Privacy Policy

1. Information we collect

Account information

When you create an account, we collect your name, email address, authentication information, and—if supplied by your sign-in provider—your profile image. Passwords are handled by our authentication provider and are not visible to CommenCents.

Budget and activity information

We store the information you choose to enter, including income amounts, budget categories, planned amounts, merchants, transaction amounts, transaction dates, notes, workspace settings, and related audit records.

Bookkeeper information

When you use the Bookkeeper, we process your question, recent conversation context, and the budget information needed to answer it. We also record the question, response, tools used, and any proposed transaction in your private workspace.

Technical information

We and our service providers may process device, browser, IP address, session, security, diagnostic, and request information needed to deliver and protect the service. CommenCents also stores your selected visual theme in your browser.

2. How we use information

• Provide accounts, authentication, private workspaces, budgeting tools, and support.
• Generate Bookkeeper answers, calculations, searches, and transaction drafts you request.
• Maintain audit records, prevent abuse, diagnose errors, and secure the service.
• Communicate about your account, service changes, security, and support requests.
• Comply with law and enforce our Terms of Service.

We do not sell personal information or use it for third-party targeted advertising.

3. Google sign-in data

Data we access

If you affirmatively choose Continue with Google, Google presents its authorization screen and, after you consent, provides CommenCents with the basic OpenID profile data needed for sign-in: your Google account identifier, email address, name, and profile image when available. CommenCents requests only the openid, email, and profile scopes. It does not request or access Gmail, Drive, Calendar, Contacts, Google Pay, passwords, or financial-account data.

How we use and store it

We use this Google user data only to authenticate you, create and maintain your CommenCents profile, display your identity inside your private workspace, protect your account, and provide account support. The identifier and related profile data are stored through Supabase authentication and profile services for as long as your CommenCents account remains active, unless a longer period is required for security or law.

How we share it

We disclose Google user data only to service providers acting on our behalf when necessary to provide authentication, hosting, security, or account support, or when required by law. We do not sell Google user data, use it for advertising, transfer it to data brokers or information resellers, use it to determine creditworthiness or for lending, or use it to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models.

CommenCents does not use Google Workspace APIs. Google profile data obtained through OAuth is not included in the budget context sent to the Gemini Bookkeeper. Information you independently type into a Bookkeeper message is processed as content you chose to submit, as explained below.

CommenCents' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Your control

You may review or revoke CommenCents' Google access from your Google Account connections. Revoking access stops future Google authentication but does not automatically delete your CommenCents account or budget records. To delete those records, submit a verified deletion request using the contact information below.

4. AI processing through Gemini

The Bookkeeper uses Google's Gemini API. When you deliberately submit a Bookkeeper question, the question, conversation context, budget month, currency, totals, category balances, and relevant transaction results may be sent to Google to generate the requested response. Your OAuth identifier, email address, Google profile name, and Google profile image are excluded from this model context. Do not type information into Bookkeeper that you do not want processed by an AI provider.

Google's treatment of prompts and responses can differ depending on whether the connected Gemini API project uses paid or unpaid services. Review the current Gemini API Additional Terms for those distinctions. CommenCents does not use Bookkeeper conversations to train its own AI model.

5. When we share information

We disclose information only as needed to operate the service, at your direction, or when legally required. Current service providers include:

• Supabase for authentication, database hosting, and account sessions.
• Google for optional Google sign-in and Gemini Bookkeeper processing.
• Vercel for application hosting, delivery, and operational logs.

These providers may process information in the United States and other locations under their applicable contracts and privacy commitments. They may use information only for the services described here or as otherwise permitted by law. We may also disclose information to protect users, investigate misuse, comply with valid legal process, or complete a business reorganization with appropriate safeguards and notice where required.

6. Cookies and local storage

CommenCents uses essential authentication cookies to keep you signed in and secure your session. It uses browser local storage to remember your theme preference and may use similar essential technologies for reliable operation. We do not currently use third-party advertising cookies.

7. Retention and security

We retain account and budget information while your account is active. After a verified deletion request, we delete or de-identify information that is no longer reasonably needed, subject to limited retention for fraud prevention, security records, dispute resolution, backups, and legal obligations. Bookkeeper audit records are retained with the associated workspace while the account is active. Provider retention and backup cycles may continue for a limited period after deletion.

We use reasonable administrative and technical safeguards, including encrypted connections, managed authentication, tenant-based access controls, and database row-level security. No system can guarantee absolute security, so protect your credentials and notify us if you suspect unauthorized access.

8. Your choices and privacy rights

You may update information through the service where editing is available. You may also ask to access, correct, obtain a portable copy of, or delete personal information associated with your account. A request to delete your account includes the associated personal workspace and Google profile data held by CommenCents, subject to the limited exceptions described above. We may need to verify your identity before completing a request.

Depending on where you live, you may have additional rights such as restricting or objecting to processing, withdrawing consent, or appealing a denied request. We will not discriminate against you for exercising an applicable privacy right.

9. Children and international processing

CommenCents is not directed to children under 13, and we do not knowingly collect their personal information. The service and its providers may process information in the United States and other countries where their infrastructure operates.

10. State and regional disclosures

Depending on where you live, privacy law may provide rights to know, access, correct, delete, or obtain a copy of personal information and to appeal certain decisions. CommenCents does not sell personal information or share it for cross-context behavioral advertising. We do not knowingly use or disclose sensitive personal information for purposes other than providing and securing the service.

11. Changes and contact

We may update this policy as the service evolves. We will post the revised policy here, change the effective date, and provide additional notice when required.