Privacy Policy

Effective date: July 6, 2026  ·  Last updated: August 2, 2026

This policy explains what information FortuniFi (“FortuniFi,” “we,” “us”), operated by FortuniFi, LLC, a Michigan limited liability company, collects, how we use it, and the choices you have. By using FortuniFi you agree to this policy.

Information we collect

• Account information — your email address and a password. Passwords are stored only as salted, hashed values; we never keep them in plain text.
• Budget information you enter — income, bills, debts, savings goals, and similar figures you choose to type in so we can build your plan.
• Bank account data (optional) — if you choose to connect a financial account, we use a third-party bank-connection provider (a “financial data aggregator”) to retrieve information such as account balances, transactions, and account details so we can keep your plan current. We currently use Plaid, and may add other providers (for example, Finicity or MX) to reach institutions Plaid does not support. Connecting an account is optional and requires your consent; the app works fully without it, and you can disconnect at any time.
• Payment information — handled entirely by Stripe. We never see or store your full card number; we keep only a customer reference and your subscription status.
• Technical data — basic information needed to operate and secure the service, such as a session token stored in your browser to keep you signed in.

How we use your information

• To build and update your monthly plan and show your progress.
• To create and secure your account and process subscriptions.
• To provide support and respond to your messages.
• To protect against fraud, abuse, and security threats.

Connecting your bank accounts

Linking a financial account is optional and happens only with your affirmative consent, shown before the connection begins. To do it, we use trusted third-party bank-connection providers (financial data aggregators). We currently use Plaid Inc., and we may add other providers such as Finicity or MX to support institutions that Plaid cannot reach. These providers connect to your financial institution on your behalf and share account information — such as balances, transactions, and account details — with us.

When you connect through Plaid, your use of Plaid is also governed by Plaid’s End User Privacy Policy. We use the information we receive only to build and update your plan — never to sell or advertise. Connection tokens and any financial data we receive are stored encrypted at rest, and your bank-connection tokens are never exposed to your browser. FortuniFi never receives or stores your online-banking username or password — you enter those directly in your bank’s or Plaid’s secure window, and they are never visible to us.

You can disconnect a linked account at any time, which deletes our stored connection so we no longer access that account. Disconnecting stops any future access, but information already imported into your plan stays in your FortuniFi data as your own record until you choose to remove it — you can delete that data, or your whole account, at any time (see “Data retention and your choices”).

How we protect it

Sensitive fields are encrypted at rest, traffic is protected in transit with TLS, and access is limited and logged. No system is perfectly secure, and we don’t claim otherwise — but we hold as little sensitive data as possible and make what we hold unreadable without isolated keys. You can also sign out of all other devices from your account page. If a data breach affecting your personal information ever occurs, we will notify you and any regulators as required by applicable law.

How we share it — and what we never do

We share information only with the service providers that make FortuniFi work: Stripe (payments), our bank-connection providers (currently Plaid, and potentially others such as Finicity or MX — only if you connect an account), our infrastructure provider Cloudflare (secure hosting and storage), our email provider Resend (which sends transactional emails such as verification codes, receipts, and security notices, and receives only your email address and the message content), Amazon Web Services (AWS) (which securely holds, in its Key Management Service, the isolated master key that encrypts your sensitive data), and — for the optional AI features you choose to use — Anthropic (the maker of Claude), which powers features like reading a statement photo or drafting a hardship letter or call script. When you use an AI feature, we send only the specific details that feature needs; we never send the raw data from your connected bank accounts to the AI provider (no account or routing numbers, transactions, or connection tokens), and your data is not used to train AI models. The AI provider may retain what we send for a feature only briefly (up to about 30 days, or longer only if it is flagged for a safety review) and then deletes it, and every AI draft is yours to review before you use it. We may disclose information if required by law.

Shared households (couples)

FortuniFi lets two people share one household plan. If you invite a partner, or join a household, the financial information in that shared plan — the balances, debts, bills, transactions, and goals in it — is visible to the other member of the household. That’s how a shared plan works, so only share with someone you trust. Each of you still signs in with your own separate account and password. You can leave a shared household at any time; because the plan was shared, that plan data stays with the household unless you delete it, and you can always delete your own account and personal information. If you and your partner want to separate your finances, you can do that in the app or by contacting us.

Financial data and GLBA

Because FortuniFi handles consumer financial information, we operate consistent with the safeguards expected of a financial institution, including the Gramm-Leach-Bliley Act (GLBA) and its Safeguards Rule — we designate an individual accountable for our security program, encrypt sensitive data in transit and at rest, restrict and log access, oversee our service providers, and maintain an incident-response plan.

Cookies and local storage

FortuniFi keeps its cookie use to the essentials. We set a sign-in/session cookie and a security token so the app works and stays signed in. Our infrastructure provider, Cloudflare, sets a small security cookie (__cf_bm, and cf_clearance when a bot-check is passed) to protect the site from abuse, and measures basic traffic at the network edge from server logs — no cookie is used for that measurement. We also use your browser’s local storage to hold your plan on your device so the app is fast and works offline.

All of this is strictly necessary to provide the service you asked for. We do not use analytics, advertising, or cross-site tracking cookies — so there is no cookie banner to click, and nothing about you is sold or shared with advertisers. In the UK and EEA, strictly-necessary cookies and storage like these do not require prior consent; we describe them here for transparency.

Data retention and your choices

We keep your information only while your account is active, and we hold the minimum needed to run your plan. Security and audit logs are kept for a limited period (currently 90 days) and then automatically deleted.

You may access your data in the app, disconnect a linked bank at any time, and delete your account and all associated data. You can delete your account yourself in the app, which takes effect right away; if you email a deletion request instead, we complete it within 30 days. Deleting your account removes your stored plan data, bank-connection tokens, and sign-in credentials. You may also request correction or export of your data. Our retention periods and deletion process are set out in our internal Data Retention & Deletion Policy.

Your privacy rights (U.S. state laws)

Depending on where you live, U.S. state privacy laws — including the California Consumer Privacy Act as amended by the CPRA, and comparable laws in states such as Virginia, Colorado, Connecticut, and others — give you the right to:

• Know and access the personal information we hold about you;
• Correct inaccurate information;
• Delete your personal information;
• Export a portable copy of your data; and
• Opt out of any sale or sharing of your personal information for cross-context behavioral advertising.

We do not sell your personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of on that front. We honor Global Privacy Control (GPC) browser signals. You can exercise the rights above directly in the app (access, export, delete) or by contacting us; we will not discriminate against you for exercising them, and we verify requests using your account before acting on them. A California resident may designate an authorized agent to make a request on their behalf.

Open banking (UK & Europe)

If you are in the United Kingdom or the European Economic Area, your bank connection is provided through Plaid Financial Ltd. — authorised and regulated by the Financial Conduct Authority (FCA) as an Account Information Service Provider (AISP) under the Payment Services Regulations 2017, FCA reference number 804718. Plaid is the regulated provider that securely retrieves your account information from your bank on your behalf; FortuniFi receives that information solely to build and keep your plan current. Under open-banking rules you will be asked to re-confirm your consent about every 90 days, and you can withdraw consent and disconnect at any time — in the app or directly with your bank. Your use of Plaid is also governed by Plaid’s End User Privacy Policy.

Your privacy rights (Canada)

If you’re in Canada, under the federal PIPEDA and, in Quebec, Law 25, you can: access the personal information we hold and ask us to correct anything inaccurate; withdraw your consent to our use of your information at any time (this may limit some features); ask us to delete your information; request a copy of the information you gave us in a portable, structured format (Quebec); and understand how and why we use your information and who we share it with. We ask for your express consent before connecting a financial account, and we use that data only to build your plan — never to sell or advertise. If a security incident ever created a real risk of serious harm, we would notify you and the appropriate authority as the law requires. To exercise any right, or to reach our privacy officer, contact us. You may also complain to the Office of the Privacy Commissioner of Canada, or in Quebec to the Commission d’accès à l’information.

Your privacy rights (UK & Europe)

If you’re in the UK or the EEA, the UK GDPR / EU GDPR apply.

How we rely on the law to use your data (legal bases). We process your information to perform our contract with you (providing FortuniFi), on your consent (for connecting a financial account, and for any marketing), and for our legitimate interests in keeping the service secure and working — balanced against your rights.

Your rights. You can ask us to give you access to your data; correct it; erase it (“right to be forgotten”); restrict or object to how we use it; receive it in a portable format; and withdraw consent at any time (without affecting what we did before). We’ll respond within one month. To exercise any right, contact us. Complaints: you can complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk, or to your local EU supervisory authority.

Where your data is processed & international transfers. Your information is hosted and processed by our infrastructure provider, Cloudflare, Inc. Where your information is transferred outside the UK or EEA, we rely on the safeguards in Cloudflare’s data-processing agreement — including the UK International Data Transfer Addendum (IDTA) and the EU Standard Contractual Clauses. We keep your information only as long as needed to provide the service and meet legal obligations, and you can delete your account and data at any time. Marketing (PECR): we send marketing emails only with your consent, and every one has a one-click unsubscribe.

Your consent

When you create an account, you affirmatively agree to this Privacy Policy and our Terms, and you confirm you are at least 18. Connecting a financial account requires a separate, specific consent shown at the moment you link it, and you may withdraw that consent at any time by disconnecting the account.

Children

FortuniFi is an adult financial tool intended for users 18 and older, and it is not directed to children. We do not knowingly collect personal information from anyone under 18; if we learn we have, we delete it. Any separate FortuniFi product designed for youth financial education would operate under its own privacy policy built for that purpose, including verifiable parental consent (COPPA) and, in school settings, FERPA safeguards.

Changes to this policy

We may update this policy from time to time. We will post the new effective date here and, for material changes, take reasonable steps to notify you.

Contact us

Questions about your privacy? Open a support ticket or email us at [email protected].