Slowburn Privacy Notice

Effective date: 2026-10-16. Slowburn is operated by Swellborn LLC ("we," "us," or "our").

Slowburn helps you understand your spending, organize your financial accounts, and estimate how your finances could change over time. This notice explains what information we collect through the app and website, why we use it, who can see it, and your choices. “Personal information” means information about you or information that can reasonably be linked to you, such as your email address or bank transactions.

Slowburn is intended for adults aged 18 and older in the United States. We send promotional emails only to people who choose to receive them, and every promotional email includes a way to unsubscribe.

For privacy questions or requests, email privacy@slowburn.money. For product help, email support@slowburn.money. Please do not email bank passwords, sign-in codes, or other secret credentials.

Registered-agent address: Swellborn LLC, c/o Northwest Registered Agent, Inc., 2108 N St, Ste N, Sacramento, CA 95816, United States. Please use the email addresses above for privacy requests and product support.

Information we collect

When you sign in. We use Apple and Google sign-in. We receive the account identifier used to recognize you and, when supplied, your name and email address. Our sign-in service also stores information needed to keep you signed in and protect your account.

When you connect a bank. We use Plaid to connect to financial institutions with your permission. Depending on your bank and connection, we receive account and institution names, account types, balances, and transaction history. Transaction details can include dates, amounts, merchant names and descriptions, bank-assigned categories, who a payment was sent to or received from, how it was made, and merchant locations. Merchant location information comes from transaction records; it is different from tracking your phone's GPS location. We keep an encrypted access token—a digital credential that lets the service continue importing updates. Plaid explains its own handling of information in its End User Privacy Policy.

What you enter and what the app works out. We store accounts and transactions you add manually, your settings, spending categories, corrections, and assumptions you use to explore your finances. We also store estimates of future finances, suggested transaction categories, and the information used to produce those results. For example, the app may put a purchase in “Groceries” and keep a record of how certain it is about that suggestion and any correction you make.

When you subscribe. Slowburn starts with a free week; after that, a subscription keeps it working. You can subscribe on our website, where Stripe runs checkout, or in the App Store, where Apple does. Stripe or Apple collects your payment details, such as your card, Apple Pay or Link details, and billing address. We do not receive or store your full card number. To fill in checkout for you, we give Stripe an identifier for your Slowburn account and your email address, unless it is a private Apple relay address. An App Store purchase carries the same account identifier, so the purchase unlocks your account. From Stripe and Apple we receive your plan, subscription status, free-week and renewal dates, cancellation date, the reason you picked when canceling if you picked one, and identifiers for your subscription and customer record. When you agree to automatic renewal at checkout on our website, we keep a record of that agreement: the plan, price, free-week length, the wording you agreed to, and when.

When you use an invite code. If you redeem an invite code for free access, we record the code, when you redeemed it, which account redeemed it, and when the free access ends. We keep a short note with each code we create, such as who we gave it to.

When you refer a friend or join with a referral code. Each account has a referral code and link to share; we keep your code and when it was created. If you join with someone's code, we record whose code you used, when you joined, and a shortened form of your email address that the person who referred you sees (described below). When you pay on our website, we record the Stripe charge ID and date of your first payment, when both free months are due, and whether each month was given, saved for later, or not given because the payment was refunded, disputed, or made with the referrer's card. To check the card, we compare the identifiers Stripe uses for the card you paid with and the cards saved to the referrer's account, without seeing either card's number, and keep only the result. A free month moves the next charge on each Stripe subscription a month later, and both subscriptions carry a random marker for the referral so a month is never added twice.

How you use the app. After you agree to this notice, the app records how it is used: which screens you open and how long you stay on each, how long each setup step takes, how you signed in, when you view the subscription screen, choose a plan or start checkout, which features you use (for example, changing a transaction's category or creating a category), and error codes the app shows you. When you connect a bank, it records the institution's name, whether the connection worked, the reason it stopped if it did not, and how long it took. Each record includes the time, the app and iOS versions, and a random identifier created when the app was installed. We also record when a free week, a subscription or a cancellation starts, and how long your first import of bank history took. These records are linked to your account. They do not include amounts, balances, merchant names, or text you type.

When you contact us. We receive your email address, messages, and attachments you choose to send to our support or privacy inboxes.

When you report a problem in the app. We receive what you write and any screenshots you include. Shaking your iPhone attaches a picture of the screen you were on, which can show balances and transactions; you can remove it or draw over it before sending. We also receive the app and iOS versions, your iPhone model, the screen you were on, your time zone, recent error codes the app showed you, and the status of your bank connections at that moment. Reports are linked to your account. We email the report to our support inbox and a copy to you.

Information needed to run the service. Slowburn and its providers process technical information such as IP addresses, device or browser information, sign-in activity, and records of requests and errors. Our application records include identifiers used to trace requests, whether a task succeeded or failed, and how long it took. This information helps us operate the service, protect accounts, and investigate problems.

How we use information

We use information to recognize your account, keep your information separate from other users' accounts, import and display bank records, organize purchases into categories, calculate estimates, and keep your devices up to date. We also use it to answer requests, investigate errors or security problems, and improve the app.

Subscriptions and invite codes. We use subscription and invite-code records to give you access, show your plan and its dates, offer the free week once per account, keep accurate payment and tax records, and keep a record of your agreement to automatic renewal, as California law requires.

Referrals. We use referral records to give both people their free month, show you the friends who joined with your code and where each stands, and keep people from referring themselves.

Problem reports. We use them to find and fix problems and to reply to you by email.

App usage records. We use these records to see where people get stuck or run into errors, how long setup takes, which features people use, and how many people start the free week and subscribe, so we can improve the app. Our internal dashboard shows them mostly as totals. Where it lists individual accounts, it shows a code in place of the account and a partly hidden email address, such as k•••@gmail.com.

People may review your app information. The people operating Slowburn may look at stored account details, transactions, categories, financial estimates, and other app information to answer support requests, find bugs, and improve the experience. We may do this even when you have not contacted support. Replacing your name with a user number does not make the information anonymous: purchases and other financial details may still identify you or reveal personal information.

Viewing the app as you see it. To find problems, our team can open a read-only view of your app as you see it: your burn rate, spending categories, transactions, accounts, balances, and net worth. In that view, your account is shown as a code, people's names in transfers and payment-app transactions are shortened to initials, the employer and landlord in paycheck and rent transactions are hidden, and account numbers, your name, and your email address are not shown. Each view requires a fresh second sign-in step by an authorized team member, ends after 30 minutes, cannot change your information, and is recorded.

AI helps organize transactions. We use AI service providers to suggest spending categories and transaction types. Information sent for this purpose can include merchant names and descriptions, amounts, dates, bank categories, transaction details, account names and types, institution names, your category descriptions, and relevant earlier transactions and corrections. Details of individual purchased items may be included when available. This helps the service understand a purchase in the context of your categories and past choices. These details may identify you even when your name is not included.

AI helps you set up categories. When you create a category, we send the name as you type it to an AI service provider to suggest an emoji for it. If you choose Create description, we send the new category's name, emoji, and bucket, together with the names and descriptions of your other categories, to a larger AI model that writes a suggested description. You can edit or remove the suggestion before saving. These requests do not include your transactions.

AI keeps your category instructions clear. When you correct a transaction's category, we use a larger AI model to update the instructions for sorting transactions into your spending categories, so similar purchases land where you want them. It receives your category descriptions, corrections, and relevant transaction details from the information described above. Using those details to improve the instructions for your categories is different from allowing an AI provider to use them to train its models.

AI suggestions and financial estimates can be wrong. You can adjust supported categories and assumptions in the app. Estimates depend on the information available and the assumptions used; they are not guarantees of what you can afford or what will happen.

Who receives information

We do not sell your personal information or share it for targeted advertising. We do not send app usage records to analytics or advertising companies; they are stored with the rest of your Slowburn information. We do share information with providers that help operate Slowburn, as explained here.

We use Plaid for bank connections and Apple and Google for their respective sign-in services. Stripe processes subscriptions bought on our website, and Apple processes subscriptions bought in the App Store. Each uses payment information to complete purchases, prevent fraud, and meet financial regulations, as explained in the Stripe Privacy Policy and Apple Privacy Policy. If you save payment details with Link, Stripe handles them under its Link terms. Other providers help us host the app and website, store and back up records, manage sign-in, process information with AI, deliver website resources, send emails, and handle support and privacy inboxes. Each receives information needed for its role; they do not all receive the same information.

The person who referred you. If you join with someone's code, they see you in their Invite friends list as the first letter and domain of your email address, such as k•••@gmail.com. If you signed in with a private Apple relay address, they see only “A friend.” They also see where you stand: trying Slowburn free, stopped without subscribing, paid and the date of your first payment, earned the free month and when, or no month because the payment was refunded, disputed, or made with their card. They do not see your name, your full email address, your plan, what you paid, or any of your financial information.

TypeSafe (Jev). We send information directly to TypeSafe to suggest transaction categories and, when you create a category, an emoji for its name. TypeSafe states in its privacy policy that it does not train or fine-tune AI models on the information sent to it. Its published terms allow information to be kept for service delivery and other permitted purposes, including security and legal requirements, rather than specifying a fixed number of days. Its terms also allow backup copies to remain. We do not have a verified zero-retention arrangement with TypeSafe and do not promise immediate deletion of its copies.

OpenRouter Auto. For the larger-model features described above, we use OpenRouter's automatic model selection. OpenRouter receives the request and passes it to a company running the selected model; both process the information. The model and the company running it can change between requests. Our existing request configuration requires OpenRouter to select services whose policies exclude training on request information and provide zero data retention for those requests. In the account reviewed for this feature, optional storage of prompts and responses, sharing them for OpenRouter's own use, and routing to endpoints that permit training are turned off.

OpenRouter's zero-retention rules permit temporary processing in memory, including short-lived caches. Its data-collection documentation also explains separate optional storage of request contents and collection of usage records, such as token counts and response times. Zero retention for AI requests therefore does not mean that every kind of technical or billing record is erased. Deleting information from Slowburn does not necessarily erase copies already processed by an AI provider.

We may disclose information when required by law, to respond to lawful requests from authorities, or when reasonably necessary to investigate fraud, abuse, security incidents, or legal claims and protect people's rights or safety.

If Slowburn is involved in a merger, acquisition, or sale of the business or its assets, customer information may be reviewed or transferred as part of that transaction. Any such handling remains subject to applicable privacy requirements, and we will provide notice of changes to how the information is handled when required.

Slowburn and its providers may process information in locations outside your state or country. Privacy laws can differ between locations. Any legally required protections for these transfers must still apply.

Website resources and tracking

Our website loads resources, such as fonts and software libraries, from outside delivery services. Loading them sends information such as your IP address and browser request details to those services. The example spending animation on the website uses made-up examples, not customers' bank records.

The website also uses Cloudflare Web Analytics to measure visits and loading performance. This involves technical information about page visits and browser performance. Cloudflare states that this analytics service does not track individual visitors across customers' websites. Website delivery and security services separately process network information, including IP addresses.

We do not currently use an advertising or remarketing service on the website. The website does not currently change its behavior in response to a browser's “Do Not Track” setting. The font service states that it does not use these requests to build visitor profiles or target ads, and the software-delivery service states that it does not track individual users. Those statements do not mean that outside services receive no information: they still process requests to deliver resources, measure service performance, and protect their services. See Google Fonts' privacy explanation, jsDelivr's privacy policy, and Cloudflare's analytics explanation.

Links to other websites lead to services with their own privacy notices. Review those notices when you choose to use those services.

How we protect information and who can read it

We encrypt information sent between the app and our servers, and our hosted database uses encryption for stored information. We use sign-in checks and account access controls. The credentials used for Plaid connections have an additional layer of encryption. The iPhone app stores some information locally so it can display your data and save changes awaiting upload; that local copy uses iOS file protection.

Encryption does not mean that only you can read the information. Our systems need to read it to provide the app's features. Authorized providers and the people operating Slowburn can also read information for the purposes described in this notice, including support, debugging, and product improvement. This is not end-to-end encryption that keeps information readable only by you. No system can guarantee complete security.

Your choices and requests

Your permission for financial-data processing. Before you add financial information, we explain how Slowburn collects, stores, and processes it and ask you to choose Agree and continue. This includes the service-provider processing, AI categorization, app usage records, and authorized human review described in this notice. Signing in or opening the notice does not make this choice for you. We keep a record of the notice version, its content fingerprint, your account, and when you agreed. You can cancel without agreeing and still sign out or delete your account. Connecting a bank also requires separate authorization through Plaid.

Reviewing and correcting information. You can change supported entries, categories, and assumptions in the app. For help accessing, correcting, or getting a copy of information associated with your account, email privacy@slowburn.money.

Canceling a subscription. You can cancel a website subscription in Profile → Subscription, and an App Store subscription in your iPhone's Settings under your Apple Account's subscriptions. Canceling stops future charges; Slowburn keeps working until the end of the period you paid for.

Disconnecting a bank. Disconnecting stops future imports through that connection. It does not delete transactions already imported into Slowburn. Clearing category suggestions, restarting onboarding, and uninstalling the app are also different from deleting your account.

Deleting your account. In the app, open Profile → Delete account and complete the identity check and confirmation. Deleting your account cancels a website subscription. It does not cancel an App Store subscription, which Apple manages; cancel that in your iPhone's Settings. Once the necessary cleanup finishes, your account and financial information are removed from active systems, subject to the limited records and backup copies described below. This does not close your bank accounts or delete your Apple or Google account. You can also email us for help with deletion.

If you used Sign in with Apple, account deletion also revokes Apple’s authorization when Slowburn has the credentials needed to do so. For some older sign-ins, we may ask you to remove Slowburn from your Apple Account’s Sign in with Apple settings separately. That extra step is not required to delete your Slowburn information.

How we handle requests. We may need to verify your identity before giving access to information or making changes. We will not ask you to email bank passwords, sign-in codes, or access tokens. If we cannot provide, change, or delete something, we will explain the reason, subject to any legal restrictions. We will handle requests within the deadlines required by applicable law.

Rights under privacy laws. Depending on where you live and which laws apply, you may have rights to know how your information is used, access or obtain a copy of it, correct it, delete it, or limit certain uses or disclosures. Where applicable, you may use an authorized representative to make a request, and we will verify their authority as required. We will not discriminate against you for exercising rights protected by applicable privacy law. Contact privacy@slowburn.money to make a request or ask about your rights.

Appealing a decision. If we decline a privacy request, you can ask us to reconsider by emailing privacy@slowburn.money with the subject “Privacy request appeal.” Identify your original request and explain what you would like us to reconsider; do not send secret credentials. We will review the decision, explain the outcome, and meet any applicable response deadline. Where applicable, if we deny your appeal we will explain how to contact the relevant privacy regulator or state attorney general.

How long we keep information

Your account and financial history. We keep your account information, imported history, entries, categories, and related results while your account remains active so that its history and features continue to work. Disconnecting a bank or stopping use of the app does not by itself delete that history. Account deletion starts the cleanup described above.

Subscription records. While your account exists, our database keeps your subscription's status, dates, and identifiers. Account deletion cancels a website subscription and then removes these records from our database, except the record of your agreement to automatic renewal. That record keeps only the plan, price, free-week length, the wording you agreed to, when you agreed, and Stripe's identifiers for your subscription and customer record; it no longer names your Slowburn account. We delete it automatically three years after you agreed or one year after the subscription ended, whichever is later. Stripe and Apple keep their own payment records. Our Stripe account also keeps customer, invoice, and payment records, including your email address, for as long as needed for tax, accounting, fraud-prevention, and other legal obligations.

Invite codes. We keep each code, its note, and when it was used. When you delete your account, we remove the link between the code and your account.

Referrals. We keep your referral code and the referrals you're part of while your account exists. Deleting your account removes your code and every referral you're part of, whether you referred someone or joined with their code, so you also disappear from the other person's Invite friends list. A free month already added to a subscription stays on it. If the person who referred you hasn't received their free month yet, we keep only that month for them, with who it's for, when it was earned and the referral's random marker, until it's added or they delete their account.

App usage records and views by our team. App usage records are deleted automatically 13 months after we receive them. The record of each time our team viewed your app is deleted 13 months after that view. Account deletion removes all of them sooner.

Temporary bank-connection records. Routine records of a bank-connection attempt become eligible for automatic cleanup 30 days after they expire. Unfinished or uncertain attempts stay longer while we resolve their status. These temporary records are different from your connected accounts and imported transaction history.

Database backups. The current database plan keeps daily backups in a rolling seven-day window. Removing information from the active database does not immediately remove it from those backups. This seven-day window does not describe every provider's logs, other records, or copies on your devices.

Records that keep deleted accounts from returning. We keep limited records of account deletion so that restoring an older backup does not restore a deleted account's access. These records contain account and request identifiers, dates, and cleanup status, rather than your bank transactions or bank-access credentials. Their separate encrypted recovery copies are kept for at least 90 days under the current storage setting and are not automatically erased on day 90. We retain these protective records while backups, old sign-ins, or pending activity could otherwise restore deleted access or information. Safe removal of these records still needs to be implemented; we do not currently promise a fixed deletion date for them.

Support messages and privacy requests. We review these records monthly. Our schedule is to delete routine support messages within 30 days after 12 months have passed since the issue was resolved or the last substantive support exchange, whichever is later. We keep a minimal record of a completed privacy request for 24 months, then delete it within 30 days. This record describes the request and our response, rather than keeping a full copy of your financial information. This review is manual; the mailbox does not automatically expire messages. The exceptions below may require us to keep particular records longer.

Problem reports. We keep problem reports in our database while your account exists, and deleting your account removes them. The emailed copies in our support inbox follow the schedule for support messages above.

Technical records and exceptions. We keep technical records to operate and protect the service. Our target for routine operational logs under our control is no more than 30 days where configurable; provider-owned logs have separate retention arrangements. Limited records may be kept longer for a documented legal obligation, security investigation, or dispute. We do not promise that account deletion immediately erases every email, log, or provider copy.

Copies on devices or outside the service. An offline device cannot immediately receive a deletion or other change made elsewhere. Copies you export or keep outside Slowburn remain under your control.

Children

Slowburn is intended for adults aged 18 and older. If you believe a child has provided information to us, please contact privacy@slowburn.money so we can investigate and take appropriate steps to remove it. We do not knowingly collect personal information from children under 18.

Changes to this notice

We will post updated versions when our practices change. For material changes, we will provide a prominent notice in the app or on the website, or notify you by email, as appropriate and as required by law. Each published version will state when it takes effect. Where a change requires your consent, we will ask for it before applying that change.

For questions about this notice or to make a privacy request, email privacy@slowburn.money.