Felix(“the app”) lets you view your bank, card, and brokerage accounts in one place. This policy explains what data the app collects, how it’s stored, who else processes it, and how you can delete it.
The app is operated by Felix Software LLC(“we,” “us”). For any questions about this policy or your data, email bryanmoses@comcast.net.
What we collect
To run the app we collect:
- Account information: the email address and password you provide at signup. Passwords are hashed by our auth provider; we never see plaintext passwords.
- Financial account data:when you connect a bank, card, or brokerage, the app receives institution name, account names, account types, balances, transactions, and (for brokerages) holdings. Connection credentials (your bank username and password) are entered in the partner’s widget and never reach the app.
- Access tokens: short identifiers our data partners issue so the app can refresh your account data on your behalf. These are encrypted with AES-256-GCM before storage and are only decrypted server-side during your active sync requests.
- Session cookies: a single httpOnly cookie that keeps you signed in.
The app does not collect: your bank username or password, your government ID, your phone number, your physical address, browsing history outside the app, location data, or analytics tied to your identity.
How we use your data
We use your data only to display your accounts and transactions back to you, and to keep that view up to date by periodically syncing with your connected institutions. We do not sell your data. We do not share your data with advertisers. We do not use your transactions to train machine-learning models. We do not contact you for marketing.
Service providers
The app passes data through the following service providers, each with a narrow, purpose-specific role:
- Plaid:connects to U.S. banks and credit-card issuers and provides the app with account balances and transactions. Your bank credentials are entered into Plaid’s widget and are never shared with the app. Plaid’s handling of end-user data is described in their End User Privacy Policy.
- Supabase:hosts the app’s database and authentication. Your account record and your (encrypted) financial data are stored here. Database access is scoped per-user via Row-Level Security.
- Vercel:hosts the app’s code and serves it over HTTPS. Vercel sees HTTP request metadata (IP address, user agent) as a normal part of serving traffic.
- Upstash:stores per-user request counters for rate limiting. Only an opaque user identifier and the endpoint name are stored — no financial data ever reaches Upstash.
Each of these providers acts as a data processor on our behalf and is bound by their own published terms.
Security
We treat your financial data as sensitive. Specifically:
- All traffic to and from the app uses HTTPS.
- Access tokens are encrypted at rest with AES-256-GCM, bound to your user identity so a token blob cannot be moved between users or between contexts.
- Every database query that touches user data is scoped to the signed-in user via Row-Level Security policies.
- Tokens and secrets are never written to logs, never returned to the browser, and never embedded in error responses.
- Cost-multiplying endpoints (sync, account connect, account delete) are rate-limited per user.
No system is perfectly secure. If we become aware of a breach that affects your data, we will notify you by email at the address on your account without undue delay.
How long we keep your data
We keep your data for as long as your account exists. When you delete your account (Settings → Danger zone) the app:
- Revokes its access at every connected institution via Plaid.
- Deletes your auth record, which cascade-deletes your encrypted tokens, accounts, transactions, and holdings.
- Signs you out and clears your session cookie.
Backups maintained by Supabase may retain a copy of deleted rows for up to 30 days as part of normal disaster-recovery policy. After that window, backups roll off.
Your rights
You can:
- Access your data at any time through the dashboard.
- Disconnecta specific institution without deleting your account (Accounts panel → Disconnect).
- Deleteyour entire account and all associated data (Settings → Danger zone).
- Email us at bryanmoses@comcast.net for any other question, correction, or request.
Depending on where you live (for example California, the EU, the UK) you may have additional rights under local law including the right to a copy of your data in a portable format or the right to correct inaccuracies. Email us and we’ll honor those requests within the timelines those laws require.
Cookies
The app sets one cookie: an httpOnly, Secure session cookie issued by Supabase Authentication that keeps you signed in across page loads. The app does not use advertising or analytics cookies.
Children
The app is not directed to children under 13. We don’t knowingly collect data from children under 13. If you believe a child has created an account, email us and we’ll delete the account.
Changes to this policy
If we change this policy in a way that materially affects how your data is used or shared, we’ll update the effective date at the top of this page and email you at the address on your account before the change takes effect. Continued use of the app after a change indicates acceptance of the updated policy.
Contact
For any privacy-related question or request, email bryanmoses@comcast.net. The app is served from https://seefelix.com.