Privacy Policy

1. Categories of Personal Data We Collect

We collect information to provide you with a seamless budgeting experience. Here's what we collect, broken down by category:

Account & Profile Information

• Identifiers: Name, email address, account ID, password (hashed and encrypted)
• Profile Data: Profile picture (optional), household settings, partner information

Financial Data

• Transaction Information: Purchase amounts, merchant names, transaction dates, categories
• Account Balances: Checking, savings, credit card balances (read-only via Plaid)
• Manual Entries: Cash transactions, custom categories, notes, budget limits you create
• Payment Information: Billing details for your Halfway subscription (processed and stored by Stripe, not by us)

Device & Usage Information

• Device Data: Device type, operating system, browser type, unique device identifiers
• Usage Data: Pages viewed, features used, time spent in app, navigation patterns
• Technical Data: IP address, browser language, time zone

Location Information

• Approximate Location: Derived from IP address for fraud prevention and service improvement
• We do not collect precise geolocation unless you explicitly enable location services for specific features

Communications

• When you contact support, we collect your messages and correspondence
• Records of your consent to marketing communications

2. Categories of Sources

We collect information from these sources:

Directly From You

• When you create an account
• When you manually enter transactions or create budgets
• When you contact customer support
• When you opt-in to marketing communications

From Plaid

• When you connect your bank accounts, Plaid retrieves transaction data and balances on our behalf
• Plaid operates in the United States, Canada, United Kingdom, and European Union

From Your Devices

• Automatically collected when you access Halfway through web or mobile app
• Includes device information, IP address, and usage analytics

From Analytics Services

• Google Analytics helps us understand how users interact with our app
• We use analytics to improve features and user experience

3. Business Purposes for Collection and Use

We collect and use your personal information for the following business purposes (as defined under California and other state privacy laws):

• To Provide Our Service: Categorize transactions, track spending, calculate splits, sync data across devices
• Account Management: Create and maintain your account, authenticate your identity, manage your subscription
• Customer Support: Respond to your inquiries, troubleshoot issues, provide assistance
• Service Improvement: Analyze usage patterns, test new features, improve algorithms and user experience
• Security & Fraud Prevention: Detect and prevent unauthorized access, protect against fraud, maintain system security
• Legal Compliance: Comply with applicable laws, regulations, court orders, and government requests
• Communications: Send service updates, security alerts, and (with your consent) promotional materials
• AI-Powered Features: Use machine learning to categorize transactions and provide financial insights (data is anonymized where possible). AI suggestions are automated and may contain errors—you should verify all AI-generated categorizations
• Analytics: Understand aggregate usage trends to make informed product decisions

We do not sell your personal information or share it for cross-context behavioral advertising.

4. Bank Connections & Security

Your security is paramount. We partner with Plaid, an industry leader in financial technology, to securely connect to your financial institutions.

• No Credential Storage: Halfway never sees or stores your bank login credentials (username or password). These are handled directly by Plaid.
• Read-Only Access: Our connection allows us to view transactions and balances solely for the purpose of helping you budget. We cannot initiate transfers, withdrawals, or any changes to your accounts.
• Encryption: All data is encrypted at rest using AES-256 encryption and in transit using TLS 1.2 or higher.
• Plaid's Security: Plaid is SOC 2 Type II certified and complies with industry security standards. Learn more at plaid.com/safety.

5. How We Use Your Data

We use your data exclusively to operate and improve Halfway:

• To categorize your transactions and track your spending against budgets
• To facilitate expense splitting between you and your partner
• To provide insights into your financial health
• To process subscription payments via Stripe
• To improve our algorithms for transaction categorization using machine learning
• To send you service-related notifications (e.g., budget alerts, security updates)
• To respond to support requests and improve customer service

We do not sell your personal or financial data to third parties, advertisers, or data brokers.

6. Shared Data Within Households

Halfway is designed for couples. By inviting a partner to your household:

• You explicitly consent to share certain financial information with them, such as shared transactions, joint budget progress, and household settings.
• Personal transactions remain private unless you choose to share them or mark them as split expenses.
• Each partner can view only the information you've designated as shared.
• You can remove a partner from your household at any time through the app settings.

Important: You should only invite someone to your household if you trust them with this financial information. Be cautious about who you share data with, especially in situations involving domestic conflicts.

7. Third-Party Services

We trust a select group of partners to help us deliver our service:

Plaid

• Purpose: Secure bank connections
• Data Shared: Bank login credentials (handled directly by Plaid, not visible to Halfway), transaction data, account balances
• Privacy Policy: plaid.com/legal

Stripe

• Purpose: Secure payment processing for subscriptions
• Data Shared: Email, billing information
• Note: We do not store your credit card details. Stripe handles all payment information.
• Privacy Policy: stripe.com/privacy

OpenAI

• Purpose: AI-powered transaction categorization and financial insights
• Data Shared: Transaction descriptions (anonymized where possible)
• Note: Data sent to OpenAI is not used to train their public models per our agreement
• Privacy Policy: openai.com/privacy

Google Analytics

• Purpose: Understanding how users interact with our app to improve the experience
• Data Shared: Usage data, device information (anonymized)
• Privacy Policy: policies.google.com/privacy

AmplifyFinancials.com (Optional Service)

• Independent Entity: AmplifyFinancials.com is a separate, independent company from Halfway (Success Bee LLC). They operate under their own privacy policy and terms of service.
• Purpose: Provision of financial advisory services (only if you explicitly opt-in)
• Limited Data Sharing: With your explicit opt-in, we share only basic contact information (name, email) with AmplifyFinancials.com for scheduling purposes.
• NO Automatic Financial Data Sharing: We do NOT share your detailed transaction data, account balances, spending habits, or other financial information with AmplifyFinancials.com without your separate, explicit written consent.
• Their Privacy Policy Governs: Any data you provide directly to AmplifyFinancials.com (during consultations, onboarding, or through their platform) is governed by their own privacy policy, not ours. We strongly recommend reviewing their privacy policy before engaging their services.
• Opt-Out Anytime: You can opt-out of communications with AmplifyFinancials.com at any time by contacting us or them directly.
• Independent Data Controller: AmplifyFinancials.com operates as an independent data controller for any information they collect from you.

Review Before You Engage: Before scheduling or participating in any advisory sessions, we encourage you to:

• Review AmplifyFinancials.com's privacy policy and terms of service
• Understand what data they collect and how they use it
• Ask them directly about their data practices if you have concerns

8. Third-Party Financial Advisor Services

As part of certain premium features or promotional offers, Halfway may provide access to third-party financial advisory services (such as AmplifyFinancials.com). Here's what you need to know about data sharing and privacy:

Data Sharing is Limited & Requires Consent

• Contact Information Only: With your explicit opt-in, we share basic contact information (name, email address) with the third-party advisor for scheduling purposes.
• NO Financial Data Without Separate Consent: We do NOT automatically share your transaction history, account balances, spending patterns, budgets, or any other financial data with third-party advisors.
• You Control What You Share: If an advisor requests access to your financial data during a consultation, you will need to provide separate, explicit consent. This may involve:
  • Verbally sharing information during a call
  • Providing documents or reports directly to the advisor
  • Authorizing data export through Halfway (only if you explicitly choose to do so)

Independent Privacy Policies Apply

• Separate Data Controller: Third-party financial advisors operate under their own privacy policies and terms of service. Once you share data with them (directly or through us), their privacy practices govern how that data is used, stored, and protected.
• Review Their Policies: We strongly recommend reviewing the advisor's privacy policy and terms before engaging their services or sharing any sensitive financial information.
• Direct Relationship: Any advisory relationship, data sharing, or financial transactions you enter into with third-party advisors is between you and them—not between you and Halfway.

Opt-Out Rights

• You can opt-out of promotional communications from third-party advisors at any time
• You can decline to share any financial data with advisors
• Opting out does not affect your access to Halfway's core features

Our Commitment

Halfway will never sell your data to third-party advisors or share your financial data without your explicit, informed consent. You are always in control of what information you choose to share.

9. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to improve your experience:

Essential Cookies

• Purpose: Required for authentication, security, and basic functionality
• Can You Opt Out? No - these are necessary for the service to work

Analytics Cookies

• Purpose: Understand how users navigate the app, which features are most used
• Provider: Google Analytics
• Can You Opt Out? Yes - you can disable analytics cookies or use browser extensions like Google Analytics Opt-out Browser Add-on

Session Storage

• We use local storage and session storage in your browser to cache data and improve performance
• This data is stored locally on your device and is not transmitted to our servers except when syncing

Managing Cookies

You can control cookies through your browser settings. Note that disabling essential cookies may affect functionality.

10. Data Retention

We retain your personal information for as long as necessary to provide our services and comply with legal obligations:

While Your Account is Active

• We retain all your data to provide continuous service
• Transaction data, budgets, and household information are kept for the lifetime of your account

After Account Deletion

• Personal Data: Deleted within 90 days of account closure
• Financial Data: Deleted within 90 days of account closure
• Legal & Compliance Records: Retained for up to 7 years for tax, accounting, and legal compliance purposes (e.g., subscription receipts, refund records)
• Anonymized Analytics: May be retained indefinitely for product improvement (fully anonymized with no personal identifiers)

Inactive Accounts

• If your account remains inactive for 3 years with no paid subscription, we may delete your account after providing 30 days notice

11. International Data Transfers

Halfway is based in the United States. By using our service, you understand that your data may be transferred to and processed in:

• United States: Our primary servers and operations
• Canada: Through Plaid for Canadian bank connections
• United Kingdom: Through Plaid for UK bank connections
• European Union: Through Plaid for EU bank connections

Data Transfer Safeguards

When we transfer data internationally, we rely on:

• Standard Contractual Clauses (SCCs): EU-approved contracts for data transfers
• Adequacy Decisions: Transfers to countries deemed adequate by the EU Commission
• Your Consent: By using Halfway, you consent to international data transfers necessary to provide the service

12. Data Breach Notification

We take security seriously and have measures in place to protect your data. However, no system is 100% secure.

In the Event of a Data Breach

• Assessment: We will immediately investigate the scope and impact
• Notification Timeline: If your personal information is compromised, we will notify you within 72 hours of discovering the breach (or sooner if legally required)
• How We'll Notify You: Via email to your registered email address and/or in-app notification
• What We'll Tell You: Nature of the breach, data affected, steps we're taking, and actions you should take to protect yourself
• Regulatory Reporting: We will also notify relevant data protection authorities as required by law

13. Children's Privacy

Halfway is not intended for children. We comply with the Children's Online Privacy Protection Act (COPPA) and similar laws:

• Age Requirement: You must be at least 18 years old to use Halfway
• No Intentional Collection: We do not knowingly collect personal information from anyone under 13 years of age
• If We Discover Underage Users: If we become aware that we've collected data from someone under 13, we will delete it immediately
• Parents: If you believe your child under 13 has created an account, please contact us at hello@meethalfway.app so we can delete it

14. Your Privacy Rights

You own your data. You have the right to:

• Access: Request a copy of all personal data we hold about you
• Correction: Correct any inaccuracies in your personal information
• Deletion: Request that we delete your account and associated data
• Data Portability: Export your data in a machine-readable format (JSON)
• Opt-Out of Marketing: Unsubscribe from promotional emails at any time
• Revoke Consent: Withdraw consent for data processing where consent is the legal basis

15. U.S. State Privacy Rights (CCPA, VCDPA, CPA, etc.)

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, or other states with comprehensive privacy laws, you have additional rights:

Right to Know / Access

• Request disclosure of categories and specific pieces of personal information we've collected about you
• Request information about sources, business purposes, and third parties we share data with

Right to Delete

• Request deletion of your personal information, subject to certain exceptions (e.g., legal compliance, fraud prevention)

Right to Correct

• Request correction of inaccurate personal information

Right to Data Portability

• Receive a copy of your personal information in a portable format

Right to Opt-Out of Sale or Sharing

• We do not sell your personal information.
• We do not share your personal information for cross-context behavioral advertising.
• If this changes in the future, we will provide a clear opt-out mechanism and notify you in advance

Right to Limit Use of Sensitive Personal Information

• Financial data is considered "sensitive" under some state laws
• We only use sensitive data for purposes necessary to provide the service (as disclosed in this policy)
• We do not use sensitive data for advertising or profiling

Right to Non-Discrimination

• We will not discriminate against you for exercising your privacy rights
• You will not receive different pricing or service quality for asserting your rights

Authorized Agent

You may designate an authorized agent to make requests on your behalf. We will require verification of the agent's authority.

16. GDPR Rights (UK/EU Users)

If you are located in the United Kingdom or European Union, you have rights under the General Data Protection Regulation (GDPR):

Right of Access

• Obtain confirmation of whether we process your data and access to that data

Right to Rectification

• Correct inaccurate or incomplete personal data

Right to Erasure ("Right to be Forgotten")

• Request deletion of your personal data in certain circumstances

Right to Restriction of Processing

• Limit how we use your data under certain conditions

Right to Data Portability

• Receive your data in a structured, commonly used format and transfer it to another controller

Right to Object

• Object to processing based on legitimate interests or for direct marketing purposes

Right to Withdraw Consent

• Where processing is based on consent, you can withdraw it at any time

Right to Lodge a Complaint

• You have the right to lodge a complaint with your local data protection authority (e.g., ICO in the UK, or your country's supervisory authority in the EU)

Legal Basis for Processing

We process your data under the following legal bases:

• Contract Performance: To provide the Halfway service you signed up for
• Legitimate Interests: To improve our service, prevent fraud, and ensure security
• Consent: For marketing communications and optional features
• Legal Obligation: To comply with applicable laws and regulations

17. How to Exercise Your Rights

To exercise any of the rights described above:

In-App Actions

• Access Your Data: View and export your data from Settings → Privacy → Download My Data
• Delete Your Account: Settings → Account → Delete Account (permanent action)
• Update Information: Edit your profile and preferences directly in the app

Email Requests

For other requests or assistance, email us at hello@meethalfway.app with:

• Subject line: "Privacy Rights Request"
• Your full name and email address associated with your account
• Description of your request (e.g., "Please delete my data" or "I'd like a copy of my information")

Verification Process

To protect your privacy, we will verify your identity before fulfilling your request. We may ask you to:

• Confirm your email address
• Answer security questions
• Provide additional identifying information

Response Timeline

• Initial Response: We will acknowledge your request within 5 business days
• Complete Response: We will fulfill your request within 45 days (or notify you if we need an extension up to 90 days total)

No Fee

We do not charge a fee to process your privacy requests unless the request is manifestly unfounded or excessive.

18. Do Not Track Signals

Some browsers have "Do Not Track" (DNT) features that signal websites not to track users. Currently, there is no industry-wide standard for recognizing DNT signals.

Our Approach: We respect browser settings and minimize tracking where possible. However, we do not respond to DNT signals because:

• There is no standard implementation
• Some tracking (like authentication cookies) is essential for the service to work

You can manage cookies through your browser settings or opt-out of analytics as described in the Cookies section above.

19. Updates to This Privacy Policy

We may update this Privacy Policy as we grow and add new features, or to comply with legal requirements.

How We'll Notify You

• Material Changes: We will email you at least 30 days before any material changes take effect
• Minor Changes: We will update the "Last updated" date at the top of this page
• In-App Notification: For significant changes, we may also show an in-app notification

Continued Use

By continuing to use Halfway after changes become effective, you accept the updated Privacy Policy. If you do not agree to changes, you should stop using the service and delete your account.

Version History

Previous versions of this Privacy Policy are available upon request by emailing hello@meethalfway.app.

20. Contact Us

Halfway is operated by Success Bee LLC. If you have any questions about this Privacy Policy, your data, or your rights, please reach out to us:

• Email: hello@meethalfway.app
• Subject Line: "Privacy Question" or "Privacy Rights Request"

For UK/EU users, our data protection contact is available at the same email address.

We are committed to resolving any privacy concerns you may have.