Last updated: October 2026
This Privacy Policy describes how Allokate LLC ("Allokate," "we," "us," or "our") collects, uses, shares, and protects information when you use our websites, mobile experiences, and related services (collectively, the "Services").
We built Allokate to help households feel calm and in control of their money. That mission only works if you trust us with your data; so we keep this policy in plain language and avoid surprises wherever we can.
1. Quick summary
- We collect only what we need to run the Services and help you budget.
- We do not sell your personal information.
- Bank credentials are handled by our connection partner (Plaid). We never see or store your bank username or password.
- You can delete your account any time in Settings → Profile & account → Delete account (web, iOS, and Android), or email support@allokate.io to export or delete your data.
- We use trusted infrastructure (Supabase, Vercel, Stripe, Apple, Plaid, Pendo, Resend, Expo, and Google or OpenAI for AI features); each is described below.
- AI features send a model provider only what that feature needs for one request. Never your bank login, your password, or your email address. Section 5.1 lists exactly what goes where.
2. Who we are
Data controller: Allokate LLC, Durham, North Carolina, United States.
Contact: support@allokate.io for privacy questions, data requests, or general inquiries.
3. Information we collect
3.1 Information you give us directly
- Account data: email address, password (stored as a salted hash by our auth provider), display name, household name, and profile details you choose to add.
- Financial information you enter: transactions, budgets, categories, goals, recurring bills, net worth items, paycheck allocations, and notes you add inside the product.
- Household data: members you invite, their role (owner / partner), and shared budget records.
- Support communications: messages, screenshots, or attachments you send us when you ask for help.
3.2 Information we collect automatically
- Usage and diagnostics: pages visited, features used, device and browser type, approximate location derived from IP address, log data, and crash or performance data.
- Cookies and similar technologies: required for authentication, optional for analytics. You can clear or block cookies in your browser at any time, though that may affect login.
3.3 Information from third parties
- Authentication providers (Google Sign-In and Sign in with Apple) share basic profile information you authorize at the consent screen.
- Bank connection partner (Plaid): We use Plaid Inc. ("Plaid") to connect your accounts. Plaid authenticates with your institution and returns account names, balances, transactions, and investment holdings to Allokate. By connecting an account, you grant Allokate and Plaid the right, power, and authority to act on your behalf to access and transmit your information from your financial institution, under Plaid's End User Privacy Policy. We never receive your bank credentials.
- Payment processor (Stripe): when you subscribe, Stripe collects payment details directly. We receive subscription status, plan, and a customer ID; never your full card number.
4. How we use information
We use information to:
- Provide, maintain, and improve the Services; including personalization, household features, and security.
- Authenticate you, process subscriptions, and communicate about your account or important product updates.
- Respond to support requests and comply with legal obligations.
- Detect, prevent, and respond to fraud, abuse, or security incidents.
- Analyze aggregated or de-identified usage to make Allokate easier and more useful.
- Show optional community benchmarks in Achievements (leaderboards and cohort medians). See our Community benchmarks page for sources and opt-out controls.
- Suggest categories. When you file a transaction, we may count one word from its merchant name together with the category you chose, with other households' filings, so the next suggestion is better. Counts are shown to no one as a person, and one person counts once. If you would rather keep yours out, email support@allokate.io and we will stop counting them.
We do not sell your personal information as that term is defined under U.S. state privacy laws (CCPA / CPRA, VCDPA, CPA, and similar). We do not use your financial data to train third-party AI models.
5. How we share information
We share information only with service providers that help us run Allokate, and only as needed for them to do their job:
| Partner | Purpose |
|---|---|
| Supabase | Database, authentication, file storage |
| Vercel | Hosts our website and web app |
| Plaid | Bank account connections, transaction sync, and investment balances |
| Stripe | Subscription billing and payment processing |
| Apple | App Store purchases and Sign in with Apple |
| Pendo | Product analytics on web (guides, session replay, usage events) |
| Allokate (first-party) | Product analytics stored in our Supabase database (screens, clicks, feature usage on web and mobile) |
| Google (Gemini API) | Our default provider for AI features (Ask Allokate, category suggestions, plain-words report summaries, reading receipts). See 5.1 for what each one receives |
| OpenAI | The same AI features, only as a fallback when Google is not available |
| Resend | Account and transactional email, including invites |
| Expo | Delivers push notifications to your device |
| Logo services (Nubela, logo.dev, and DuckDuckGo icons) | Receive merchant domains to fetch logos. Direct image requests also include your IP address and browser or device metadata; we do not send amounts or account identifiers |
| Wikidata (Wikimedia Foundation) | Receives cleaned merchant or company names when we look up an unknown merchant's website, without amounts or account identifiers |
We may also share information when required by law, to enforce our agreements, to protect rights or safety, or in connection with a business transfer (merger, acquisition, sale of assets); in which case we will notify you.
5.1 AI features: what goes to the model provider
A few features use a large language model. Our default provider is Google (Gemini API). If Google is not available for a request, we may use OpenAI instead. For each request we send the provider only what that feature needs, over an encrypted connection. We never send your bank login, your password, or your email address, and we do not use your financial data to train models.
| Feature | What the provider receives |
|---|---|
| Ask Allokate (the assistant) | Your question, and the parts of your budget it looks up to answer it: categories and budgets, transactions (merchant names, amounts, and dates), goals, bills, and account summaries. Your income, if the question needs it. |
| Suggesting a category for a transaction | A cleaned-up merchant name and the names of your categories. No amounts and no income. |
| Writing a report in plain words (only when you press the button) | The report's totals (income, spending, savings), your top category names with amounts, which categories went over budget, and your first name if the report shows it. |
| Reading a receipt, a screenshot, or a store order | The image, PDF, or order-page text you scan or add. |
Providers receive these requests through their developer APIs and handle them under their API terms, which can include keeping a request for a limited time to catch abuse. Rules and your own history sort most transactions without any AI at all.
6. Legal bases (where applicable)
If the GDPR, UK GDPR, or similar laws apply to you, we rely on these legal bases:
- Contract; to provide the Services you request.
- Legitimate interests; to keep the Services secure, prevent fraud, and improve the product.
- Consent; for optional cookies, marketing emails, or features that require it.
- Legal obligation; to comply with tax, accounting, and other applicable laws.
7. Data retention
We keep information for as long as your account is active and as needed to provide the Services, comply with law, resolve disputes, and enforce our agreements. When you delete your account, we delete or de-identify your personal data within 30 days, except where retention is required (for example, billing records). Backups roll off within 30 days of deletion. If an account has had no sign-in for 24 months, we email you, and if you do not sign in within 30 days of that notice, we delete the account. To prevent repeated free-week claims after account deletion, we retain a restricted fingerprint of the email used to claim the week and its start date. We do not use names for this check.
8. Security
We use industry-standard measures appropriate to the sensitivity of household financial data, including:
- Encryption in transit (TLS 1.2 or better) and at rest (AES-256).
- Row-level security policies on every user-scoped database table.
- Least-privilege access controls for our team.
- Regular dependency and security scanning.
- We review our security program at least once a year.
No method of transmission or storage is 100% secure. If we ever experience a breach affecting your data, we will notify you as required by law.
9. Your choices and rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you.
- Correct inaccurate information.
- Delete your account and associated data.
- Export your data in a portable format.
- Restrict or object to certain processing.
- Withdraw consent where we relied on it.
- Opt out of targeted advertising or "sales" (we do not engage in either).
You can delete your account any time in Settings → Profile & account → Delete account, on web, iOS, and Android. The steps are also at allokate.io/delete-account. To exercise any of these rights, or if you would rather ask us to do it, email support@allokate.io. We will respond within the timeframe required by your local law (typically 30–45 days). You may also lodge a complaint with your local data protection authority.
10. International transfers
Allokate is operated from the United States. If you access the Services from outside the U.S., your information will be transferred to and processed in the U.S. Where required, we use appropriate safeguards such as Standard Contractual Clauses.
11. Children's privacy
The Services are not directed to children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will post the updated version and revise the "Last updated" date above. For material changes, we will give you reasonable notice; for example, by email or an in-app banner; before the change takes effect.
13. Contact us
Questions, concerns, or requests about this Privacy Policy:
Allokate LLC Durham, NC, United States support@allokate.io