Slash Privacy Policy

Account information

When you create an account, we collect your email address and an authentication credential (your password is never stored by us in readable form; it is handled by our authentication provider, Supabase). We may also collect your name where it is provided to us in connection with your account or bank connection.

Financial information (through Plaid)

To detect your spending, Slash connects to your bank through Plaid Inc., a third-party financial data provider. When you link a bank, Plaid provides us with:

• the name of your financial institution and identifiers for the connected accounts;
• your transactions, including the amount, date, merchant or description, and category of each transaction.

We use this information solely to calculate how much you have spent during the current period and to compare it against your limit. Plaid provides us with a secure access token that lets us retrieve your transactions; we store that token in encrypted form and never expose it to the app or any third party. We do not receive or store your online banking username or password — you enter those directly with Plaid. Plaid's handling of your information is governed by Plaid's own end-user privacy policy, available at plaid.com/legal.

Spending settings

We store the settings you configure, such as your weekly spending limit, your next-period limit, and whether blocking is enabled.

Subscription information

Slash offers an auto-renewable subscription that is purchased and managed through Apple. Apple processes your payment; we never receive your credit card or payment details. We receive from Apple your subscription status (for example, whether your subscription is active) so we can provide the paid features.

Information that stays on your device

The selection of which apps you choose to block is made through Apple's system Family Activity picker and is stored only on your device. Because of how Apple's Screen Time framework is designed, this selection and your app-usage data are never transmitted to us and are not accessible to us or to any third party. Slash also stores small amounts of app-state data on your device (for example, your onboarding progress) to make the app function.

Information we do not collect

Slash does not collect your precise location, your contacts, your photos, your microphone or camera input, or advertising identifiers. Slash does not include analytics or advertising software development kits, and it does not use the App Tracking Transparency framework because it does not track you.

We use the information described above to:

• provide the core function of the app — monitoring your spending against the limit you set and blocking the apps you selected when you exceed it;
• authenticate you and keep your account secure;
• provide and manage your subscription;
• respond to your support requests and send you essential service messages;
• maintain the security and integrity of the service, prevent fraud and abuse, and comply with legal obligations.

We do not use your financial or personal information for advertising, marketing profiling, or use-based data mining, and we do not sell or rent it.

Where the EU or UK General Data Protection Regulation applies, we process your information on the following bases:

• to perform our contract with you (providing the app's core spending-monitoring and blocking features, and your subscription);
• your consent (for example, when you choose to connect a bank account), which you may withdraw at any time by disconnecting the bank or deleting your account;
• our legitimate interests in securing the service and preventing abuse;
• compliance with legal obligations.

We share information only with the service providers that make Slash work, and only to the extent needed to provide the service. We require these providers to protect your information to a standard consistent with this policy and with applicable law.

• Plaid — connects to your bank and provides transaction data. See plaid.com/legal.
• Supabase — provides authentication and database hosting for your account, settings, and transaction records. See supabase.com/privacy.
• Railway — hosts our backend server infrastructure. See railway.app/legal/privacy.
• Apple — processes your subscription purchases and operates the App Store and Screen Time technology. See apple.com/legal/privacy.

We may also disclose information if required to do so by law, or to protect the rights, safety, and security of our users, the public, or Slash. If Slash is involved in a merger, acquisition, or sale of assets, we will provide notice before your information is transferred and becomes subject to a different privacy policy.

We do not share your information with third parties for their own marketing or advertising purposes.

We protect your information using industry-standard measures. Bank access tokens are encrypted at rest using AES-256-GCM, and they are never returned to the app or to any client. All communication between the app and our servers occurs over encrypted connections (HTTPS/TLS). Access to your records is restricted to your own account through database row-level security and authenticated requests. No method of transmission or storage is completely secure, but we work to protect your information and to limit what we collect to what the app needs.

We retain your account information, settings, and transaction records for as long as your account is active. When you delete your account, we permanently delete this information, as described in Section 7. We may retain a limited amount of information where necessary to comply with legal obligations, resolve disputes, or enforce our agreements, after which it is deleted.

Disconnecting your bank

You can disconnect a linked bank account at any time from within the app. When you do, we instruct Plaid to remove the connection and we stop retrieving your transactions.

Deleting your account

You can delete your account and all associated data entirely from within the app, in Settings. Deleting your account permanently removes your profile, your settings, your transaction records, and your bank connections, and it revokes your bank access token with Plaid. Account deletion is immediate and cannot be undone; it is separate from simply signing out.

Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. Because Slash lets you view your data in the app and delete your account and data directly, you can exercise the core of these rights yourself at any time. For any additional request, contact us at privacy@theslash.app and we will respond as required by applicable law. You will not be discriminated against for exercising your privacy rights.

California residents

We do not sell or share your personal information as those terms are defined under the California Consumer Privacy Act, and we do not use it for cross-context behavioral advertising. California residents have the rights described above and may exercise them as set out here.

Slash is not directed to children, and it is not intended for use by anyone under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at privacy@theslash.app and we will delete it.

We operate in the United States, and our service providers may process your information in the United States and other countries. Where required, we rely on appropriate safeguards for international transfers of personal information.

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, provide additional notice within the app. Your continued use of Slash after an update means you accept the revised policy.

If you have questions about this Privacy Policy or how we handle your information, contact us at:

[LEGAL ENTITY]
privacy@theslash.app

This policy is governed by the laws of [JURISDICTION], without regard to its conflict-of-laws rules.