Privacy Policy

Draft pending legal review. This is a product-specific draft prepared for review. It should be reviewed by qualified counsel before it is relied upon as a final published policy.

1. Who we are

Lost Money Detective is operated by Lost Money Detective, LLC, PLACEHOLDER — registered business address pending. Questions about this policy can be sent to our privacy contact, which is launching shortly. We are not a bank, a government agency, a consumer reporting agency, or a claims filer.

2. Information we collect

• Account information. The email address you sign in with, and authentication metadata handled by our authentication provider.
• Email content you authorize. When you connect a mailbox, we access message metadata and content in order to identify evidence of refunds, credits, gift cards, rebates, rewards and similar value. Full message bodies are retrieved only for promising candidates and are discarded after analysis; we retain the extracted facts and a short evidence snippet.
• Financial account information you authorize. If you connect an account through Plaid, we receive account basics (institution, account name and type, last four digits), balances, and transaction history (date, amount, description, merchant, category).
• Findings and app data. The items we identify, their status and lifecycle, your preferences, retention setting, notes, and recovery progress.
• Technical and diagnostic data. Log and error information needed to operate, secure and debug the service.

We do not collect your online banking username or password. Those are entered directly with Plaid and your financial institution.

3. How we use information

• To identify value that may be recoverable by you, and to explain the evidence behind each item.
• To reconcile promised or issued value against your transaction history, so we can tell whether money already arrived.
• To show account balances and totals you have asked us to display.
• To send notifications and reminders you have enabled.
• To operate, secure, support, and improve the service, including debugging and abuse prevention.
• To comply with legal obligations.

We do not use your email content or financial data for advertising, ad targeting, credit decisioning, scoring, or resale, and we do not sell or rent personal information.

4. Legal bases and consent

Connections are voluntary. We access an email account or a financial account only after you affirmatively consent in the app, and we describe what will be accessed and why before the connection starts. You can withdraw consent at any time by disconnecting the source.

5. Sharing and service providers

We share information only with the service providers needed to run the product, and only as necessary:

• Plaid Inc. — financial account connectivity and transaction data. Plaid’s handling of your information is governed by Plaid’s End User Privacy Policy.
• Nylas — email connectivity for supported mail providers.
• Supabase — authentication, database and server infrastructure.
• Email delivery and model providers — used for notifications and for classifying candidate evidence where enabled by the operator.

Owner confirmation needed: the definitive subprocessor list, including any analytics or hosting vendors, should be finalized and published here.

We may also disclose information if required by law, to protect our rights or the safety of users, or in connection with a corporate transaction, in which case we will provide notice where required.

6. Storage, security and retention

Data is stored in a managed Postgres database protected by row-level security, so records are scoped to your account. Traffic is encrypted in transit using TLS, and our infrastructure providers encrypt data at rest. Provider access tokens are stored server-side and are never exposed to the browser. We make no certification, audit, or “bank-grade security” claims.

Evidence snippets are retained according to the retention setting you choose in the app (30, 90 or 365 days) and can be deleted sooner at your request. Owner confirmation needed: the retention period for account records after an account is closed should be stated here.

7. Your choices and rights

• Disconnect any mailbox or financial account at any time in the Accounts screen.
• Delete stored evidence snippets while keeping the amounts and dates behind a finding.
• Delete all of your data using Delete my data in the app, or by submitting a deletion request.
• Depending on where you live, you may have rights to access, correct, port, or delete personal information, and to appeal a decision. Our published privacy contact is launching shortly; until then, Delete my data in the app performs a complete, immediate deletion without contacting us.

See the data deletion page for how deletion requests are handled.

8. Children

The service is intended for adults and is not directed to children under 13.

9. Changes to this policy

If we make material changes we will update the effective date above and, where appropriate, notify you in the app.

10. Contact

Lost Money Detective, LLC, PLACEHOLDER — registered business address pending. A published privacy email address is launching shortly and will appear here once it is verified as monitored.