Privacy Policy

Account information: your name, email, and password (stored hashed by our authentication provider — we never see it in plain text), and an optional profile photo you choose to upload.

State of residence: we ask which U.S. state you live in so we can apply the rules that govern how certain features work in your state. You can set or change it in your Account settings.

Financial information you enter or upload: income, cash flow, savings, debts, goals, planned events, your credit score if you add it, and any statement or screenshot you choose to upload for auto-fill. This powers your scores, routes, simulations, and reports.

Bank-connection data (Premium, optional): if you choose to link an account, our banking partner Plaid retrieves your account balances and transaction history on your behalf, under Plaid's own terms and privacy policy. Transactions are sorted into categories — such as income, bills, and everyday spending — to build your picture. We never see or store your bank login credentials.

Messages you send to Franklin, our AI assistant: your chats are stored so the assistant has context in later sessions, and so we can keep the service safe and help you if you contact support.

Usage and device information collected automatically to operate, secure, and improve the service.

To provide the service: calculate your financial health and routes, personalize your plan, send you messages (including your monthly report), process payments, apply the rules for your state, prevent abuse, and comply with law. We do not use your financial inputs to make decisions for you — you remain the driver.

Franklin (AI): your messages, and the figures from any statement you upload, are sent to our AI provider (Anthropic) only to generate the response or read the numbers you asked us to extract. We do not train our own models on your data.

Human review: a limited number of authorized personnel may review Franklin conversations to keep the service safe, resolve support requests, and improve the product. We restrict this access and log it.

We share data only with the service providers that help us run UrMula — hosting and database (Supabase), email (Resend), payments (Stripe), AI (Anthropic), and bank connections (Plaid, only if you link an account) — under contracts that limit their use of it to running the service for us.

We do not sell your personal information. We do not share it for anyone else's marketing. We do not share it with lenders, card issuers, debt-relief companies, or advertisers. We may disclose information only if required by law, or to protect the rights and safety of our users or the public.

The free tier shows ads. Today those ads are our own in-app promotions, such as an invitation to try Premium. We do not share your personal information with advertisers, and we do not use advertising or cross-site tracking cookies. If we ever introduce third-party advertising, we will update this policy first and explain the choices you will have before it starts.

This section is our privacy notice under the federal Gramm-Leach-Bliley Act (GLBA). We treat the nonpublic personal financial information you share as confidential, and we collect and use it only to provide UrMula to you. We do not disclose it to nonaffiliated third parties except to run the service at your direction — for example, a bank connection you authorize, or the service providers listed above — or as required or permitted by law. Because we do not share your information for marketing, there is no marketing opt-out to make; you can delete your data at any time.

We maintain a written information security program with administrative, technical, and physical safeguards designed to protect your information. Data is encrypted in transit and at rest by our infrastructure providers, access is limited and logged, and row-level security means each user can access only their own records. No system is perfectly secure, so please use a strong, unique password.

Sensitive financial information and your consent. The information you share (such as your income, debts, and, if you link a bank, your account and transaction data) is sensitive. You provide it knowingly and voluntarily, and by entering it or connecting your bank you consent to our processing it to provide UrMula to you. You can withdraw that consent at any time by disconnecting your bank or deleting your data in Settings.

We keep your information while your account is active. When you delete your account, we permanently remove your profile, financial data, goals, snapshots, debts, planned events, and Franklin chat history from our live systems.

If you connected a bank, disconnecting it or deleting your account revokes the connection with Plaid and deletes the stored access token, so no further data is pulled.

Copies may remain in our providers' encrypted backups for a short time until those backups age out on their normal rolling cycle (generally within about 30 days). We may keep limited records longer only where the law requires it or to prevent fraud.

Former customers: if you close your account, we continue to treat any information that survives (for example, in a backup until it ages out, or a record the law requires us to keep) under this same policy — we do not use it or share it for any new purpose.

Wherever you live, you can export a full copy of your data and permanently delete your account at any time from Settings. Depending on your state or country — including under state privacy laws, GDPR, and California's CCPA/CPRA — you may also have rights to access, correct, delete, or port your data, to opt out of the sale or sharing of your information (we do neither), and to appeal a decision we make on a privacy request.

To make a request or an appeal, use the controls in Settings or email privacy@urmula.com. To protect your privacy, we verify that a request comes from the signed-in account it concerns before we act on it.

We honor Global Privacy Control (GPC) browser signals as an opt-out of any sale or sharing of your information. If you believe we have mishandled your data, you may contact us at privacy@urmula.com; you may also contact your state attorney general or data-protection authority.

We use necessary cookies to keep you signed in and operate the service, and first-party analytics to understand and improve usage. We do not use third-party advertising or cross-site tracking cookies. UrMula is not directed to children under 18, and we do not knowingly collect their information. We may update this policy, and we will post material changes here with a new date.