Anthropic PBC (Claude)
AI parsing of your statement and AI coaching analysis of your transactions.
Data shared: Statement text (with account/routing/card numbers, SSNs, emails, phones, and addresses redacted BEFORE sending on the text path); for photos and scanned/image-only PDFs, the document image itself (not pre-redacted) so Claude can read it — you are asked to confirm first.
Helicone Inc.
AI-request observability, used only when AI-request logging is enabled.
Data shared: Metadata only (timing, token counts, model). Request and response bodies — your statement text and transaction content — are omitted and are not logged.
Sentry
Error monitoring and crash diagnostics.
Data shared: Technical error data. Session replay is disabled; personal-data fields are not sent by default. Fragments of application data may incidentally appear in an error report.
Vercel Inc.
Application hosting, serverless functions, cookieless performance and usage analytics.
Data shared: Request/response traffic; aggregate page-load timing (Speed Insights); and aggregate page views, referrers, approximate country, and device/browser type (Web Analytics). No cookies, no cross-site tracking; page URLs are recorded with campaign parameters only (utm_source, utm_medium, utm_campaign, utm_content, utm_term, each truncated and limited to safe characters); every other query-string value — including referral codes and checkout session identifiers — is removed before recording.
Turso
Database storage (AWS US-West-2 infrastructure).
Data shared: Extracted transaction rows (identifying details already scrubbed). Name, email, and phone are encrypted at the application level before storage.
Resend
Transactional and product email delivery.
Data shared: Your email address and message content (access code, welcome, snapshots, nudges).
Cloudflare
Bot protection via Turnstile.
Data shared: Challenge token only. No financial data shared.