Privacy policy

Contha is operated by OWSH Unlimited LLC, a New York limited liability company (“Contha”, “we”). This policy says what we collect when you use contha.com and app.contha.com, why, who else touches it, how long we keep it, and what you can do about it. It is written to be read. If a sentence here and a sentence in a law disagree, the law wins.

The short version

• We read your financial accounts through a read-only connection so we can do arithmetic on them. We cannot hold, freeze or close money, and Contha never moves it on its own.
• We do not sell your data, share it with advertisers, or use it to train anything.
• You can export everything as one file at any time, and delete the account with everything in it.
• The people who can see your books are you, anyone you invite to your household, anyone you hand a read-only link to, and the small number of services below that store or carry the data for us.

What we collect

Account. Your email address and a password hash. If you sign in from a link we emailed, the code in that link. If you sign in with Google, the name, email address and profile picture Google shares for that purpose; we use them only to create and identify your account, never for advertising, and we do not share them.

Financial data you connect. When you link a bank, card, brokerage or loan account through Plaid, we receive the account name and masked number, balances, transactions (date, amount, merchant, description, pending status), and for investment accounts, holdings. We store these in our database. We store the token that lets us re-read the account, encrypted at the application layer with a key that is not the database’s key. We never see or store your bank login.

Financial data you type or upload. CSV files you import, transactions, categories, rules, budgets, goals, mileage trips, entities and their tax treatment, wages and distributions you record, receipts you attach (image or PDF files), tax settings such as your state and filing status, the name of the account you keep tax money in, a cost basis you type for a holding, marks you put on a recurring charge, and a record of which reminders we have emailed you.

Claude, ChatGPT and access tokens. If you connect an AI assistant such as Claude or ChatGPT, or make a token for one or for your own script, we store the assistant’s name and the web address it registered, a hash of the token, the first characters for display, whether it can make changes, when it was made, when it expires, when it was last used and how many times. We never store the token itself. Whatever it reads or changes, it does as you: what it returns goes to the assistant or script you gave it to, and from there the assistant’s own privacy terms apply. We do not see or keep your conversations with the assistant, only the tool calls it makes to Contha.

Billing. If you subscribe, Stripe collects your card. We never see the card number. We store your Stripe customer and subscription ids, your plan, the price you pay, and when it was locked.

Household and sharing. The email address of anyone you invite, the role you gave them, and when they joined. We send that address one email saying who invited them; nothing else is sent to it until they make an account. For a read-only accountant link: the label you typed, when it expires, and when it was last opened.

Technical. Server logs with IP address, browser type, the pages requested and the time, kept briefly for security and debugging. Error reports, with personal details removed before they leave our servers. Page-view counts on the marketing site from Vercel Analytics and from Google Analytics running in its cookieless mode: consent for analytics storage is denied before the tag loads, so it sets no cookie, keeps no client identifier, and anonymises the IP address. The app carries no analytics or tracking of any kind: no page-view count and no Google tag. The calculators on the marketing site compute in your browser and send nothing to us.

We do not use advertising cookies or trackers, and Google signals and ad personalisation are off. The only cookies are the ones that keep you signed in to the app.

Why we collect it

• To run the product: show your accounts and transactions in one place, categorize them, split business from personal, compute the tax estimate, the quarterly schedule, the reserve, mileage, the year-end package and the other figures the product exists for.
• To keep it working: sync your connections daily, tell you when a feed is behind or dead, and send the monthly digest if you have it on.
• To bill you, and to honour the price your subscription carries.
• To keep it safe: detect abuse, investigate incidents, enforce the terms.
• To meet legal obligations, including the Gramm-Leach-Bliley Act and the FTC Safeguards Rule, which apply to us as a company that handles consumer financial information.

We do not use your data to build profiles for advertising, to sell leads, or to decide anything about your creditworthiness. Where the product recommends a card or a deposit account, the ranking is computed from your own spending on our servers and nothing about you is sent to an issuer or a bank.

Who else touches it

These companies process data on our behalf. Each has its own privacy policy and a contract with us that limits what it may do with the data.

• Supabase (database, authentication, file storage), hosted on Amazon Web Services in the United States.
• Vercel (application hosting, edge network, server logs).
• Plaid (bank connections). Plaid collects and processes your financial data under its own End User Privacy Policy at plaid.com/legal, which you agree to when you connect an account through Plaid Link.
• Stripe (payments and subscription billing).
• Resend (transactional email: sign-up confirmation, sign-in and recovery links, email-change confirmation, notices about your free week and plan, invitations to share your books, receipts and plan renewal notices, the dead-feed notice, bill reminders, quarterly tax reminders and the monthly digest).
• Cloudflare Turnstile (on the sign-in, sign-up and password forms only: a check that you are a person, which reads signals from your browser to tell people from scripts; it sets no advertising cookie).
• Sentry (error reports from the app: stack traces and the route, with personal details scrubbed before they leave our servers, no session replay).
• TypeSafe (transaction categorization). When a charge cannot be filed by your own rules, your earlier answers, our list of known vendors or your bank’s own category, we send TypeSafe the merchant name, the bank’s description of the charge, its amount, the name and type of the account it is on, and the names of your categories, and it suggests a category. We do not send it your account numbers, balances, name or email address; the bank’s description is sent as the bank wrote it, and a description can carry a name, such as the sender of a Zelle payment.
• Google Analytics (aggregate page views on the marketing site only, contha.com, in cookieless mode: consent for storage is denied before the tag loads, so it sets no cookie and keeps no client identifier. The app carries no analytics tag of any kind).

Beyond those: anyone you invite to your household (they see the books, at the role you gave them), anyone you hand a read-only link to (they see the year-end package until the link expires or you turn it off), and the authorities when a valid legal demand requires it, in which case we tell you unless the law forbids it. If Contha is ever sold, the data goes with it under this policy and you are told first.

We do not sell personal information and have not done so in the preceding twelve months. We do not share it for cross-context behavioural advertising.

How long we keep it

• Account and financial data: for as long as your account exists. Delete the account and everything in it, receipts included, is deleted at once; the encrypted backups that held the rows roll off within seven days, and in no case later than thirty.
• Disconnected accounts: the encrypted token is removed at once; the transactions already read stay in your books until you delete them or the account.
• Billing records: seven years, because tax law requires it of us.
• Server and database logs: no more than thirty days; the providers currently keep them for less.
• Read-only links: they expire on the date you chose (30, 45 or 90 days) or when you turn them off, and nothing about the link is kept after that except that it existed.

Security

Every row in the database is scoped to its owner in Postgres itself, not only by the screen you look at. The token that reads your bank is encrypted with AES-256-GCM using a key held separately from the database, so a leaked database is not a leaked connection. Everything is encrypted in transit and at rest. Sessions are refreshed while you use the app and end after thirty days without activity. Passwords must be at least ten characters and are checked against known leaks, and you can turn on two-step verification with an authenticator app under Settings. We do not claim certifications we do not hold; there is no SOC 2 yet.

No system is perfectly secure. If we learn of a breach affecting your data we will tell you by email without unreasonable delay and in any case within the time the law requires.

Your rights and choices

• Export: every row you can see, as one document, from Settings, at any time.
• Correct: everything in the app is editable.
• Delete: the whole account, from Settings, behind a typed confirmation. It is not a support ticket.
• Disconnect: any bank connection, from Accounts, at once.
• Email: the monthly digest, quarterly tax reminders and bill reminders can each be turned off under Settings or from the link in the email. Sign-up, sign-in and recovery links, notices about your free week and plan, receipts, plan renewal notices and the dead-feed notice are part of the service and cannot be turned off while the account exists.
• Access and portability: the export is the access request. If you want it in another form, write to us.

If you live in California, Virginia, Colorado, Connecticut, Utah, or another state with a consumer privacy law, those rights are yours under it as well: to know, to delete, to correct, to opt out of sale or sharing (we do neither), and not to be discriminated against for exercising them. Write to the address below and we will act within the time the law gives, usually 45 days. You may use an authorised agent; we will verify the request through the account. If you live in the European Economic Area or the United Kingdom, the product is not offered there; if you use it anyway, your data is processed in the United States and the rights above are yours under the GDPR or UK GDPR, with OWSH Unlimited LLC as the controller.

Children

Contha is for adults. We do not knowingly collect data from anyone under 18, and an account we learn belongs to a minor is deleted.

This is also our financial privacy notice

Because we handle consumer financial information, the Gramm-Leach-Bliley Act applies to us. This page is the privacy notice that law requires: it is shown when you create an account, it is available here at all times, and we email every account before a change that matters. We share your information only as described above, never with non-affiliated companies for their own marketing, so there is nothing to opt out of.

Changes

When this policy changes we update the date at the top and, for anything that matters, email every account before it takes effect. The previous version is available on request.

Contact

OWSH Unlimited LLC, Buffalo, New York.
privacy@contha.com for anything on this page, including a request under a state privacy law.