Privacy Policy

Draft, pending legal review. This policy describes how the app works today, but it hasn't been reviewed by a lawyer yet and may change before tarpp launches. Text in [square brackets] is still to be filled in.

This policy explains what tarpp collects, why, who helps us run it, and the choices you have. "tarpp", "we" and "us" mean Parchment Holdings LLC, [address, to be added]. It covers the tarpp iPhone app, its Safari extension and this website.

The short version

We collect what the app needs to work: your account, the choices you make in Safari, your goal, and, if you link one, your investment account's balances and deposits.
tarpp never holds or moves your money and never sees your brokerage login.
No ads, no third-party analytics or tracking, and we don't sell your data.
You can export your data and delete your account in the app at any time.

What we collect

Your account

Your email address, or with Sign in with Apple the address Apple gives us (which can be a private relay address).
Your password, if you sign up with email. It's stored only as a secure hash by our authentication provider.
Your first name, and your last name if you add it.
An optional profile photo or avatar colour.
Settings saved with your account: your yearly goal and when you chose it, whether you've seen the app's tour, and which tips you've dismissed.

Your choices in Safari

The Safari extension reads product pages on the websites you allow in Safari's settings, to find a product's name, price and picture. It only acts when you tap a buy button for something over the minimum price you set. It saves something only when you choose in its sheet:

Whether you chose Invest instead or Buy anyway, and when.
The product's name, its price, the web address of its picture, and the store's website name (for example, a shop's domain), never the page's full address.
For Invest instead, the name of the linked brokerage you chose.

These are saved on your iPhone and then to your account by the app. The extension doesn't record the pages you visit and doesn't send anything to our servers itself.

If you use Remind me later (Pro), the reminder, including the product page's address, is kept on your iPhone only.

Linked investment accounts (optional)

If you link an investment account, you do it through Plaid (see below). You sign in to your brokerage in Plaid's screens; we never see your login. Through Plaid we receive, and keep:

The institution's name, logo and colour.
Each investment account's name and the last four digits of its number.
Each account's current balance, and a daily record of it so we can show how it has changed.
Cash deposits and contributions into those accounts (date, amount and description).
An access token from Plaid, kept only on our server, which the app itself can't read.

To find deposits, our server reads the accounts' recent investment transactions from Plaid and keeps only the deposits. We don't link bank or credit card accounts, so we never receive your spending.

Subscriptions

If you subscribe to Pro, Apple handles payment; we never see your card. Apple sends us a signed record of the subscription, from which we keep your plan, its status, when it renews or ends, and Apple's transaction identifier for it.

Feedback and support

If you send feedback in the app, we keep your message, how important it is to you, whether we may contact you about it, and the app's version. If you email us, we keep the email and our reply.

On your iPhone only

Some things never leave your iPhone: Remind me later reminders, the record of notifications you've had, your appearance and notification settings, whether the app asks for Face ID, and cached copies of what the app shows so it opens quickly. Face ID itself is handled by iOS; we never receive your face data.

What we don't collect

No advertising identifiers, no location, no contacts, no browsing history, and no third-party analytics or tracking tools. If you've chosen to share crash reports and usage data with app developers in your iPhone's settings, Apple may share anonymous crash reports with us.

How we use it

To run the app: showing your redirects, goal, portfolio, deposits and Insights, and keeping them in step across your iPhones.
To send the notifications you've turned on, such as the weekly recap, milestones, reminders and account alerts. These are created on your iPhone.
To send you sign-in and verification codes and password resets by email.
To provide Pro and check your subscription.
To answer support requests and improve the app from feedback.
To keep the service secure and prevent abuse.

We don't use your data for advertising and we don't sell or rent it.

Who helps us run tarpp

We share data only with the service providers that run parts of tarpp for us, and only what each needs:

Supabase hosts our database, sign-in and file storage, in the United States (us-east-1).
Plaid connects your investment accounts, if you choose to. Plaid's handling of your data is described in the Plaid End User Privacy Policy.
Apple provides Sign in with Apple, and App Store payments and subscriptions.
[Email delivery provider, to be confirmed] sends our sign-in, verification and password reset emails.

When the app or extension shows a product picture or a store's page, your iPhone loads it from that store's website, as Safari would.

We may also disclose information if the law requires it, to protect our rights or users' safety, or as part of a merger or sale of the business, in which case this policy would continue to apply to your data.

How long we keep it

Your account data is kept until you delete your account.
A redirect you delete in the app is removed from your iPhones and marked deleted in your account; it's erased for good when you delete your account.
Unlinking an investment account removes its connection at Plaid and deletes its balances, history and deposits from our servers.
Our providers keep server logs for a limited time to operate and secure the service.

Your choices and rights

Export: Settings › Data › Export my data gives you your redirects and deposits as a spreadsheet.
Correct: change your name, photo and goal in the app's Settings.
Unlink: remove a linked investment account in Settings › Linked accounts.
Delete: Settings › Data › Delete account removes your account and everything saved to it, and removes your connections at Plaid. It can't be undone. It doesn't cancel a Pro subscription, which you manage in your Apple Account.
Notifications: turn each kind on or off in Settings › Notifications.

Signing out erases tarpp's data from that iPhone; what's saved to your account comes back when you sign in again. Depending on where you live, you may have other rights, such as to request access to your data. To make a request, email [email protected]. [State-specific and international disclosures, to be added after legal review.]

Security

Data travels encrypted between the app and our servers. Each account can read only its own data, enforced by the database itself, and Plaid access tokens are kept where the app can't reach them. The app can lock with Face ID and hide balances on screen. No system is perfectly secure, but we work to protect your information.

Children

tarpp isn't intended for children, and we don't knowingly collect data from anyone under [age, to be confirmed in legal review]. If you believe a child has given us data, email us and we'll delete it.

This website

This website uses no cookies, analytics or trackers, and has no forms. Our hosting provider may keep standard server logs, such as IP addresses, for a limited time to operate and secure the site.

Changes

If we change this policy, we'll update the date at the top, and for significant changes we'll let you know in the app before they take effect.

Contact

Questions about privacy: [email protected]. [Postal address, to be added.]