Privacy Policy

1.1 Miva is a budgeting application operated by Elbadri Innovations LLC (the “Company”, “we”, “us”).

1.2 Questions about this policy may be sent to muhammadmelbadri@gmail.com.

2.1 Account information: your email address. If you set a password, it is stored in hashed form by our sign-in provider and cannot be read by us.

2.2 Bank information, if you connect a bank through Plaid or SimpleFIN Bridge: account names and types, the last digits of each account number, balances, posted transactions, and for credit cards and loans the interest rate, minimum payment and due date. The connection is read-only.

2.3 Information you enter, including budgets, categories, goals, pay schedule, debts and notes.

2.4 What you tell us when you join (the bank you use most and your main goal), and survey answers you give at your first sign-in, on the waitlist, and approximately one month after joining.

2.5 Usage information: sign-ins, pages opened and time spent on them, and use of features such as Refresh. We do not record the content of the pages you view.

2.6 Feedback you send, including any image you attach. Images captured by the application hide all amounts before they are saved.

2.7 The date on which you agreed to the Terms and this Privacy Policy, and the versions you agreed to.

2.8 If you choose a paid plan: your plan, its renewal date and whether a payment failed. Your card and billing address are entered on Stripe’s page and held by Stripe; we never see or store your card number.

2.9 If you forward your bank’s alert emails to your private Miva address: the transactions we read from them, and when each alert arrived. The email itself is encrypted until it has been read, then deleted, and never kept more than three days. Email from any other sender is not kept.

2.10 A cookie that keeps you signed in. We do not use advertising or tracking cookies.

3.1 We do not collect bank passwords, Social Security numbers, full account or card numbers, location or contacts. The application contains no advertising and no third-party tracking.

4.1 To calculate and display your balances, safe-to-spend amount, budgets and debt plan.

4.2 To suggest a category for new transactions. Merchant names, and the names of your categories, are sent to an artificial intelligence provider for this purpose. Amounts, account numbers and sign-in details are not sent.

4.3 To improve the application, using usage counts, feedback and survey answers.

4.4 To send email you need for your account: sign-in codes and invitations, and notices about your account — the link to finish setting up when you ask for it, a bank connection that needs you to sign in again, reminders before your free trial ends, and a note when something you were waiting for is ready, such as a place in the beta. We do not send marketing email.

5.1 Your financial information is visible only to you. Our administrative view shows usage, survey answers and feedback. It does not show balances, transactions or bills.

5.2 Service providers process information only to operate the application: Supabase (database and sign-in), Vercel (hosting), Cloudflare (receives the bank alert emails you forward to your Miva address and passes them to us), Plaid or SimpleFIN Bridge (the bank connection you choose), Anthropic (category suggestions: merchant names and your category names), Resend (email) and Stripe (payment for a paid plan). They may not use the information for their own purposes.

5.3 If you connect a bank through Plaid, Plaid’s End User Privacy Policy (plaid.com/legal) also applies to the information Plaid collects.

5.4 We do not sell information, share it for advertising, or disclose it to others except where the law requires.

6.1 Information is transmitted over encrypted connections.

6.2 Bank connection credentials are encrypted before storage and decrypted only to retrieve your bank information.

6.3 Each user’s information is separated in the database, and automated tests confirm that no user can read another user’s information.

6.4 You can add an authenticator code to every sign-in in Account, Security. Before a bank is connected through Plaid, you are asked for a code sent to your email or from your authenticator.

7.1 We retain your information while you have an account.

7.2 Disconnecting a bank deletes its stored credential immediately. Transactions already received remain in your account until you delete it.

7.3 You can delete your account in Account, Delete my account. Your bank connections are removed and your information is deleted immediately. Our database provider keeps daily backups for 7 days, after which copies in backups are also deleted. All of your information is removed within 30 days. If you had a paid plan, your customer record at Stripe, which holds your email address, is deleted at the same time; Stripe keeps its own record of past payments where the law requires it.

7.4 If you join while sign-ups are full, we keep your email address, bank and goal until we let you in or you ask us to remove them. Waitlist answers given before you join are retained until the beta ends or until you ask us to remove them.

8.1 You can view and change the information you entered, disconnect a bank and delete your account at any time. To request a copy of your information, write to muhammadmelbadri@gmail.com.

9.1 Miva is intended for adults. We do not knowingly allow anyone under 18 to create an account.

10.1 We will notify you in the application or by email before a material change to this policy takes effect.