Privacy Policy

Draft pending legal review. This is a draft prepared for review. Final operator details will be inserted and the document reviewed by qualified counsel before it is relied upon as a published policy.

1. Who we are

Lost Money Detective is operated by Gregory Podell, a sole proprietor doing business in California ( lostmoneydetective.com).

Gregory Podell
200 South Refugio Road
Santa Ynez, CA 93460
United States

We are not a bank, a government agency, a consumer reporting agency, or a claims filer. For privacy requests contact privacy@lostmoneydetective.com; for security reports contact security@lostmoneydetective.com.

2. Information we collect

• Account information. The email address you sign in with, and authentication metadata handled by our authentication provider.
• Email content you authorize. When you connect a mailbox, we access message metadata and content in order to identify evidence of refunds, credits, gift cards, rebates, rewards and similar value. Full message bodies are retrieved only for promising candidates and are discarded after analysis; we retain the extracted facts and a short evidence snippet.
• Financial account information you authorize. If you connect an account through Plaid, we receive essential account metadata (institution, account name and type, last four digits) and transaction history (date, amount, description, merchant, category). We do not request account balances, identity, income, assets, liabilities or investment data, and we request no payment product.
• Findings and app data. The items we identify, their status and lifecycle, your preferences, retention setting, notes, and recovery progress.
• Technical and diagnostic data. Log and error information needed to operate, secure and debug the service.

We do not collect your online banking username or password. Those are entered directly with Plaid and your financial institution.

3. How we use information

• To identify value that may be recoverable by you, and to explain the evidence behind each item.
• To reconcile promised or issued value against your transaction history, so we can tell whether money already arrived.
• To show the totals and statuses you have asked us to display.
• To send notifications and reminders you have enabled.
• To operate, secure, support, and improve the service, including debugging and abuse prevention.
• To comply with legal obligations.

We do not use your email content or financial data for advertising, ad targeting, credit decisioning, scoring, or resale, and we do not sell or rent personal information.

4. Legal bases and consent

Connections are voluntary. We access an email account or a financial account only after you affirmatively consent in the app, and we describe what will be accessed and why before the connection starts. You can withdraw consent at any time by disconnecting the source.

5. Sharing and service providers

We share information only with the service providers needed to run the product, and only as necessary:

• Plaid Inc. — financial account connectivity and transaction data. Plaid’s handling of your information is governed by Plaid’s End User Privacy Policy.
• Nylas — email connectivity for supported mail providers.
• Supabase — authentication, database and server infrastructure.
• Email delivery and model providers — used for notifications and for classifying candidate evidence where enabled by the operator.

This list is kept current as the service changes; any additional provider we rely on will be added here.

We may also disclose information if required by law, to protect our rights or the safety of users, or in connection with a corporate transaction, in which case we will provide notice where required.

6. Storage, security and retention

Data is stored in a managed Postgres database protected by row-level security, so records are scoped to your account. Traffic is encrypted in transit using TLS, and our infrastructure providers encrypt data at rest. Provider access tokens are stored server-side and are never exposed to the browser. We make no certification, audit, or “bank-grade security” claims.

Evidence snippets are retained according to the retention setting you choose in the app (30, 90 or 365 days) and can be deleted sooner at your request. When you delete your account data, findings, evidence, imported transactions, scan records and connection records are removed, and routine backups age out on their normal cycle.

7. Your choices and rights

• Disconnect any mailbox or financial account at any time in the Accounts screen.
• Delete stored evidence snippets while keeping the amounts and dates behind a finding.
• Delete all of your data using Delete my data in the app, or by submitting a deletion request.
• Depending on where you live, you may have rights to access, correct, port, or delete personal information, and to appeal a decision. Contact privacy@lostmoneydetective.com and we will respond as required by applicable law.

See the data deletion page for how deletion requests are handled.

8. Children

The service is intended for adults and is not directed to children under 13.

9. Changes to this policy

If we make material changes we will update the effective date above and, where appropriate, notify you in the app.

10. Contact

Email privacy@lostmoneydetective.com.