Privacy Policy
Last Updated: October 25, 2026
ClarityTrack, Inc. ("we," "our," or "us") operates ClarityTrack, a personal finance dashboard that helps individuals track and accelerate progress toward debt freedom. This Privacy Policy explains how we collect, use, store, and protect your information when you use ClarityTrack at claritytrack.ai.
Table of Contents
1. Information We Collect
We collect the following categories of information when you use ClarityTrack:
Account Information
- Email address
- Authentication session tokens managed by Supabase Auth
Financial Planning Data
- Debt records (name, balance, interest rate, minimum payment)
- Payment transactions and logs you enter manually
- Payoff targets and repayment strategy settings
Bank Connection Data (Plaid Integration)
When you connect a bank account through Plaid, we collect and store the following data returned by the Plaid API:
- Plaid Item identifiers and encrypted access tokens
- Bank account information (institution name, account name, last four digits, account type, and current balance)
- Transaction data (date, amount, merchant name, category, and pending status) for up to the most recent 180 days (approximately six months) of history
- Recurring transaction patterns used for subscription and bill detection
- Liability details (such as APR, minimum payment, and due dates) for connected loan and credit accounts, where your bank makes them available through Plaid
- Investment holdings (securities, quantities, and values) for connected investment accounts, where available through Plaid
Your bank login credentials are never seen or stored by ClarityTrack. Plaid handles credential collection directly and returns only an access token.
AI Assistant Data
- Messages you send to and receive from the ClarityTrack AI assistant (Clarity)
- Conversation history stored per session to support continuity
- When you start a new conversation, the previous one is kept for 30 days and then permanently deleted.
Usage Data
- Browser type, device type, and operating system
- Product-analytics events (pages viewed and features used), collected through PostHog and associated with your account after you log in. Not sold, and not used for advertising.
2. How We Use Your Information
We use the information we collect to:
- Provide and maintain the debt payoff dashboard and all core features
- Sync and display your bank transactions from connected accounts
- Detect recurring subscriptions and bill payments from your transaction history
- Power the AI assistant (Clarity) to answer your spending and debt questions
- Send emails about your account: a welcome email, payment receipts, trial reminders, re-authentication alerts, and, if you cancel, a short series asking whether you’d like to come back
- Send the weekly email (your summary and behind-pace alerts) when you have turned it on
- Send ClarityTrack Monthly, our product newsletter, only if you ask for it. It never contains your financial figures, and every issue has a one-tap unsubscribe. When you sign up we keep your email address, when and where you agreed, and the exact words you agreed to, so we can show your consent. Unsubscribing stops the emails; deleting your ClarityTrack account deletes this record. If you aren’t a member and want the record deleted, email us
- Improve the application based on product-analytics usage patterns (collected through PostHog and associated with your account)
3. Data Storage and Security
Your financial data is protected with bank-level security, built in from day one. Here is exactly what that means.
- It runs on trusted infrastructure. ClarityTrack is hosted entirely on Amazon Web Services (AWS), whose infrastructure holds the major independent security certifications, including SOC 2, PCI-DSS, and ISO 27001. Our application servers run in private network segments with no direct public exposure, behind a web application firewall.
- Your data is encrypted, always. Data is encrypted at rest with a customer-managed key (AWS KMS) and in transit with TLS. Your bank and email access tokens are encrypted with AES-256-GCM, and the encryption keys are never stored in our source code.
- Your data is segregated and yours alone. Row-Level Security is enforced at the database on every account, so you can only ever reach your own data. ClarityTrack does not browse, expose, or sell any individual user's financial information.
- We can show your money, but never move it. Bank connectivity is read-only, through Plaid. ClarityTrack can show you your position but cannot move, send, or spend a cent.
- Your data is never used to train AI, and never sold. We do not sell your data, and we do not use your financial information to train AI models. That protection is the default, with no setting to turn off.
- Access is least-privilege, audited, and monitored. Cloud access uses short-lived, least-privilege credentials with no long-lived keys, and administrative access requires multi-factor authentication. All activity is recorded to a tamper-evident, multi-region audit trail (AWS CloudTrail), and the environment is continuously monitored for threats (AWS GuardDuty).
- Sign-in. ClarityTrack signs you in with an email one-time code or a password you set. When you connect Gmail, you sign in through Google, and we never see your password.
ClarityTrack does not hold a SOC 2 attestation today and does not claim one. It runs on a SOC 2-ready foundation with a documented readiness roadmap. For the full control register and that roadmap, see our Trust Center.
4. Third-Party Services
ClarityTrack integrates with the following third-party services:
Plaid
ClarityTrack uses Plaid to connect your bank accounts and retrieve transaction data. When you connect a bank account, Plaid handles credential collection in its own secure interface and returns an encrypted access token to ClarityTrack. Your bank credentials are never transmitted to or stored by ClarityTrack. Plaid access tokens stored by ClarityTrack are encrypted at rest using AES-256-GCM. Plaid processes data according to its own privacy policy at plaid.com/legal.
Anthropic (AI Assistant)
The ClarityTrack AI assistant (Clarity) is powered by Anthropic's Claude API. When you use Clarity, your messages and relevant financial context (such as recent transactions) are sent to Anthropic's servers for processing. Anthropic processes this data according to its own privacy policy.
Important: We recommend that you do not share sensitive identifiers such as Social Security numbers or full account numbers in the Clarity chat.
Connected AI Assistants (Optional, Your Choice)
You can choose to connect third-party AI assistants, such as OpenAI's ChatGPT or Anthropic's Claude, to your ClarityTrack account through our secure connector (the ClarityTrack MCP server). This connection is entirely optional and only happens when you explicitly authorize it through an OAuth consent screen.
When you connect an AI assistant, it can read the following categories of your data on your behalf: account names, types, and balances (including the last four digits of account numbers), transactions (dates, amounts, merchant names, categories), budgets, goals, spending summaries, Clarity insights, and your subscription status. Access is read-only by default: a connected assistant can never move money. Write actions are off unless you turn them on for that connection, and when enabled they are limited to a fixed list: logging or annotating a transaction, creating or updating a budget, updating a goal, and setting your debt payoff strategy. They cannot delete anything, cannot change your bank connections, and cannot change your account or email settings. Enabled writes are previewed before they commit, and are verified server-side with a signed token bound to you and to that exact change, which expires in ten minutes.
Data read by a connected assistant is transmitted to that provider (for example, OpenAI or Anthropic) and is then governed by that provider's own privacy policy and terms, including any settings you hold with them about data retention or model training. We do not control how a third-party assistant handles data after you direct us to share it.
You can revoke a connected assistant's access at any time from ClarityTrack settings or from the assistant's own connection settings. Revocation takes effect on the assistant's next request.
Supabase
User accounts, financial data, and application state are stored in Supabase Postgres. Supabase provides authentication services (OTP email codes) and enforces Row Level Security for per-user data isolation.
Amazon Web Services (AWS)
The ClarityTrack application runs on Amazon Web Services, which provides compute, storage, networking, security monitoring, and KMS encryption. All application data is encrypted at rest and in transit. AWS maintains a SOC 2 Type II attestation and processes data in accordance with its own privacy policy.
Cloudflare
ClarityTrack uses Cloudflare for DNS, CDN, TLS termination, and webhook proxy Workers. Cloudflare processes network traffic in accordance with its own privacy policy.
Resend
ClarityTrack uses Resend to deliver its emails: the account emails listed above, the weekly email, and ClarityTrack Monthly. Your email address is passed to Resend only at the time an email is sent to you; the newsletter’s subscriber list is kept in ClarityTrack’s own database, not at Resend. Resend tells us when an email bounces or is marked as spam, and we then stop sending ClarityTrack Monthly to that address. Resend processes data according to its own privacy policy.
PostHog (Product Analytics)
ClarityTrack uses PostHog to measure how the product is used (pages viewed and features used) so we can improve it. After you log in, analytics events are associated with your account, including your email address. PostHog does not receive your bank transactions, balances, or other financial data. PostHog is a first-party product-analytics provider and does not use your data for advertising or cross-site tracking. PostHog processes data according to its own privacy policy.
6. Data Retention
- Account data. Retained for the lifetime of your account.
- Transaction and financial data. Retained for the lifetime of your account to support historical tracking and AI assistant context.
- Bank connection data. Retained until you disconnect the bank account. Disconnecting calls Plaid's /item/remove endpoint to revoke the access token at Plaid's side, then permanently deletes all associated transaction records, account records, and the access token from ClarityTrack's database.
- AI assistant conversations. Retained for the lifetime of your account to support conversation continuity.
- After account deletion. All associated data is permanently removed from active databases upon request. Backup copies may persist for up to 90 days before being purged.
7. Your Rights
You have the following rights regarding your personal data:
- Access. You can view all of your financial data within the application at any time.
- Correction. You can update your personal information and financial records at any time through the application.
- Deletion of bank data. You can disconnect any linked bank account at any time via the Banks page. Disconnecting permanently deletes all associated transaction data from ClarityTrack and revokes the access token at Plaid's side.
- Account deletion. You can permanently delete your account yourself at any time from Settings: type DELETE to confirm, and ClarityTrack immediately purges all of your data from its databases and cancels any active billing. If you prefer, you can contact [email protected] to request deletion instead.
- Data portability. You can export your data yourself at any time by asking Clarity: a CSV of your debts, goals, and journal; a full JSON export of all your data (a GDPR-style complete record); or a PDF of your journal. Each export is delivered as a download link that expires after one hour. Your saved Clarity memories can also be exported from Settings. If you would rather we prepare an export for you, contact [email protected].
9. California Privacy Rights (CCPA)
If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA):
- Right to know. You may request disclosure of what personal information we collect, use, and share about you.
- Right to delete. You may request deletion of your personal information, subject to certain exceptions.
- Right to opt out of sale. We do not sell your personal information. There is no need to opt out.
- Right to non-discrimination. We will not discriminate against you for exercising your CCPA rights.
To exercise your CCPA rights, contact us at [email protected].
10. Children's Privacy
ClarityTrack is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will promptly delete it. If you believe a child has provided us with personal information, please contact us at [email protected].
11. Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices or applicable laws. We will notify you of material changes by posting the updated policy within the application and updating the "Last Updated" date at the top of this page. Your continued use of ClarityTrack after any changes constitutes your acceptance of the updated policy.
12. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
- Company: ClarityTrack, Inc.
- Email: [email protected]
- Website: claritytrack.ai