Privacy Policy

Effective: April 1, 2026  ·  Version 1.3

This policy explains what data Reclaim collects, why, how it is used, and your rights — including GDPR (UK & EU), CCPA (California), PIPEDA (Canada), Australian Privacy Act, and applicable laws in the UAE, Saudi Arabia, Qatar, Singapore, Japan, South Korea, Hong Kong, New Zealand, and Brazil.

1. What we collect

Information you give us

• Account data: Name, email address, password (hashed — we never see it)
• Onboarding answers: Country, income range, financial goals — used only to personalise your experience, never sold
• Tax documents: W-2s, 1099s, prior returns — uploaded voluntarily for tax services only
• Consent records: Timestamp and version of terms you agreed to

Information collected automatically

• Bank transactions: Read-only via Plaid (US/Canada) or TrueLayer (UK/EU). We detect recoverable charges. We never see your login credentials.
• Gmail: Read-only access to send recovery emails and detect replies. We only read emails related to recovery threads we created.
• Device locale: Country and language, detected once at signup. Not tracked ongoing.
• App usage: Anonymised event logs to improve the product. No advertising use.

What we never collect

• Bank account numbers, sort codes, or login credentials
• Payment card details (handled entirely by Apple)
• Advertising trackers or third-party data profiles

2. How we use your data

• Detecting duplicate charges, price hikes, and unknown charges
• Generating and sending recovery emails on your explicit approval
• Providing income tracking, budgeting, and tax document storage
• Connecting you with tax professionals (US and Canada)
• Sending in-app notifications about recovery status
• Improving the app through anonymised analytics

AI models (Anthropic Claude) process transaction descriptions to identify issues. Anthropic does not retain or train on your data.

3. Legal basis for processing (GDPR / UK GDPR)

Applies to: EU · UK

Data Controller: Reclaim — privacy@getreclaimapp.store

• Contract performance — necessary to deliver the service you signed up for
• Legitimate interests — anonymised analytics, fraud prevention
• Consent — Gmail access, tax documents, optional analytics (withdraw anytime in Settings)
• Legal obligation — retaining financial records as required by law

4. Who we share data with

• Plaid Technologies — bank linking (US/Canada). Privacy Policy
• TrueLayer Limited — bank linking (UK/EU). Privacy Policy
• Supabase Inc. — database and auth, US East (Virginia). Privacy Policy
• Anthropic PBC — AI analysis only. No data retention or training. Privacy Policy
• Apple Inc. — payment processing. Privacy Policy
• Independent tax professionals — only when you explicitly request tax services

We do not sell, rent, or share your data with any other party.

5. How we store and protect your data

• Encrypted in transit (TLS 1.3) and at rest (AES-256)
• Row-level security ensures you can only access your own data
• Bank credentials never stored — Plaid and TrueLayer handle tokenised access
• Passwords hashed using bcrypt, never visible to us
• Sessions encrypted using iOS Keychain (Secure Enclave)
• Production data access limited to essential personnel only

6. Data retention

• Account data: Deleted within 30 days of account closure
• Transaction data: 24 months, then deleted
• Tax documents: Until you delete them or close your account
• Email content: 12 months
• Anonymised analytics: 36 months

Delete your account and all data anytime in Settings → Delete Account. Permanent and irreversible.

7. Your rights

Everyone

• Access your data: privacy@getreclaimapp.store
• Delete your data: Settings → Delete Account
• Export your data: Settings → Export My Data
• Disconnect bank or Gmail: Settings at any time

EU & UK (GDPR) EU · UK

• Right of access, rectification, erasure, restriction, portability, objection, and consent withdrawal

Contact privacy@getreclaimapp.store. Response within 30 days. Complaints: UK → ICO (ico.org.uk), EU → your national DPA.

California (CCPA) US-CA

Right to know, delete, and opt-out of sale. We do not sell personal information. Contact privacy@getreclaimapp.store.

Canada (PIPEDA) CA

Withdraw consent by deleting your account. Contact privacy@getreclaimapp.store for access or correction requests.

Australia & New Zealand AU · NZ

Compliant with Australian Privacy Principles. Complaints: OAIC (oaic.gov.au). Contact privacy@getreclaimapp.store.

UAE, Saudi Arabia & Qatar GCC

Compliant with applicable local data protection laws. Contact privacy@getreclaimapp.store.

Singapore & Hong Kong SG · HK

Compliant with Singapore PDPA and Hong Kong PDPO. Contact privacy@getreclaimapp.store.

Japan (APPI) JP

Contact privacy@getreclaimapp.store for disclosure, correction, or deletion under the APPI.

South Korea (PIPA) KR

Contact privacy@getreclaimapp.store for requests under PIPA.

Brazil (LGPD) BR

Contact privacy@getreclaimapp.store for access, correction, deletion, or portability under the LGPD.

8. Children

Reclaim is for users aged 17 and above. Contact privacy@getreclaimapp.store if you believe a child has provided data and we will delete it immediately.

9. Contact

• Privacy: privacy@getreclaimapp.store
• Support: support@getreclaimapp.store
• Website: getreclaimapp.store
• Response time: 5 business days for support · 30 days for rights requests

Updates

We will notify you of material changes by email and in-app at least 14 days before they take effect.