Privacy Policy

Last updated: Sep 30, 2026

This Privacy Policy describes how Snapdaisy (“we,” “us,” or “our”) collects, uses, stores, and shares information when you use snapdaisy.com, a goal-based financial planning and portfolio management application (the “Service”).

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy and our Terms of Use.

1. Information We Collect

1.1 Information You Provide to Us

We collect information that you provide directly to us, such as:

  • Account information: name, email address, username, and password. We store your password only as a one-way hash, never in readable form.
  • Passkeys: when you register a passkey for sign-in, we store only its public key. Your fingerprint, face, or device PIN never leaves your device.
  • Planning information: your goals, living expenses, income, tax details (such as filing status), risk preferences, strategies, and related settings.
  • Conversations: the messages you exchange with the Service’s assistant.
  • Communications: messages you send to us (e.g., support requests or feedback).
  • Consents and settings: choices you make about notifications, conversation memory, and account configuration.

1.2 Accounts You Connect Through Plaid

We use Plaid Inc. (“Plaid”) to connect the bank and investment accounts you choose. When you connect an account through Plaid, you give your sign-in details to Plaid or directly to your financial institution, never to us. Plaid then sends us the information you authorized about those accounts, which may include:

  • The institution’s name, and each account’s name, type, and masked account number;
  • Balances;
  • Holdings (e.g., securities, quantities, cost basis, and market values);
  • Investment transactions (e.g., purchases, sales, dividends, and fees) and, where the account supports it, other transaction history.

Accounts connected through Plaid are read-only: the Service cannot move money or place trades in them.

By connecting an account, you grant us and Plaid the right, power, and authority to act on your behalf to access and transmit your personal and financial information from your financial institution. You agree to your personal and financial information being transferred, stored, and processed by Plaid in accordance with the Plaid End User Privacy Policy.

1.3 Information from Linked Brokerages

When you connect a brokerage account directly to the Service for trading, we may receive information from that brokerage (“Brokerage Data”), such as:

  • Account identifiers (e.g., account number or account ID key);
  • Balances (e.g., cash balance, portfolio value);
  • Holdings and positions (e.g., symbols, quantities, cost basis, market values, gains/losses);
  • Order and trade information (e.g., orders submitted through the Service, fills, status, and execution prices);
  • Account status flags (e.g., trading restrictions, fractional trading eligibility) where available.

The specific data we can access depends on the permissions you grant at the brokerage and its APIs.

1.4 Credentials and Security Information

To connect a brokerage directly, you may provide us with API keys, OAuth tokens, or other technical credentials (“Broker Credentials”). When you connect an account through Plaid, we receive an access token from Plaid. We store Broker Credentials and Plaid access tokens in encrypted form and use them solely to:

  • Retrieve account information from the brokerage or from Plaid; and
  • Submit, modify, and cancel trade orders at your direction, for brokerages connected directly for trading.

We do not store your brokerage or bank sign-in password, and we do not take custody of your funds or securities.

1.5 Usage Data

We may collect information about how you access and use the Service, including:

  • Log data (e.g., IP address, browser type, operating system, pages viewed, access times, referring URLs);
  • Interaction data (e.g., feature usage and error reports);
  • Device information (e.g., device type, screen size, approximate location derived from IP address).

1.6 Cookies and Similar Technologies

We use cookies and similar technologies to:

  • Maintain your session and keep you signed in;
  • Protect your requests against forgery;
  • Remember your preferences and settings.

We do not use advertising cookies or third-party analytics. You can usually adjust your browser settings to refuse or limit cookies, but the Service cannot keep you signed in without them.

2. How We Use Your Information

We use the information we collect for the following purposes:

  • To provide and operate the Service: create and manage your account, connect your accounts, display holdings and balances, build and project your plan, process trade requests, and maintain your strategies.
  • To answer your questions: the Service’s assistant uses your planning information and account information to answer what you ask it (see section 4.2).
  • To remember context between conversations: unless you turn conversation memory off, the assistant keeps short notes of facts you have shared, so you do not have to repeat them.
  • To secure the Service: detect, prevent, and respond to fraud, abuse, security incidents, and technical issues.
  • To improve the Service: analyze usage and performance, develop new features, and enhance user experience.
  • To communicate with you: send administrative messages (e.g., account notices, security alerts), respond to your inquiries, and, where permitted, send updates about the Service.
  • To comply with legal obligations: meet applicable legal, regulatory, and compliance requirements, and enforce our Terms of Use.

We do not sell your personal information, and we do not use it for advertising.

3. Legal Bases for Processing (if applicable)

Where required by law (for example, in the European Economic Area or United Kingdom), we rely on one or more of the following legal bases to process your personal data:

  • Performance of a contract: to provide and manage the Service in accordance with our Terms of Use.
  • Legitimate interests: to maintain and improve the Service, secure our systems, and prevent misuse.
  • Consent: where we ask for your consent for specific processing (e.g., connecting an account or optional communications).
  • Legal obligations: to comply with applicable laws and regulations.

4. How We Share Information

We do not sell your personal information. We share information only in the following situations:

4.1 Plaid

Plaid connects your accounts and sends us their information, as described in section 1.2. Plaid’s handling of your information is governed by the Plaid End User Privacy Policy.

4.2 AI Service Providers

The Service’s assistant is powered by large language models from OpenAI and xAI. When you use the assistant, or a feature that relies on it, we send these providers the information needed to answer. That can include your message, your planning information, and information from your connected accounts, such as holdings and balances. It is sent encrypted. Each provider keeps requests and responses for up to 30 days, under its own terms, to monitor for abuse.

To illustrate your goals, the Service may send an image-generation provider (Leonardo.Ai) a short description of a goal’s theme. It does not include information from your connected accounts.

4.3 Other Service Providers

We use Amazon Web Services to host the Service, store its data and backups, and deliver email, and ImprovMX to forward email sent to our addresses. These providers may use your information only as necessary to provide their services to us.

4.4 Linked Brokerages

When you submit or manage trades through the Service, we share only the information necessary to perform those actions with the connected brokerages (e.g., symbols, quantities, order types, and your Broker Credentials for authentication).

4.5 Compliance with Law and Protection of Rights

We may disclose information if we believe in good faith that such disclosure is reasonably necessary to:

  • Comply with any applicable law, regulation, legal process, or governmental request;
  • Enforce our Terms of Use or other agreements;
  • Protect the security or integrity of the Service;
  • Protect our rights, property, or safety, or that of our users or the public.

4.6 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction, subject to confidentiality obligations and applicable law.

5. Data Security

We protect your information with technical and organizational measures, including:

  • Encryption in transit: the Service is available only over encrypted (HTTPS) connections.
  • Encryption at rest: all of the Service’s data, including information from your connected accounts, is stored on encrypted disks, and every backup is encrypted (AES-256).
  • Credentials encrypted again: Broker Credentials and Plaid access tokens are also encrypted individually. The keys are held in a managed key store, separately from the data.
  • Multi-factor sign-in: every account signs in with a passkey.
  • Restricted access: administrative access to production systems is limited to the operator and monitored.

However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your devices and passkeys secure.

6. Data Retention

  • While your account is open, we keep your information for as long as necessary to provide the Service to you.
  • When you remove an account connected through Plaid, we stop retrieving its information. When you remove the last account at an institution, we also revoke our access through Plaid.
  • When you ask us to delete your account, we revoke our access through Plaid, delete your stored credentials, and delete your account and the information associated with it from the Service.
  • Backups are encrypted and kept for up to two years, then deleted automatically. Information deleted from the Service remains in older backups until they expire. Backups are used only to recover the Service from a failure.
  • Conversation memory: turning it off deletes everything the assistant remembered.
  • AI service providers keep requests for up to 30 days (section 4.2).
  • Server logs are kept for a limited period for security and troubleshooting.

We may also retain information where we must do so to comply with legal, regulatory, tax, or accounting obligations, or to resolve disputes and enforce our agreements.

7. Your Rights and Choices

Depending on your jurisdiction, you may have certain rights in relation to your personal information, which may include the right to:

  • Access the personal information we hold about you;
  • Request correction of inaccurate or incomplete information;
  • Request deletion of your personal information, subject to legal obligations;
  • Object to or restrict certain forms of processing;
  • Withdraw consent where processing is based on your consent;
  • Receive your data in a portable format where technically feasible.

You can also act on your own:

  • Remove any account connected through Plaid from your account page;
  • Turn conversation memory off from your profile.

To exercise your rights, including deleting your account, please contact us at info@snapdaisy.com. We respond to every request within 30 days. We may need to verify your identity before responding to certain requests.

8. Where Your Information Is Stored

The Service stores your information in the United States. If you use the Service from elsewhere, your information is transferred to and processed in the United States, which may have different data protection laws from your country. Where required, we take appropriate measures to protect your information in accordance with applicable law.

9. Children’s Privacy

The Service is not directed to children under the age of 18, and we do not knowingly collect personal information from children under 18. If you believe that a child has provided us with personal information, please contact us so that we can take appropriate action.

10. Third-Party Links and Services

The Service may contain links to third-party websites or services that are not owned or controlled by us. This Privacy Policy does not apply to those third parties, and we are not responsible for their content, privacy policies, or practices. We encourage you to review the privacy policies of any third-party sites or services you visit.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice by posting the updated policy on the Service and updating the “Last updated” date at the top of this page, or by other appropriate means. Your continued use of the Service after any changes become effective signifies your acceptance of the updated Privacy Policy.

12. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

info@snapdaisy.com