Privacy Policy

What We Collect

Account Information

When you sign up, we collect:

• Email address - So you can log in and we can reach you about your account
• Name - So your AI coach knows what to call you
• Password - Stored encrypted (hashed), we can never see it

Financial Data

When you connect your bank, we receive:

• Transaction history - Descriptions, amounts, dates, and categories
• Account balances - So you can see your money in one place
• Account names - To help you identify your accounts

Important: You log in to your bank inside Plaid's secure window. Plaid is a bank-connection service that many banks and money apps use. Zado never sees or stores your username or password. Your bank connection is read-only. Zado asks Plaid for your transactions and nothing else, so it can read your accounts, transactions and balances. It has no way to send, withdraw or transfer money from your bank.

Preferences & Settings

We store your choices, like:

• Your coach's personality settings
• Your neurotype preferences (if you choose to share)
• Notification settings
• Budget categories and allocations

App Usage

We may collect basic analytics:

• Which features you use (to improve them)
• Error reports (to fix bugs)
• Device type and browser (to ensure compatibility)

How We Use Your Data

• To run the app - Your transactions power your budget
• To personalize your coach - Your preferences shape how it talks to you
• To improve Zado - Anonymous, aggregated data helps us build better features
• To contact you - Only for account-related stuff, never spam

What We Don't Do

We never sell your data, never share it with advertisers, and don't use advertising cookies.

We do share what each service needs to run Zado for you: Plaid connects your bank, Anthropic answers Penny's questions, and Twilio sends the texts you ask for. Each is described below.

Bank Connection Security

We use Plaid for bank connections.

You log in to your bank inside Plaid's secure window. Plaid is a bank-connection service that many banks and money apps use. Zado never sees or stores your username or password.

Your bank connection is read-only. Zado asks Plaid for your transactions and nothing else, so it can read your accounts, transactions and balances. It has no way to send, withdraw or transfer money from your bank.

Disconnect your bank from Settings whenever you like. If you delete your account, it's removed 72 hours after you ask, and you can change your mind before then.

About Plaid

When you connect a bank through Plaid, Plaid processes your data under their own privacy policy. We don't control how Plaid handles your information. That relationship is between you and Plaid.

Read Plaid's policy here: Plaid End User Privacy Policy.

Plaid may collect more information about you than Zado uses. From the data Plaid makes available to us, Zado only requests and stores what we need to run your envelope budget: transaction history, account balances, and account names (as listed above under "Financial Data").

To revoke Plaid's access, you have two paths:

• Disconnect the bank from Zado at Settings > Banks & Data. When you remove a connection, Plaid is designed to automatically delete the personal data tied to that connection from its systems.
• Manage your Plaid connections directly through Plaid Portal at my.plaid.com.

You can also contact Plaid directly at privacy@plaid.com for data subject requests.

AI Coach Privacy

Where Penny's AI runs: Penny's answers come from Claude, an AI made by Anthropic. When you ask Penny something, your question and the parts of your money picture she needs to answer it are sent to Anthropic. Anthropic deletes them within 30 days, with exceptions: it keeps them longer when the law requires it, and for up to 2 years if its automatic safety checks flag a conversation (the results of those checks, for up to 7 years). Anthropic doesn't train its AI on what Zado sends.

Your conversations with Penny are:

• Yours alone in Zado - Before we ship a change, we test it for one customer reaching another's data, across every part of our server and every one of Penny's tools.
• Deletable - You can clear your chat history anytime

Where the data lives: Your conversations and the money data Penny uses are stored in our database. Our hosting provider, Railway, encrypts all stored data (AES-256). That protects your data on the disks it's kept on. It doesn't stop someone who has our database login, which is why a second layer, inside Zado itself, is on our list of what we haven't done yet. Encrypting your conversations, transactions, receipts and the rest of your money data inside Zado, as a second layer on top of our host's disk encryption. Today only the bank key and the two-step secret are encrypted that way. Today Zado's server and the founder's own tools, including AI tools, share one login to the production database. The database has an address on the internet, and that login is what protects it.

Receipts & Images

If you snap or upload a receipt, we read it so we can match it to a transaction and split it across your envelopes. From the receipt we extract and store:

• Store, date, and totals - Merchant name, date, subtotal, tax, and total
• Line items - Each item's description, quantity, price, and the envelope category we assign it
• Payment method - Whether it was cash, credit, debit, etc. (never the card number)
• The image itself - Kept in your account so you can look back at the original
• The full text we read off it - The raw text pulled from the receipt, kept so we can re-check our work. It can include anything printed on the receipt — the store address, a loyalty/member number, or a partial card number if the receipt itself shows one

How we read it: When you snap a receipt photo, Claude, the AI made by Anthropic, reads the photo to find the store, date, totals and items. Before we send the photo to Claude, we strip the hidden location and camera details from it. Sorting those items into your envelopes is a separate choice, and it stays off until you say yes. The first time you scan a receipt with items to sort, Zado asks. If you say yes, it sends the item names and your envelope names to Claude, never your balances or accounts. You can change your answer anytime in Settings, under Receipts.

In more detail: we read every receipt on our own servers too. When you send a photo, Claude reads the image itself, which is how a crumpled, faded or handwritten receipt still gets read. If our servers can't read a receipt's text cleanly (a PDF, or a hard photo), we may also send that text to Claude. What Anthropic keeps, and for how long, is the same as for Penny's questions (above). If we still can't read a receipt, we tell you plainly rather than guess.

Sorting the items into envelopes: This is off until you say yes. The first time you scan a receipt with items to sort, Zado asks: "Want me to sort these items into your envelopes?" If you say yes, we send Claude the item names we couldn't sort, the store name, and the list of your envelope names, and ask which of your envelopes each item belongs to. Never your balances, amounts, or anything about your accounts. The AI can only pick from that list; if it picks something that isn't yours, we throw the answer away and leave the item unsorted rather than guess. If you say "Not now", none of that is sent, your items stay unsorted for you to file, and we won't ask again. You can change your answer anytime in Settings, under Receipts.

What we don't do: Receipt data stays inside your account. We don't sell it, we don't share it with advertisers, and we won't use your individual receipts to build any other product without your explicit, opt-in consent. You can delete a receipt anytime.

Agent Access

Connecting outside AI agents to your account is paused while it gets its own security review. If you connected one before, you can still remove it in Settings.

When it comes back, it will stay opt-in: you'd connect each agent yourself, choose what it can see or spend, and be able to remove it anytime.

SMS Communications & Consent

If you choose to receive SMS-based approval prompts for AI agent purchases, here's exactly what happens.

What you'll receive

We send text messages for two purposes only:

• Purchase approval requests - When an AI agent connected to your Zado account tries to make a purchase above your configured approval threshold, you'll get a text like: "[Zado] Your agent Dottie wants to spend $87.00 on Groceries (Whole Foods). Reply YES to approve, NO to deny." You reply, and the agent only proceeds if you said YES.
• Verification codes - When you add a new phone number to your account, we text you a one-time 6-digit code to confirm the number is really yours.

No marketing. No promotions. No surveys. No solicitations. Every text is triggered by a specific action you or your agent took.

How you opt in

1. Go to Settings → Phones in the Zado app
2. Enter your phone number
3. We send a one-time code via text
4. Enter the code in Zado to verify the number

By adding your phone and confirming the code, you explicitly consent to receive SMS messages from Zado for the purposes listed above.

How you opt out

• Reply STOP to any Zado text message. We'll immediately stop sending you SMS. STOPALL, UNSUBSCRIBE, CANCEL, END, and QUIT also work.
• Remove your phone from Settings → Phones. Same effect, instant.

You can reply START to reactivate if you've previously opted out, or just re-verify the phone in Settings.

How to get help

Reply HELP to any Zado text message. You'll receive a single response with support contact info: "Zado SMS. Reply STOP to opt out. Support: nicholas.smith@evolvingintelligence.ai or https://zadofi.ai."

The full SMS opt-in workflow (with screenshots) is at zadofi.ai/sms-opt-in.

How often

Volume scales with your own agent activity:

• One SMS per agent purchase that requires your approval
• Plus one SMS per phone-verification setup (one-time)
• Plus an optional settlement confirmation when a transaction completes

Typical: a few SMS per day if your agents are active; zero if they're not.

Message and data rates

Standard message and data rates may apply per your wireless plan. Zado does not charge you for SMS.

How we handle your phone number

• What we store - The phone number, an optional label you provide, and the timestamp of when you verified it.
• Verification codes - Stored as a one-way bcrypt hash; we can't recover or read them. Hashes are deleted after successful verification.
• Who else sees it - Only our SMS provider (Twilio), for the sole purpose of delivering messages you've asked to receive. Twilio's privacy policy covers their handling.
• Marketing - We never use your number for marketing and never share it with marketers.
• Deletion - Remove your phone from Settings → Phones anytime. The number is immediately deleted from our records and all SMS to that number stops.

Your Rights

You can always:

• Export your data - Download everything in JSON or CSV format
• Delete your account - Removes all your data from our systems
• Disconnect your bank - Stop transaction syncing anytime
• Update your info - Change your email, name, or preferences
• Contact us - Ask questions about your data

To exercise these rights, go to Settings > Data & Privacy, or email us at support@zadofi.ai

Data Storage

Here's the honest picture of how your data is stored today:

• Encryption in transit - Every connection to Zado uses HTTPS, and browsers are told to accept nothing else.
• Encrypted where it's stored - Our hosting provider, Railway, encrypts all stored data (AES-256). That protects your data on the disks it's kept on. It doesn't stop someone who has our database login, which is why a second layer, inside Zado itself, is on our list of what we haven't done yet.
• Encrypted inside Zado - The key Plaid gives us to read your account, and your two-step sign-in secret, are encrypted inside Zado before they're stored.
• Who can reach the database - Today Zado's server and the founder's own tools, including AI tools, share one login to the production database. The database has an address on the internet, and that login is what protects it.
• Automatic backups - Our hosting provider maintains automatic backups of the database

What isn't encrypted inside Zado yet: transaction history, envelope balances, conversations with Penny, preferences, audit logs, and your receipt images and the text we read from them (the images on our file storage, everything else in the production database). We want you to know exactly what is and isn't protected that way.

What we haven't done yet:

• Separate database logins: one for Zado's server that can do only what the app needs, and a read-only one for people and AI tools. It's built and switches on next.
• Encrypting your conversations, transactions, receipts and the rest of your money data inside Zado, as a second layer on top of our host's disk encryption. Today only the bank key and the two-step secret are encrypted that way.
• An independent security audit. Until we have one, we hold ourselves to a written security standard and log every security review we run and what it found. Not every change gets an independent review yet, only our security work.

The full picture, kept current, is on How Zado protects your money.

Cookies

We use a few essential cookies to:

• Keep you logged in
• Remember your preferences
• Protect against cross-site attacks

We don't use tracking cookies or third-party advertising cookies.

Changes to This Policy

If we make significant changes, we'll:

• Update the "Last updated" date
• Notify you via email or in-app message
• Give you time to review before changes take effect

Contact Us

Questions about privacy? We're happy to help.

• Email: support@zadofi.ai