KeepsheetPrivacy Policy
Keepsheet is operated by [legal entity name] ("Keepsheet", "we"). This policy explains what Keepsheet collects, why, and what you can do about it. Questions: [contact email].
What we collect
- Account details: your email address and a password. We store only a salted scrypt hash of the password, never the password itself.
- Financial data you choose to add: transactions from bank, card and order CSV files you upload, and, if you connect a bank, account names, the last digits of account numbers, balances and transactions supplied by Plaid.
- Categories and rules you set, so Keepsheet can remember how to sort your transactions.
- Cookies: a session cookie that keeps you logged in and a short-lived security cookie that protects the login and signup forms. No advertising or analytics cookies.
Bank connections through Plaid
When you connect a bank, you sign in on your bank's own screen inside Plaid's window. Keepsheet never sees or stores your bank username or password. Plaid gives Keepsheet a read-only access token that lets us fetch your transactions and account balances. We can't move money. Your use of Plaid is also covered by the Plaid End User Privacy Policy.
The connect page loads Plaid's Link script from Plaid's servers (cdn.plaid.com). It's the only third-party script Keepsheet uses, and it's loaded only on that page.
How we use it
Only to run Keepsheet for you: showing your dashboard, categorizing transactions, building reports, and keeping a connected bank in sync (when you connect, when your bank tells us there's new data, and about every 6 hours). We don't sell your data, share it with advertisers, or use it to train AI models.
Where it's stored and how it's protected
- Data is stored on servers run by our hosting provider, Render, in the United States, and sent over HTTPS.
- Each account's financial data is kept in its own separate database file.
- Bank access tokens are encrypted with AES-256-GCM before they're saved. The key is kept separately from the data.
- No system is perfectly secure. If we learn of a breach that affects your data, we'll tell you.
Who else sees it
Service providers that run Keepsheet: Render (hosting) and Plaid (bank connections, only if you connect a bank). We'll disclose data if the law requires it. Nobody else.
Your choices
- Disconnect a bank anytime in Settings. We tell Plaid to revoke access and delete the stored token. You can also delete the transactions it imported.
- Delete your data or your account in Settings. Deleting your account removes your login, your financial data file and any bank tokens. Server backups may keep copies for up to [N] days.
- Export your transactions and reports as CSV at any time.
Children
Keepsheet isn't meant for anyone under 18.
Changes
If we change this policy in a meaningful way, we'll post the new version on this page.