• Backups: deleted data ages out of rotating encrypted backups within about 35 days.
• Security-event history (sign-ins, password/MFA/passkey changes): kept for as long as your account is open, and deleted with it.
• Internal security-log entries (kept for security and legal reasons, and containing no personal information): kept for as long as your account is open.
• Application request logs: short-lived (days), for debugging and abuse mitigation.
• Billing records held by Stripe: retained by Stripe under their own policy and as required by tax and accounting law.

Your rights and controls

• Access: the full ledger of your data is visible inside the app. For an offline copy, use the export below.
• Export / portability: /settings/data → "Export your data" produces a ZIP of your core financial records (accounts, transactions, budgets, goals, income, and more) as CSVs plus a manifest with row counts, readable in any spreadsheet or other tool.
• Correction: edit anything in-app at any time.
• Deletion: /settings/data → "Delete my account" starts the 30-day grace period described under Retention. After day 30 your records are permanently deleted; only internal security-log entries that contain no personal information remain.

You can exercise all of these yourself in the app, or email privacy@momofi.app and we'll help. The section below describes additional rights for California residents.

California privacy rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you specific rights over your personal information.

Categories we collect map to the statute as: identifiers (your email); financial information (the records you enter and, if you opt in, bank-linked data); internet/network activity (IP, request logs, feature usage); geolocation (approximate, city-level); and commercial information (your subscription). We collect these for the business purposes described under "How we use your data."

We do not sell or share your personal information as those terms are defined under the CCPA/CPRA, and we have not done so in the preceding 12 months. We also do not use or disclose sensitive personal information beyond what's needed to provide the service.

Your rights:

• Know / access the personal information we hold and how we use it.
• Delete your personal information.
• Correct inaccurate personal information.
• Opt out of sale or sharing: not applicable, because we do neither, but the right stands.
• Limit the use of sensitive personal information.
• Non-discrimination for exercising any of these rights.

To exercise a right, use the in-app export/delete tools or email privacy@momofi.app. We verify requests through your signed-in account. An authorized agent may submit a request on your behalf with your written permission and verification of their authority.

Children

MoMoFi is for people 13 and over. That applies to every account, including a student account inside a Household. We don't knowingly collect personal information from anyone under 13, and we don't offer an under-13 account of any kind.

Every plan supports student accounts for teenagers (one on Free and Individual, up to five on Family). A parent or guardian creates one by invitation and confirms at that point that the student is 13 or older. A student account holds the same kind of information as any other account (name, email address, and the money records they enter or that are shared with them), and the parent or guardian who runs the household can see and manage it.

If you believe someone under 13 has an account with us, email privacy@momofi.app. We'll close the account and delete the data.

Changes to this policy

We review this policy at least once a year, and whenever we change what we collect or how long we keep it. If we materially change what data we collect or how we use it, we'll notify users by email and update the "Last updated" date at the top of this page.

Contact

MoMoFi, LLC, Texas. Privacy questions, or to exercise any right above: email privacy@momofi.app. You can also use the in-app tools at /settings/data, or reach us via the contact page for anything else.