Privacy Policy

Nautilus Money ("we," "our," or "us") operates a personal financial management platform available at nautiliusmoney.com and through our mobile applications (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your information when you use the Service.

By creating an account or using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Service.

This Privacy Policy is incorporated into our Terms of Use. Capitalized terms not defined here have the meanings given in the Terms of Use.

Account Information: When you register, we collect your email address, password (stored as a cryptographic hash — never in plain text), and profile information such as your name, age, and currency preference.

Financial Account Data via Plaid: To connect your financial institutions, we use Plaid Technologies, Inc. ("Plaid"), a third-party data aggregation service. When you connect an account, Plaid retrieves and transmits to us: account balances, transaction history (merchant name, date, amount, category), and account type and subtype (e.g., checking, savings, credit card). We do not receive, store, or have access to your bank username, password, PIN, or full account and routing numbers. You connect your accounts directly through Plaid's secure interface; your credentials go to your bank, not to us.

Financial Goals and Manual Entries: Information you voluntarily enter into the Service, such as savings goals, budget targets, income information, and notes.

Usage Data: We collect information about how you interact with the Service, including pages visited, features used, session duration, and general device and browser information (browser type, operating system, referring URL). This data is used in aggregate to improve the Service and is not linked to your financial data.

Communications: If you contact us by email or through the app, we retain the content of your message and your contact information in order to respond.

We use the information we collect solely to provide, maintain, and improve the Service. Specifically:

(a) To operate the Service: aggregating your financial accounts, calculating your Nautilus Score, generating spending insights, tracking goals, and producing forecasts.

(b) To personalize your experience: displaying data relevant to your accounts and preferences.

(c) To communicate with you: sending account-related notifications, security alerts, and — where you have opted in — product updates and financial digests.

(d) To improve the Service: analyzing aggregated, de-identified usage patterns to identify bugs, improve features, and develop new functionality.

(e) To comply with legal obligations: responding to lawful requests from government authorities or as required by applicable law.

We do not use your personal financial data to train machine learning models for sale to third parties, serve targeted advertising, or profile you for any purpose beyond delivering the Service to you.

Nautilus Money uses Plaid to connect to your financial institutions. By connecting an account, you also agree to Plaid's Privacy Policy (available at plaid.com/legal) and End User Privacy Policy. Plaid's collection and use of your information is governed by Plaid's own policies.

The data we receive from Plaid is used exclusively to provide the personal financial management features of the Service — specifically to display balances, categorize transactions, calculate net worth, generate budgets, and produce financial insights for you.

We do not sell, rent, license, or otherwise share Plaid-sourced financial data with any third party for any purpose other than operating the Service as described in this Privacy Policy.

You may disconnect a financial institution at any time from within the Service. Upon disconnection, we revoke the Plaid access token for that institution and queue deletion of associated transaction data from our database.

We do not sell your personal information. We do not share your financial data with advertisers, data brokers, or marketing platforms.

We share information only in the following limited circumstances:

Service Providers: We use a small number of trusted service providers who process data on our behalf under written agreements that restrict them to using data only to provide services to us. These include: Supabase, Inc. (database and authentication infrastructure) and Stripe, Inc. (subscription billing). These providers are contractually prohibited from using your data for their own purposes.

Plaid Technologies, Inc.: As described in Section 4, Plaid operates as our data aggregation partner. Data flows between Plaid and Nautilus Money are governed by our agreement with Plaid.

Legal Requirements: We may disclose information if required to do so by law, subpoena, court order, or other governmental request, or when we believe disclosure is necessary to protect our rights, protect your safety or the safety of others, or investigate fraud.

Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred as part of that transaction. We will notify you via email or prominent in-app notice before your information becomes subject to a different privacy policy.

With Your Consent: We may share information for other purposes with your explicit consent.

We retain your account information and financial data for as long as your account is active, or as long as necessary to provide the Service.

Transaction history retrieved from Plaid is retained indefinitely while your account is active so that historical analysis and net worth tracking remain accurate. You may request deletion at any time.

If you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain certain records for legal or regulatory purposes (for example, billing records may be retained for up to 7 years for tax compliance).

De-identified and aggregated data that cannot reasonably be used to identify you may be retained indefinitely for product improvement purposes.

We take the security of your information seriously. Our security measures include:

Encryption: All data is encrypted in transit using TLS 1.3. All data is encrypted at rest using AES-256 encryption provided by our database infrastructure (Supabase).

Access Controls: Row-Level Security (RLS) policies are enforced at the database layer, ensuring that no user can access another user's data — even in the event of an application-layer bug.

Credential Isolation: Your bank credentials are never transmitted to or stored by Nautilus Money. Plaid's OAuth flow sends credentials directly to your financial institution.

No Account Numbers: We deliberately do not request account or routing number data from Plaid. This information is never present in our systems.

Despite these measures, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at privacy@nautiliusmoney.com.

Access and Correction: You may access and update your profile information at any time from the Settings page within the Service.

Data Export: You may request a copy of your personal data by contacting us at privacy@nautiliusmoney.com. We will provide your data in a machine-readable format within 30 days.

Account Deletion: You may delete your account and all associated data at any time from Settings → Data & Privacy → Delete Account. Deletion is permanent and cannot be undone.

Disconnect Financial Accounts: You may disconnect any linked financial institution at any time from within the Service. This revokes our access to new data from that institution.

Email Communications: You may opt out of non-essential email communications (such as weekly digests) at any time from Settings → Notifications or by clicking "unsubscribe" in any email. You cannot opt out of transactional emails related to your account security (e.g., password reset, sign-in alerts).

California Residents: If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete your personal information, and the right to opt out of the sale of your personal information. We do not sell personal information. To exercise your rights, contact us at privacy@nautiliusmoney.com.

Nautilus Money uses session cookies solely for authentication purposes — to keep you logged in during a session. We do not use third-party advertising cookies, tracking pixels, or behavioral analytics platforms.

We use a minimal set of first-party analytics to understand aggregate usage patterns (e.g., which features are used most). This data is not linked to your identity or financial information.

You may disable cookies in your browser settings, but doing so will prevent you from logging in to the Service.

The Service is not directed to children under the age of 18. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@nautiliusmoney.com and we will delete the information promptly.

Nautilus Money is operated in the United States and is intended for users located in the United States. If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where our servers and service providers are located.

By using the Service, you consent to the transfer of your information to the United States and acknowledge that the privacy laws of the United States may differ from those in your country of residence.

The Service may contain links to third-party websites or services (such as Plaid's interface or Stripe's billing portal) that are not operated by us. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email to the address associated with your account and by posting a notice within the Service at least 14 days before the change takes effect.

Your continued use of the Service after the effective date of the updated Privacy Policy constitutes your acceptance of the changes. If you do not agree to the updated policy, you must stop using the Service and may delete your account.

The date of the most recent revision is shown at the top of this page.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: privacy@nautiliusmoney.com

Mail: Nautilus Money, Inc., Privacy Department, [Address], United States

We will respond to all privacy-related inquiries within 30 days.