Privacy Policy

1. Introduction

Welcome to HubbAI ("we," "us," or "our"), accessible at hubbai.app. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our personal financial management platform.

HubbAI is a personal-use application that integrates with financial services and communication tools to provide intelligent financial insights and automated notifications.

2. Information We Collect

Account Information

• Name and email address
• Account credentials (stored securely using bcrypt hashing)
• Phone number (for SMS notifications via Twilio)

Financial Data

• Financial account connections established through Plaid and, optionally, Monarch Money
• Transaction history, account balances, and account metadata (institution name, account type, last four digits)
• Budget and financial goal information
• Spending categories and patterns derived from your transactions

HubbAI never sees or stores your bank username or password. When you link a bank, you enter those credentials directly with Plaid or your bank's OAuth page; HubbAI only receives a Plaid access token that is encrypted at rest.

Usage Data

• Interaction logs with AI-powered features
• Feature usage and preferences
• Device and browser information

3. How We Use Your Information

We use your information to:

• Provide personalized financial insights and analysis
• Send SMS notifications about account activity via Twilio
• Generate AI-powered financial recommendations using OpenAI
• Sync and display your financial data from Monarch Money
• Authenticate your identity and secure your account
• Improve and optimize the platform experience

4. Third-Party Services

HubbAI integrates with the following third-party services:

Plaid

HubbAI uses Plaid Inc. to connect your financial accounts. When you link a bank, you authenticate directly with Plaid or your bank's OAuth flow; HubbAI does not receive, see, or store your bank credentials. Plaid provides HubbAI with an access token and data you authorize — typically account metadata (institution, type, mask), balances, and transactions — which HubbAI uses to power your spending summaries and daily texts. Your use of Plaid is subject to Plaid's End User Privacy Policy. You may revoke Plaid's access at any time from HubbAI's Settings screen or through Plaid's portal; doing so calls Plaid's /item/remove API and deletes the associated tokens and transactions from HubbAI.

Monarch Money (optional)

If you choose to connect Monarch Money, your Monarch credentials are used only to sync your financial data and are handled according to Monarch Money's own privacy policy. You can remove Monarch from HubbAI at any time from Settings.

Twilio

Used for SMS notifications and communication. Your phone number is shared with Twilio solely for delivering notifications you have opted into.

OpenAI

Used for AI-powered financial analysis and natural language processing. Financial data summaries may be sent to OpenAI's API for processing. No personally identifiable information is included in AI prompts beyond what is necessary for the requested analysis.

5. Data Storage and Security

We implement appropriate security measures to protect your information:

• Passwords are hashed using bcrypt before storage
• Authentication is managed through secure JWT tokens
• All data transmission uses TLS/SSL encryption
• Plaid access tokens are encrypted at rest using AES via Fernet (symmetric encryption with HMAC-SHA256 integrity)
• Database access is restricted, monitored, and never exposed to the public internet

Data is stored on secure servers hosted by DigitalOcean. While we strive to protect your personal information, no method of electronic transmission or storage is 100% secure.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. You may request deletion of your account and associated data at any time by contacting us.

7. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Opt out of SMS notifications
• Disconnect third-party service integrations
• Export your data in a portable format

8. Cookies and Tracking

HubbAI uses essential cookies and local storage for authentication (JWT tokens) and user preferences. We do not use third-party tracking cookies or advertising pixels.

9. Children's Privacy

HubbAI is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. Continued use of HubbAI after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at:

hubbai.app