Privacy Policy

Lava Money is built by LavaMesh LLC ("we," "us," "LavaMesh"). This policy explains what Lava Money collects, how it is used, and, because it is the core design decision behind the app, what stays on your phone and what reaches our servers.

If you only read one section, read "What we store, and where." Most privacy policies describe a company's idea of best practice. This one describes an architecture, so you can check it against the app's own behavior instead of taking it on faith.

On your phone: your accounts, balances, transaction history, investment holdings, budgets, categories, and any manual entries or CSV imports are stored on your phone, in the app's storage, not on a Lava Money server. This is true whether an account is manual, imported, or linked to a real bank.

If you back up your iPhone to iCloud or to a computer, Apple's backup includes the app's data, under your Apple ID. We never receive it.

The app also keeps a few small private values in the iOS Keychain: a random device identifier, a random sign-in secret, and a record of when you agreed to link a bank. They contain no name, email, or financial information. iOS can keep Keychain items after an app is deleted, so that if you reinstall Lava Money, the banks you linked still belong to your phone.

On our servers, only for a linked bank or investment account: if you link a real account (through Plaid, in the mobile app), what reaches our server and is kept there is:

• the random device identifier (no email, password, or account system; this and the secret below are the only "authentication" we use),
• a hash of the phone's sign-in secret (the secret itself never leaves your Keychain),
• your bank's institution name and ID, and the state of the connection (active, needs attention, removed),
• a securely encrypted access token (AES-256-GCM), and, for older app versions, the sync cursor Plaid's API requires between refreshes,
• the version of the agreement you accepted before linking and the time you accepted it, and when the connection was created and last refreshed.

We do not see or store your bank username or password. Only Plaid's screens ever see your bank credentials. Your transactions, balances and holdings are fetched from Plaid through our server and delivered straight to your phone on each refresh. They are never written to our database.

Connecting an investment account (a brokerage, IRA or 401(k)) is a separate link. Plaid shares balances and holdings (which securities you own, how many, and what they are worth) instead of transactions. When you link a bank, Plaid may also return the balances of loan and investment accounts held at that bank. All of it is delivered to your phone the same way, shown only there, and never written to our database. The same small server record described above is all we keep.

Sample data. "Try with sample data" in the app does not connect to any real bank. The accounts and transactions are fictional and are made on your phone.

• Exports. An export (Settings: "Export transactions (CSV)", "Back up everything (JSON)", or sharing a spending review as a PDF) goes where you send it. We do not receive it.
• Crash reports and diagnostics. See "Crash reports" below.
• Feedback email. "Send feedback" in Settings opens your mail app with a message that already lists the app version and build, your phone model, and your iOS version, and nothing about your money. You can edit or delete any of it. It reaches us only if you send it.
• Rating requests. The app counts how many times it has been opened and when it last asked for an App Store rating. These counters stay on your phone. Apple decides whether to show its rating box.
• Face ID or passcode. Before a bank is linked or reconnected, the app asks iOS to confirm it is you with Face ID, a fingerprint, or your passcode. iOS does the check. The app never receives your face or fingerprint data.
• Reminders. The optional weekly review reminder is a notification your phone schedules for itself. It uses no push server and no push token, and it reveals nothing to us.

We don't sell personal data. We don't share your financial data with anyone for advertising or marketing.

Release builds of the app send crash reports and performance timing to Sentry, so a broken screen can be found and fixed. A report contains the app version and build, your phone model and iOS version, the code that was running when something failed, recent events inside the app (such as which screen was open and which of our server addresses the app called, with the result and not the contents), and timing data for about one launch in five. Sentry may add an anonymous identifier that its own software makes for the installation. The app does not attach your accounts, transactions, balances, bank login, connection token, or sign-in secret to a report, and does not give Sentry your name or email. Local development builds do not send reports. The backend that talks to Plaid also reports its own failures to Sentry, as technical details only (which step failed, Plaid's error code and request ID, and the connection's ID).

• Plaid Inc. provides the bank-linking connection for real (non-sample) accounts and, for investment accounts, the balances and holdings. Plaid's own privacy policy governs the data it handles: plaid.com/legal
• Vercel hosts the backend that exchanges Plaid tokens, and this website. It may log standard request data (IP address, request time and address) for security and performance.
• Sentry receives crash reports from release builds of the app and from our backend, as described above.
• Resend sends the two emails of the website's beta sign-up, if you join it. This is a website feature, not part of the app.
• Apple provides the App Store, TestFlight, iCloud backup and the rating box. Apple's own policy covers them.

That is the complete list. We ask each of them to protect your data to at least the standard this policy describes, and we share with them only what is needed to do the job above.

lavamoney.io has one form, the beta sign-up. If you submit your email address we use it to send you a one-time confirmation, your TestFlight invite, and a note when the app is on the App Store. If the link you came from carries a label such as ?from=reddit, we note that label in the message we receive, so we know which post it was; we record nothing else about your visit. We don't sell your address or add it to any other mailing list. The site loads no advertising or analytics scripts, and its fonts are served from the site itself.

• Delete your data on our servers: in Settings, "Remove banks from our server" revokes every linked bank at Plaid and deletes the encrypted tokens and the phone's record on our server (the device identifier, the sign-in secret hash, and the saved agreement). The phone then removes those accounts. Accounts you added by hand stay. You can also email drew@lavamesh.com and we delete the server record within 30 days. If the app has already been reset, deleted or reinstalled, email us with the name of the bank and roughly when you linked it. We have no name or email on file to look you up by, so that is how we find the record.
• Unlink one bank: removing a linked account in the app revokes that connection and deletes its encrypted token.
• Delete the data on your phone: "Reset all data" in Settings clears every account and transaction on the phone. If a bank is linked through Plaid it first removes those banks from our server, as "Remove banks from our server" does, and stops if that fails, so nothing is left on the server that the app can no longer reach. Deleting the app removes the app's storage too, but not the Keychain values described above, and it does not tell our server.
• Export: a full backup (JSON) or your transactions (CSV) at any time from Settings.
• Crash reports: email us to ask for a report to be deleted. Reports do not carry your name, so say roughly when the crash happened and which phone it was.

Transactions, balances, holdings, budgets and categories are stored on your phone and are not written to our database. The encrypted access token, the device identifier, the sign-in secret hash, the bank's name, the connection state and the record of your agreement are kept only while that bank stays linked, and are deleted when you remove it. A bank connection that has not refreshed for 60 days (the app is not opened, or the connection has failed that long) is disconnected automatically: we revoke it at Plaid and delete the token and record, and the data on your phone is not touched. You can link the bank again at any time. Crash reports are kept by Sentry under its retention settings for our project. Questions about the schedule: drew@lavamesh.com.

Lava Money is not directed at children under 13, and we do not knowingly collect data from anyone under 13.

If this policy changes in a way that affects what we collect or how we use it, we'll update the effective date above and, for material changes, say so in the app before the change reaches anyone.

Questions about this policy or your data: drew@lavamesh.com