Privacy policy

Truenote is made by Zachery Gentry LLC (“we”), Austin, Texas. This policy covers the app at app.usetruenote.com and this site. Plain words, because you should be able to read it.

What we collect

• Your account: email address, a name if you give one, passkeys (public keys only), sessions.
• Bank data, through Plaid: accounts, balances, transactions, holdings, liabilities and recurring payments from the institutions you connect. We never see your bank login; you enter it inside Plaid Link. We receive a read-only access token, which we seal with AES-256-GCM before storing. We never store card numbers.
• What you add: your household profile, businesses, income sources, the spending plan, buckets, goals, notes, plans, rules, and documents you upload (paystubs, tax forms, statements), sealed the same way as tokens.
• What your agents do: an audit log of every tool call and API request made with a grant you issued (which agent, what it asked, how many rows, when), and the agents’ names and metadata.
• Technical data: request logs (method, path, status, a request id), IP addresses for rate limits and the audit log, error reports (Sentry) scrubbed of tokens, bodies, cookies and bank text. On this site, cookie-free analytics (Cloudflare Web Analytics): pages and countries, no identifiers.
• Billing: handled by Stripe. We store your Stripe customer id and subscription state, never your card.

Why

To run the service you asked for: sync your accounts, keep your context, answer your agents within the grants you set, bill you, sign you in, keep the service secure, and fix what breaks. We don’t profile you, sell data, or use your data to train anything.

AI providers

Truenote does not send your data to any AI provider. When you connect Claude, ChatGPT or another agent, that agent reads from Truenote with a grant you approved, under the provider’s own terms. You can see every call it made and revoke it at any time.

Who else touches it

• Plaid (bank connections): plaid.com/legal.
• Railway (hosting and the database, encrypted at rest).
• Resend (sign-in emails).
• Stripe (billing).
• Sentry (error reports, scrubbed).
• Cloudflare (this site, DNS, analytics).

Each is a processor acting on our instructions. We don’t share data with anyone else, except as required by law, and we would tell you if we could.

How long

For as long as your account is open. Delete the account (Settings → Delete account) and every bank is removed at Plaid, every agent’s access is revoked, and everything you own is deleted, sessions and passkeys included. A lapsed subscription keeps your data 30 days (export still works), then deletes it. Database backups keep their copies for 6 to 89 days after a deletion, then age out. Rate-limit counters live a day.

Your rights

Export everything any time (Settings → Your data, as JSON or CSV). Correct anything by editing it. Delete everything yourself. Ask us anything at hello@usetruenote.com; we answer within a few days. California and other residents with statutory rights can exercise them the same way.

Cookies

The app sets one session cookie (httpOnly, SameSite, Secure) so you stay signed in, and remembers your theme on your device. This site sets no cookies.

Children

Truenote is for adults (18 and over).

Changes

We’ll post changes here with the date above, and email you about anything material.