Privacy Policy

Croft ("the Service", "we", "us") is a personal-finance and debt-elimination tool operated by Blue Quanta LLC. This policy explains what information we collect, why, who we share it with, and the choices you have. We practice data minimization: we collect only what the Service needs to show you your money and project your debt paydown, and we do not sell your data or use your financial data for advertising. The only places we use ad measurement are our public pages (the home page, /links and /payday when you are signed out, and the sign-up quiz at /start) and the moment you create an account — see Ad measurement on our public pages.

Information we collect

Identity (Google Sign-In or an email sign-in code or link)

You can sign in with Google or with a one-time code or link we email you. There is no Croft password. If you sign in with Google, we receive from Google your email address, name, profile image, and whether your email is verified. We do not receive your Google password.

If you sign in by email, we send the code or link to the address you enter through our email provider (Resend). To check it, we store your email address and a hashed copy of the one-time code or token; each expires within 15 minutes and works once. To limit abuse we also keep an hourly count of sign-in emails per address, keyed by a one-way hash of the address rather than the address itself. The same verified email address opens the same Croft account whichever way you sign in.

Financial data you add or link

We store the following in our database to operate the Service:

• Accounts — name, type, balances, interest rate / APR, monthly payment, statement and due dates, and credit limit.
• Transactions — date, amount, the raw bank descriptor, merchant, category, and enrichment data from Plaid (such as merchant logo, website, and location).
• Recurring rules — the income and expense patterns you define to drive projections and budgets.
• Budgets and paydown projections — derived plans and forecasts the Service computes from your rules and balances.
• Ask Croft chat history — your full conversation history with the in-app assistant, so it follows you across devices.

Bank data (via Plaid)

If you link a bank, you do so through Plaid. Your bank login credentials are entered directly into Plaid's secure Link flow and are never seen or stored by Croft. We receive from Plaid your account, balance, transaction, and liability data. The access tokens that let us refresh this data are stored encrypted at rest (AES-256-GCM). We also record each attempt to connect a bank (which bank you picked and where the connection stopped) so we can fix problems; these records are deleted after 13 months. They never include what you type into Plaid.

Messages you send us (contact form)

If you use our contact form, we store the name (if you give one), email address, topic, and message you submit, and — if you are signed in — link it to your account. We use it only to respond to you, and keep it to respond to you and for our records. Each submission is also sent to Blue Quanta LLC by email through our email provider (Resend).

Contact messages are deleted automatically 24 months after we resolve them, and sooner if you ask — send a request through the contact form with the Privacy or data request topic. They are kept even if your account is deleted, unless you ask us to delete them too.

Referrals

You can share your own invite link with friends. A friend who opens it sees your first name only — never your email address or anything about your money. When a friend you invited subscribes, the reward is free months of Croft: their first month is free, and you get a free month too. Croft never contacts anyone for you — you share your own link, however you like. In your invite list you see each friend's first name and where they are (signed up, on a free trial, paid), never their email address.

Sign-up quiz answers and your email address

If you take the quiz at /start, your answers (rough ranges such as a balance range, an interest-rate range, and how often you're paid) are kept in your browser while you answer. Before showing your estimate, the quiz asks where to email it; what you type stays in your browser only until your estimate is shown (or you press "Start over"). When you give an address, we store a quiz lead: your email address, your answers, the estimate we showed you, the ad campaign that brought you (the link's utm_ tags and Meta click id), when you submitted it, and which of the emails below we sent. We use it to email you your estimate, to send the follow-ups described below if you ask for them, and to understand which campaigns work. To limit abuse we also keep a daily count of quiz submissions per address, keyed by a one-way hash of the address rather than the address itself.

• Your estimate by email, once. We email your estimate to the address you gave one time. Taking the quiz again with the same address doesn't send another copy unless the address has been confirmed (next point). Because anyone could type in an address, that one email is all an address gets unless its owner asks for more.
• Follow-ups only if you confirm. The estimate email has a "Continue to Croft" link. If you open it and press "Continue to Croft" on the page it opens, you've confirmed the address is yours, and we may send up to two short follow-ups over the next ten days (a tip, then a note about seeing your real numbers). Then they stop. They also stop as soon as you create an account. That page also has a "Continue without follow-ups" link, and whenever Croft isn't offering its free trial there are no follow-ups at all.
• Unsubscribe anytime. Every one of these emails has an unsubscribe link; one click stops them. So that we don't email that address again, even after its quiz lead is deleted, we then keep only a one-way, keyed hash of the address, never the address itself.
• Kept for 90 days. If you don't create an account, your quiz lead (address, answers, and estimate) is deleted automatically 90 days after you first submitted it, and sooner if you ask through the contact form. If you do create an account, the answers and campaign are saved with your account and deleted with it. (Signing up on a different device carries the stored answers over only if you confirmed the address.)

These emails are sent through our email provider (Resend). Your quiz answers and the email address you type into the quiz are never sent to Meta.

Cookies and your choices

The first time you visit, a small banner at the bottom of the page asks for your choice. Until you choose, and if you choose Essential only, we use only essential cookies: nothing is measured in your browser, no page-version test cookie is set, and no Meta Pixel is loaded. The banner has two equal buttons:

• Essential only — only the cookies Croft needs to work.
• Accept — also analytics (our own first-party counts and page-version tests, described below) and advertising: on our public pages only, we share page-visit data with Meta (Facebook and Instagram) to measure our ads, and tell Meta when you create an account, when a free trial begins and when you first pay for Croft (see Ad measurement).

Whatever you choose, our server keeps an anonymous count of visits to our public pages (the page, the day, and any ad campaign tag in the link), with no cookies and nothing that identifies you or your device, and a count of how many people pick each banner button. When you create an account from an ad campaign link, we record which campaign it was with your account.

The cookies, by category:

• Essential (always on): a single httpOnly session cookie (database-backed sessions via Auth.js) to keep you signed in, short-lived OAuth CSRF/callback and sign-in cookies during the sign-in handshake and two-step sign-in, your light/dark setting, our payment and bank-linking providers (Stripe and Plaid) when you use them, the cookie that remembers your choice (croft_consent, 12 months), and, if you open a friend's referral link, a 30-day cookie that remembers their code until you create your account (__Host-croft_ref).
• Analytics (only after Accept): our own anonymous daily counts of page views and quiz steps, the page-version test cookie (croft_aid), and remembering how you first found us (campaign tags, or that you came from an AI assistant) in your browser and in a short-lived __Host-croft_ft cookie.
• Advertising (only after Accept, and never with Global Privacy Control): the Meta Pixel and Meta's Conversions API on our public pages, the sign-up event when you create an account, and Meta's own cookies (_fbp, _fbc).

Changing your choice: use "Your privacy choices" at the bottom of any public page, or Settings › Privacy & data › Cookie settings when you are signed in. Switching to Essential only stops all measurement from then on; we also delete our page-version test cookie, the stored campaign tags and Meta's _fbp / _fbc cookies from your browser. If your browser sends Global Privacy Control, we treat it as an opt-out of advertising even if you press Accept (analytics then still follows your choice, except page-version tests, which stay off). Inside the Croft iPhone app there is no banner and none of this runs.

Inside the signed-in Service there are no advertising cookies and no Meta Pixel, whatever you choose. The only measurement there is the page-version test cookie described below (after Accept).

While you are signed in, we note each day you use Croft (the date and the first and last time that day, nothing about what you looked at, your IP address or your device) so we can see whether people come back; these records are deleted after 13 months. We also keep a daily record of the figures your Home paycheck plan showed you (such as the safe-to-pay amount and low point) so we can check Croft's own advice if something goes wrong; it is deleted after 13 months or with your account.

Testing page versions

Sometimes we try two versions of a page to see which one helps people more. To keep showing you the same version, we may set one first-party cookie (croft_aid) that holds a random id and lasts up to a year. It is set only after you press Accept on the cookie banner (until then, and with Essential only, you see the standard version), whether or not you are signed in. We use it only to count, in Croft's own database, which version was shown and whether someone went on to finish the quiz, sign up, or link a bank. It is not shared with any third party, it is not sold, and it is not used for advertising.

• Linked to your account: once you sign in — or create an account from a quiz you took, even on another device — the test records from your browser are linked to your account, so you keep seeing the same version and your sign-up is counted toward the right one.
• How long we keep them: records that were never linked to an account are deleted automatically after 13 months (or, if that test is still running then, once it ends), and every record from a test is deleted 13 months after that test ends. Records linked to your account are deleted with your account.
• Opting out: choose Essential only (we then delete the cookie), or send Global Privacy Control; either way we don't set this cookie and you always see the standard version.

Ad measurement on our public pages (Meta)

We advertise on Meta (Facebook and Instagram). Only if you press Accept on the cookie banner (and your browser sends no Global Privacy Control), the public home page (only when you are signed out — signed in, the same address is the app), the /links link-in-bio page (only when you are signed out), the /payday page (only when you are signed out) and the /start quiz — and only those pages, never the app itself or any page that shows your account — load the Meta Pixel, and our server sends matching events through Meta's Conversions API, to measure whether those ads work. Meta may set its own cookies (_fbp, _fbc) on those pages. Before you choose, and with Essential only, the Pixel is not loaded at all and nothing is sent to Meta.

• What is shared with Meta: that you viewed one of those pages; on the quizzes, that you started or finished one (on /payday, finishing means tapping the button to connect your bank); the page address; your IP address and browser user-agent; and Meta's cookie and click identifiers.
• When you create an account: only if you pressed Accept (and your browser sends no Global Privacy Control), our server tells Meta that an account was created, with the page you started from, your browser user-agent and Meta's cookie and click identifiers. It never includes your email address (or a hash of it), your name, your IP address, or anything about your money. No Meta Pixel runs on the sign-in or create-account pages, and nothing is sent for an account created in the Croft iPhone app.
• When a free trial begins or you first pay for Croft: only if you had pressed Accept when you went to checkout (and your browser sent no Global Privacy Control), our server tells Meta that a trial began or that your first payment went through, with the amount, your browser user-agent and Meta's cookie and click identifiers from that checkout. It never includes your email address (or a hash of it), your name, your IP address, or anything about your money. Nothing is sent for later renewals.
• What is never shared with Meta: your quiz answers, the email address you type into the quiz, balances, interest rates, goals, estimates, or any account, transaction, or other financial data.
• Our own anonymous counts (analytics — only after Accept): we also keep a daily tally of how many times the home page, the /links page and the quiz pages were viewed (the home and /links pages only when you are signed out), and how often the quiz was started and finished, grouped by the ad's campaign tags; the /payday page is counted the same way, and so are views of the sign-in and create-account pages and taps on the home page's "Start free" and quiz links and on the /links buttons (those three are never sent to Meta). It is counts only — no IP address, cookie, or anything else that identifies you — and it is kept for about 13 months. To avoid counting the same event twice we keep the random id your browser makes for each event for about two days, then delete it. When an event is also sent to Meta, the same id lets Meta match its two copies; either way we don't connect it to you or to anything else we store. Visitors who pressed Accept and send Global Privacy Control are counted too. No identifier is stored in the counts, and nothing about a visitor who sends Global Privacy Control is shared with Meta.
• How you found us (analytics — only after Accept): your browser remembers the ad campaign tags and the first page of your first visit. When you create an account we save them with it, together with which page you signed up through, so we can see which ads and pages work. To carry them to the sign-in step, the sign-in, create-account and home pages may set a first-party cookie (__Host-croft_ft) that holds only those tags, that first page and time, and Meta's click id if the visit had one, and expires within an hour. We never send it to Meta.
• How to opt out: choose Essential only (or don't choose at all), change your choice any time with "Your privacy choices", or turn on Global Privacy Control in your browser (we then load no pixel and send nothing to Meta, even after Accept), block third-party trackers with your browser or an extension, or adjust your ad settings in your Meta account. Taking the quiz and signing up work the same either way.

How we use your information

• To authenticate you and keep your session secure.
• To display your accounts, balances, and transactions, and to compute budgets, projections, and debt-paydown plans.
• To power the in-app assistant, to categorize your transactions, and to word your Insights card (see below).
• To maintain, debug, and secure the Service.
• To send account and billing notices (for example, when your membership or bank connections change, and a reminder before your free trial's first charge), and — during a free trial — a few short emails about getting started (see Emails we send).
• To send the daily summary and setup reminders, which you can turn off (see Daily emails).
• To email you the estimate you asked for on the sign-up quiz and, if you confirm, up to two follow-ups (see Sign-up quiz answers and your email address).
• Croft uses de-identified transaction patterns, with names and account numbers removed, to improve how it recognizes bills and income. This data is never sold or shared.

We do not sell your personal or financial data, and we do not use your financial data for advertising or for building cross-site profiles. The limited measurement described in Ad measurement on our public pages is the only data that reaches an ad platform.

Emails we send

Account and billing notices — sign-in emails, changes to your plan or access, the reminder before your free trial's first charge, and notices about your bank connections — are part of running the Service and are sent whenever they apply.

If our email provider tells us an address doesn't exist (it bounced) we stop emailing it, except sign-in emails you ask for; if an email is marked as spam we stop the optional emails to that address. To remember this we keep only a one-way, keyed hash of the address, never the address itself.

Free-trial emails are optional: up to two short emails during a free trial (a getting-started note, and a note after your first week that may mention how many recurring items and bank-linked accounts Croft is tracking for you). The reminder before your free trial's first charge is an account and billing notice, so it is sent even if you turn these off. They are sent through our email provider (Resend) and use only data already in your account. Every one has an unsubscribe link; one click stops them. You can also turn them off in Settings, under Email, or ask us through the contact form. Unsubscribing stops only these emails and doesn't affect account and billing notices.

A feedback request is optional too: about a week after you start using Croft, one short email asking how it's going, with a link to a four-question feedback page. It's sent once, and the same unsubscribe link (or the same setting) as the free-trial emails stops it. What you write on that page reaches the Croft team with your account email, and is kept like a message sent through the contact form.

Daily emails — up to three kinds, each on by default:

• A daily summary of what needs your attention that day and what's coming up. It can include your amounts, dates and account names. It's written by Croft's own code, and nothing about it is sent to Anthropic.
• A payday email on the morning a paycheck lands, with your plan for that paycheck. It can include your amounts, dates and debt names, and it's written by Croft's own code too.
• Setup reminders — if part of your setup is unfinished, a short note up to a few times a week suggesting one small next step. They stop when setup is done, or if a while passes without progress.

Each has its own unsubscribe link and its own switch in Settings, under Email, so you can turn off any of them at any time; you can also ask us through the contact form. Turning one off stops only that kind of email, and doesn't affect account, security, or billing emails. They are sent through our email provider (Resend), which receives your email address, first name, and the email's content.

Quiz estimate emails — if you give your address on the /start quiz, one email with your estimate, and (only if you confirm from that email) up to two follow-ups over the next ten days. Each has an unsubscribe link. See Sign-up quiz answers and your email address.

Artificial-intelligence processing (Anthropic / Claude)

Anthropic is "our AI provider" wherever Croft uses that phrase.

There are four paths by which financial data reaches Anthropic:

• In-app assistant (Ask Croft). When you use the assistant, we send the messages you type, any file or photo you attach, and a summary of your accounts — balances, APRs, recurring income and expenses, and paydown projections. When you ask about specific activity, individual transactions are sent on demand.
• Background auto-categorizer. To sort your spending, the Service sends each transaction that your own rules and earlier choices don't already cover — its merchant name, bank descriptor, amount, account type, and your bank's own category for it — together with the names of your categories, to Anthropic. This happens in the background, without a separate prompt from you.
• Setup. When Croft sets up your plan, it looks at up to 12 months of your transactions (your bank may send up to 2 years; Croft keeps them for your plan, and the AI step uses the last 12 months) and sends our AI provider a short summary for each payee: a cleaned payee name, the kind of account (checking or credit card), your bank's category label, the amounts and dates, how often and on which day it recurs, and Croft's own tags (such as a known lender's name), plus, for payments going out, your Croft category and up to two short, cleaned bank descriptions. The summaries never include account numbers or account names; Croft removes the name on your Croft account and the names of people you pay by Zelle, Venmo or Cash App, and for money coming in it sends only standard payroll, benefit and company words from a fixed list, never a bank description or a person's name. The AI only labels what each payee is; every amount comes from your bank records, and nothing the AI finds is added to your plan until you review it and tap Add.
• Insights. To word your Insights card, the Service sends Anthropic the figures Croft has already calculated from your data for that card, with their labels — for example your income, spending by category, account names with their balances, APRs and interest, your projected debt-free date, and the individual charges behind a finding (merchant and rounded amount). Claude only words the card; any number it writes that isn't one of those figures is removed before you see it.

Anthropic processes this data to return a response to the Service. Anthropic's commercial terms don't allow it to train its models on data we send through its API, and Croft hasn't opted in to any program that would. Anthropic's own handling of API data is governed by its policies.

How you agree, and how to turn it off

Nothing is sent to Anthropic until you have agreed. On our website, the screen where you create your account says: "Croft uses our AI provider to sort your transactions and answer your questions. They don't train on your data. You can turn this off any time in Settings." Creating your account there counts as agreeing. If you created your account before that sentence was added, or somewhere it wasn't shown, Croft asks you once: Got it agrees, and Turn off AI says no. If you close the question without choosing, AI stays off and Croft asks again on a later visit. In the iPhone app, Croft asks you to tap Allow first.

You can turn it off, or back on, any time in Settings › Privacy & data › Ask Croft and Insights (AI). While it is off, nothing more is sent to Anthropic: Ask Croft is unavailable, your Insights card uses a plain summary, and transactions are sorted only by your own rules and earlier choices (the rest wait for you). Turning it off doesn't recall data that was already sent.

Who we share data with (subprocessors)

We share data only with the service providers that run the Service. Each receives only what it needs:

We may also disclose information if required by law, to protect our rights or users' safety, or as part of a business transfer (in which case we will give notice as required).

Support access. Croft support may view your account in a read-only mode to help fix problems. Each view is logged, and we never sign in as you. You can turn this off in Settings › Privacy & data › Allow support to view my account. While this is on, support may also fix setup items on your account, like adding a paycheck Croft found but held back. Croft leaves you a note in the app about anything it adds, you can change or remove it, and each fix is logged.

Data retention

We keep your data for as long as your account is active. You can delete your account yourself at any time in Croft: Settings › Privacy & data › Delete my account. You'll confirm with your two-step sign-in and by typing DELETE. When you do, we sign you out on every device, disconnect every bank you linked, cancel any Croft subscription immediately (a charge from the last 7 days, or 14 for a yearly plan, is refunded; older charges aren't), and delete your personal and financial data, usually within minutes. We keep only a one-way, keyed hash of your email address so we never email you again. Stripe keeps its own records of past payments as required for accounting and tax. You can also ask us to delete your account through the contact form. Residual copies may persist briefly in routine backups before they age out. We may retain limited records where required by law. Records of support views and fixes (when they happened, which pages were opened and which fix was made) are kept for 13 months, even if you delete your account.

Contact-form messages are kept to respond to you and for our records, and are deleted automatically 24 months after we resolve them. They are kept even if your account is deleted, unless you ask us to delete them too — we delete them sooner on request.

Quiz leads (the email address, answers, and estimate from the /start quiz) are deleted automatically 90 days after they were first submitted if no account was created from them; if one was, they are deleted with the account. We delete them sooner on request.

Page-version test records (see Testing page versions) are linked to your account once you sign in and are deleted with your account. Records never linked to an account are deleted automatically after 13 months (or, if the test is still running then, once it ends), and all records from a test are deleted 13 months after the test ends. We delete them sooner on request.

How we protect your data

• Plaid access tokens are encrypted at rest using AES-256-GCM.
• Data is transmitted over encrypted connections (HTTPS/TLS) and stored with our infrastructure providers.
• Access is scoped to your own account; the Service is designed so you see only your own data.
• Sign-in is through Google or a one-time code or link we email you — there is no Croft password, and we never handle your bank or Google passwords.

In plain words: How Croft protects your data.

No system is perfectly secure, and we cannot guarantee absolute security. To report a security concern, email security@bluequanta.io.

Your rights and choices

• Access & export. You may request a copy of the data associated with your account.
• Correction. You may ask us to correct inaccurate data we hold about you.
• Deletion. You can delete your account yourself in Settings › Privacy & data › Delete my account, or ask through the contact form (see below).
• Unlink a bank. You may disconnect a linked bank, which stops further data refresh from Plaid.

To make a privacy or data request — access, correction, or deletion of your data — submit it through our contact form and choose the Privacy or data request topic. Depending on your location, you may have additional rights under laws such as the GDPR or CCPA; we will honor applicable rights.

Children's privacy

The Service is not directed to children. It is intended for adults (18+), and in any case is not for use by anyone under 13. We do not knowingly collect data from children. If you believe a child has provided us data,contact us and we will delete it.

Changes to this policy

We may update this policy as the Service evolves. When we do, we will revise the "Last updated" date above, and for material changes we will provide a more prominent notice. Continued use after an update means you accept the revised policy.

Contact

Questions about this policy or your data? Contact Blue Quanta LLC using our contact form.