Filoah Privacy Policy

Last Updated: November 3, 2026 (America/New_York)

Effective: November 3, 2026 (America/New_York)

Version: v2026.11.03

This Privacy Policy explains how Filoah collects, uses, and shares information.

Operator and controller: Filoah LLC, a New York limited liability company (“Filoah,” “we,” “us,” or “our”), with its office at 11 Charles W Briggs Road, Croton-on-Hudson, NY 10520 (Westchester County). Filoah LLC is the business responsible for (the controller of) the personal information described in this Policy.

Change of operator. Before October 14, 2026, the Service was operated by an individual doing business as Filoah. From that date, Filoah LLC operates the Service, is responsible for this Policy, and is responsible for the account data and other data held for the Service before that date. Filoah LLC’s limited-liability protection applies only from that date. It does not apply retroactively to anything that happened before it.

Privacy / legal contact: support@filoah.com

Services covered: Filoah websites and applications, including https://filoah.com, https://www.filoah.com, https://app.filoah.com, related development or staging hosts (for example https://www-dev.filoah.workers.dev/ and https://app-dev.filoah.workers.dev/), and other Filoah hosts when you use them (the “Service”).

Related: Terms of Service (/terms). Cookie and Analytics Notice (/cookies).

1. Who we are

Filoah is a DIY personal-finance planning product for cashflow, net worth, and retirement-style scenarios. We are an educational / planning software provider, not a bank, brokerage, or investment adviser. See our Terms of Service for product disclaimers.

2. Information we collect

We collect information in the following categories. We only collect what we need to operate and improve the Service.

2.1 Account and identity data

When you create or use an account (via Amazon Cognito), we may process:

• Email address, name or display name (if provided), and authentication identifiers;
• Password hashes or federated sign-in tokens managed by Cognito (we do not store your raw password);
• Account status and security settings;
• Records of your agreement to the Terms of Service and the Privacy Policy, as described next.

Agreement record. When you confirm in the app that you agree to the Terms of Service and the Privacy Policy, we keep one record for that answer. If you agree again after a change, we add a new record and keep the earlier ones. Each record holds your account ID, the version of each document you agreed to, the version of the agreement screen you saw, the date and time on our server’s clock, and a fixed note that the request came from the Filoah web app. We keep them so we can show which text you agreed to, and when.

A record does not contain your email address, your IP address, your browser details, or anything you typed. Like any request, the one that records your answer may appear in network and diagnostic logs (Section 2.5), but the record itself does not contain an IP address. The note about where the request came from is only what the request says about itself. It does not prove where or how you agreed. Filoah staff can see the records as part of the data we store about you (Section 4.6), and the staff AI tools described there can read them. If you choose “I do not agree,” we keep no record of that answer. Section 6 says how long we keep the records and what deleting your account does.

2.2 Planning inputs you provide (“Financial Planning Data”)

Information you enter to build plans and scenarios, such as income, expenses, assets, liabilities, savings rates, goals, ages, and similar assumptions. We do not claim bank or brokerage account linking for core planning unless we later introduce it and update this Policy. You decide what to enter; avoid submitting government ID numbers or account passwords into planning fields or chat. You may enter details about other people in your household, such as a spouse, partner, or child. Enter only what you are comfortable sharing. Section 2.3 says what Filoah Chat sends to AI services, and Section 4.5 says what an AI app you connect can read.

2.3 Plan chat / AI content

If you use plan chat, we store the messages you send, the plan context used to respond, and the model outputs. Filoah staff can read that stored chat. We read it to run Filoah, keep Filoah secure, fix problems, answer you when you write to us, and make Filoah more useful to you (Section 4.6). Staff may also have Claude and Grok Bot, the staff AI tools in Section 4.6, read it to learn how people use Filoah, to improve Filoah, and to plan how we tell people about Filoah (our marketing). Processing to generate a reply may occur through Amazon Bedrock (for example Amazon Nova Lite and, when enabled, Anthropic models hosted via Bedrock) or through OpenRouter.

Plan chat may be processed through OpenRouter, which sends your chat to the model provider to generate a reply.

The model provider for plan chat through OpenRouter is currently Anthropic.

When plan chat goes through OpenRouter, your messages, the plan context used to respond, and the model outputs pass through OpenRouter and Anthropic.

Anthropic is the company that makes the Claude models. For plan chat through OpenRouter we use a Claude model, and we tell OpenRouter to send your chat only to Anthropic and to no other provider.

Before we moved to Anthropic, the model provider was OpenAI. Plan chat sent while OpenAI was the provider also passed through OpenRouter and OpenAI. Sections 4.1 and 10 say how long OpenAI may keep it.

In the app, plan chat is called Filoah Chat.

What we save. Each time you send a chat message, we save it. We save the reply too. With each one, we save the time and which plan it was about. We save up to 4,000 characters of each message. This saved chat is the chat history you see in the app.

About "plan context." To answer you, we send details from your plan to the AI service: its numbers, and the names in it, such as the names of people, life events, and accounts. If you type a person's name into a life event or an account name, the AI service gets it. We do not save a separate copy of the plan data we send with each chat message. But the messages and replies we save can repeat details from your plan, such as names and amounts, and the short-term copy below also has the plan name. Your plan itself is saved as Financial Planning Data (Section 2.2).

What Filoah Chat sends to the AI service. To answer you, Filoah Chat sends your new message to the AI service. It also sends your recent messages and replies in Filoah Chat, so the AI service can follow the conversation. Filoah Chat can also read your plans and your Current Finances and send what it reads to the AI service. Except for what is listed under "What Filoah Chat does not send" below, it can read everything you entered there, including:

• the names and notes of all your plans;
• everything in the plan you have open: your income, spending, savings, accounts, debts, and houses, with their names and amounts, your life events (such as "Have a child" or "Go to college") with the names you gave them, and your assumptions and tax settings;
• your projections for that plan, with their results and plan checks, and how that plan differs from the plan it was copied from;
• your Current Finances: the people in your household, with the names or labels you gave them, their birth years and months, and whether someone is marked blind for tax purposes; where you live and your filing status; your children's birth years and months; and your accounts, debts, and houses, with their names and balances, and for an inherited account, the original owner's birth and death year and month.

Any name, note, or amount you type in those places can be sent, whoever it is about.

What Filoah Chat does not send. Filoah Chat does not send the email address on your account or your password. It does not read files you upload, your Progress, or your agreement records. It does not send the names you give children in About You, only their birth years and months. From your other plans, it reads only their names and notes. The one exception is the plan that the open plan was copied from: Filoah Chat can read how the open plan differs from it, including that plan's values for what changed.

Your agreement. When you agree to this Privacy Policy, you agree that when you use Filoah Chat, we send what this section describes to the AI services that run it: OpenRouter and the model provider behind it (now Anthropic), or Amazon Bedrock (Sections 4.1 and 10). You decide what you type in your plans, your Current Finances, and Filoah Chat, including names, notes, and amounts. If you enter details about another person, such as a spouse or a child, enter only what you may share. If you do not want something sent, do not enter it, or do not use Filoah Chat.

A short-term copy. We may also keep a second copy of each chat turn for about 90 days. It has the same saved text, the plan name, and whether you said yes to a change the chat suggested. We use it to run, fix, and improve the Service. Then it is deleted.

We hide some things before we save. Before we save chat, a computer check looks for things like a Social Security number, a long card or account number, or a word typed after "password." It swaps them for "[redacted]." The check only looks for patterns, so it can miss things. It can also hide things that are not secret. It works on the chat we save. The AI service still gets your message the way you typed it. Please do not type secrets into chat.

Stored chat is not sent to Google Analytics 4.

2.4 Billing data (when paid features launch)

If you purchase a subscription, our payment processor (to be named when live) will collect payment details. We typically receive limited billing metadata (plan, status, invoices), not full card numbers, once a processor is designated. We will name the payment processor in this Policy before paid checkout goes live.

2.5 Usage and technical data

• Device/browser type, approximate region derived from network metadata, timestamps, and diagnostic logs;
• Product events needed to operate and debug the app (API errors, feature availability);
• Per-user usage of the Service, which Filoah staff may review as described in Section 4.6.

2.6 First-party edge analytics and Google Analytics 4 (measurement only)

We use two complementary measurement approaches. They are separate.

Cloudflare Workers Analytics Engine. We keep lightweight first-party product counters (dataset example: acs_demo_events, event example: signup_completed). As configured, these counters are not tied to advertising cookies or persistent user identifiers for advertising or cross-site tracking. They are not Google Analytics, and they do not depend on the cookie banner described below.

Google Analytics 4, production only, and only after a choice. For site measurement we use Google Analytics 4 on our production sites only: https://filoah.com, https://www.filoah.com, and https://app.filoah.com.

• We do not load Google Analytics 4 on development or staging hosts, including workers.dev hosts and app-dev hosts.
• Admin hosts do not receive the Google Analytics tag and do not show the cookie banner.
• On those production sites, a cookie banner asks before any Google script loads. It has three buttons: Reject all, Accept all, and Cookie choices. Reject all is as easy as Accept all. Both are on the bar itself, and they are the same size and weight. If you choose Reject all, we do not load the Google script and we do not send the events below. Cookie choices opens a window, the Cookie choices window, where Analytics is a switch that starts Off. You can accept by pressing Accept all, or by turning Analytics On and pressing Save choices. Closing the Cookie choices window without one of those saves nothing.
• You can change your choice at any time with the Cookie choices link in the footer of every page or the Cookie choices card on your Account page. Turning Analytics Off stops Google Analytics in that tab at once and clears its cookies from your browser.
• We store that choice in a first-party cookie on the .filoah.com domain so filoah.com, www.filoah.com, and app.filoah.com share one answer. It holds only your choice, lasts 180 days, and is not a sign-in or an identifier.
• Global Privacy Control. Some browsers and browser add-ons can send a signal called Global Privacy Control (GPC). It tells the sites you visit that you do not want your personal information sold or shared, including for tracking you across sites. We honor it. When your browser sends it, we treat it the same as Reject all: we do not load the Google script and we do not send the events below, on filoah.com, www.filoah.com, and app.filoah.com, from the first page you open. The cookie bar does not show, and Cookie choices shows Analytics as Off with no way to turn it on while the signal is on. The signal wins even if you accepted before, and Google Analytics cookies are cleared from your browser as they are on Reject all. We do not save the signal in a cookie, in your browser's storage, or in your account. The choice you saved stays as it is, and applies again if you turn the signal off. The signal stops Google Analytics only. It does not change the first-party counters above, the per-user usage in Section 2.5, or staff access in Section 4.6.
• We do not connect a Google advertising (ads) account. We do not enable remarketing. We do not enable Google signals. We do not use this property to serve ads on Filoah.
• We do not use Google AdSense or another third-party display advertising network, session-replay SDKs, or a separate marketing-pixel stack.

Events that may be sent to Google Analytics 4, and only after you accept:

• page_view
• sign_up (method Cognito only, no user id)
• first_projection
• cf_ready
• chat_start

Never sent to Google: email, name, phone, Cognito sub (user id), balances, ages, account names, chat text, or your plan / Financial Planning Data.

What Google also sees if you accept. If you accept, Google Analytics uses cookies and similar storage in your browser. When your browser contacts Google, Google also sees your IP address and browser details (such as the browser type, which your browser sends with every web request), as it does for any site that uses Google Analytics. Your browser also keeps a small note in its local storage, on your device only, for each one-time event already sent (first_projection, cf_ready, and chat_start), so each is sent once. Filoah does not receive these notes, and choosing Reject all later does not remove them.

Google may act as an independent controller for some Analytics processing under Google’s own terms and privacy policy. See Google’s Privacy Policy and Analytics documentation. Your controls are in Section 5 and Section 8.

2.7 Communications

Emails and messages you send to us (including via Cloudflare Email Routing for *@filoah.com addresses and Amazon SES for Cognito transactional mail).

Support email. Email you send to support@filoah.com goes to our Gmail account, which Google runs. We keep it there with our replies. We may use Claude, an AI assistant made by Anthropic, to help us read and sort support email and write draft replies, and a person at Filoah reviews and sends every reply. Claude does not send email. When it helps, Claude can see your email address, what you wrote, and files you attach. We may also use Grok Bot, an AI agent made by Cursor that runs on models from xAI, in the same way. We do not use Grok Bot to send email, and a person at Filoah reviews and sends every reply. When it helps, Grok Bot can see the same things. Section 6 says how long we keep support email.

Gmail is not Google Analytics. Wherever this Policy or the Cookie notice says we never send something to Google, it means from our sites and apps. It does not cover email you choose to send us.

2.8 Information we do not intentionally collect

We do not intentionally collect Social Security numbers, full bank account numbers, or government ID images for core planning. Do not upload those into free-text or chat fields.

3. How we use information

We use personal information to:

• Provide, maintain, secure, and improve the Service;
• Let Filoah staff review the finances you enter, stored plan chat, and per-user usage so we can run Filoah, keep it secure, fix problems, answer you, and make it more useful to you, as described in Section 4.6;
• Let Filoah staff use the staff AI tools in Section 4.6 (Claude and Grok Bot) to read the data we store about you to find and fix problems, answer support requests, learn how people use Filoah, improve Filoah, and plan how we tell people about Filoah (our marketing). We use what we learn about many people together, and we do not use your data to choose who sees an ad;
• Authenticate users and prevent fraud or abuse;
• Generate projections and respond to plan-chat requests you initiate, which means sending your messages and plan data to the AI services in Section 2.3;
• Send transactional messages (account verification, security, service notices);
• Read and answer email you send us (Section 2.7);
• Analyze product usage with first-party Cloudflare Workers Analytics Engine counters and operational logs;
• If you accept on the cookie banner, measure traffic on our production sites (https://filoah.com, https://www.filoah.com, and https://app.filoah.com) with Google Analytics 4 using only the events listed in Section 2.6;
• Comply with law and enforce our Terms;
• With your consent where required, send product updates or marketing (you may unsubscribe).

We do not sell your personal information for money. We do not send email, name, phone, Cognito sub, balances, ages, account names, chat text, Financial Planning Data, or plan content from our sites and apps to Google. Email you send us is different: it is kept in Gmail (Section 2.7). We do not use plan-chat content to train public foundation models for unrelated third parties; Amazon Bedrock and OpenRouter processing is to provide the feature you request, subject to each provider’s applicable terms and our configuration.

4. How we share information (processors and others)

We share information only as described below.

4.1 Service providers / processors

What plan chat sends Amazon Bedrock, OpenRouter, and Anthropic is described in Section 2.3. It can include the names, notes, and amounts you type in your plans and Current Finances.

Processors may access personal information only to perform services for us and under contractual obligations appropriate to their role, except where a provider (such as Google for certain Analytics processing) acts as an independent controller under its own terms. In that case, that provider’s privacy policy also applies. Google receives measurement data only if you accept, and only the events in Section 2.6. Anthropic receives plan chat sent through OpenRouter under OpenRouter’s arrangements with Anthropic, so OpenRouter’s and Anthropic’s privacy policies also apply to that processing. OpenAI received earlier plan chat the same way, under OpenRouter’s arrangements with OpenAI and OpenAI’s API terms, so OpenAI’s privacy policy also applies to that earlier chat.

Google (Gmail), Anthropic (Claude), and Cursor (Grok Bot), the staff assistants, work differently. They handle the data in our accounts under their standard terms for those accounts (for Claude, Anthropic’s consumer terms; for Grok Bot, Cursor’s terms for our account). We do not have a separate data processing contract with any of them, so their privacy policies also apply. xAI’s privacy policy may also apply to what Cursor sends it.

4.2 Legal and safety

We may disclose information if we believe in good faith it is required by law, legal process, or to protect the rights, safety, or security of Filoah, our users, or the public.

4.3 Business transfers

If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy’s commitments unless you agree otherwise.

Change of operator to Filoah LLC. With effect from October 14, 2026, the individual who operated Filoah transferred the Service, and the personal information held for it, to Filoah LLC, which that same person owns and manages. That includes account data, Financial Planning Data, uploaded files, stored plan chat, usage data, and support email. Filoah LLC uses that information only as this Policy describes. This transfer did not change what we collect, how we use it, or who we share it with.

4.4 Analytics measurement and “sale” / “share”

We do not sell personal information for money.

Google Analytics 4 is measurement only. We use it on https://filoah.com, https://www.filoah.com, and https://app.filoah.com only (production). We do not load it on development or staging hosts (including workers.dev and app-dev). Admin hosts do not get the tag or the cookie banner. We do not connect a Google ads account. We do not enable remarketing. We do not enable Google signals. We do not use this property for cross-context behavioral advertising or to serve ads on Filoah.

Consent before any Google script loads. The Google tag loads only after you accept, by pressing Accept all or by turning Analytics On and pressing Save choices. Reject all is as easy as Accept all. Reject all does not load any Google script and does not send the events. No Google script loads before that choice. We store the choice in a first-party cookie on .filoah.com so filoah.com, www.filoah.com, and app.filoah.com share one answer.

Global Privacy Control. We treat a Global Privacy Control signal from your browser (Section 2.6) as a request to opt out of this Google Analytics disclosure, in that browser. While your browser sends it, no Google script loads and none of the events below are sent, even if you accepted before.

Event allowlist (only after accept): page_view; sign_up (method Cognito only, no user id); first_projection; cf_ready; chat_start.

Data never sent to Google: email, name, phone, Cognito sub, balances, ages, account names, chat text, or plan / Financial Planning Data.

Under some U.S. state laws, including California’s CPRA, a disclosure of a cookie or client identifier to an analytics provider can be discussed as a “share,” even when the provider is not used for advertising. We disclose that characterization so you can decide. The Reject all button on the cookie banner is how you opt out of this Google Analytics disclosure. We show it as plainly as Accept all, and no Google script loads before you choose. You can opt out again at any time with Cookie choices in the footer or on your Account page. We also honor email opt-out requests as described in Section 8.

We do not sell or share Financial Planning Data or plan-chat content with Google, advertisers, or advertising networks. Staff access in Section 4.6 is access by Filoah. When staff use Claude, Anthropic gets that data to do that work for us. When staff use Grok Bot, Cursor gets that data to do that work for us, and xAI may get it as the model provider. None of this is a sale, and none of it is a share with Google, advertisers, or advertising networks.

If we later add display advertising or other marketing pixels, we will update this Policy and provide required notices and controls before doing so.

4.5 With your direction

We may share information when you ask us to (for example, exporting your data to yourself).

AI apps you connect (MCP). You can connect an AI app that you choose to your Filoah account. The app works with Filoah through our MCP server. MCP (Model Context Protocol) is a common way for AI apps to use tools from other services. This is separate from Filoah Chat (Section 2.3). To connect, the app signs in to Filoah as you. It gets a sign-in token from us, and that token includes your email address. Through our MCP server, the app can use our tools to:

• Read your plans and what you saved in them, such as plan names and notes, income, spending, accounts, houses, debts, savings rules, life events and the names you gave them, and assumptions, and household details such as the names or labels you gave people, birth years and months, filing status, whether someone is marked blind for tax purposes, and where you live.
• Read your Current Finances: About You, your children’s birth years and months, and your accounts, debts, and houses with their balances, and for an inherited account, the original owner’s birth and death year and month.
• Get your projections: the results by year or by month, taxes, warnings, and the assumptions used.
• Add, change, or delete items in your plans and in your Current Finances. Before our tools save a change, the app must ask them for a preview of that change, and the save must match the preview. Filoah cannot tell whether the app showed you the preview or whether you said yes. A change the app saves becomes part of your Financial Planning Data (Section 2.2).

Our MCP tools do not send the names you give children in About You, files you upload, your Progress, or your agreement records. Any other name, note, or amount you type in your plans or Current Finances can be sent to the app, whoever it is about. When you connect an app, our tools send it what they return. By agreeing to this Privacy Policy, you agree to that.

The sign-in works like your own sign-in to Filoah. An app that has it can also reach your account directly, without our MCP server and without a preview, and do what you can do in the Filoah app. That includes reading the names you give children in About You and your saved Filoah Chat history, sending Filoah Chat messages, changing or deleting your plans, deleting your account, and sending the request that records your agreement to the Terms of Service and the Privacy Policy. Our MCP tools do not let an app agree for you, and our servers refuse requests from a connected app to read or save your plans and Filoah Chat until you have agreed in Filoah. Connect only an app you trust.

The app, and the company that runs it, are not Filoah. Filoah does not choose, check, or control them. What our tools send to the app leaves Filoah. That company’s own terms and privacy policy decide what happens to it next, for example how long it is kept, who can see it, and whether it is used to train AI models. Deleting your Filoah account does not delete copies the app or its company keep. You choose to send this data to the app, so it is not a sale of your personal information. Where this Policy or the Cookie notice says we never send something to Google, that does not cover an app you connect, even if Google makes it.

Our MCP server also gives the app written instructions for its AI model. For example, they ask the model to explain and not to give advice, and to save a change only after you have seen the preview and asked for it. These instructions are a request to that model. They are not a control, and Filoah cannot make the app follow them. What the app tells you is not advice from Filoah (see Terms Section 6).

Filoah does not have a setting that shows or disconnects connected apps. To stop an app, remove Filoah in that app’s own settings. An app’s sign-in lasts about 30 days from when you signed in through it, unless the app ends it sooner. After that, the app has to ask you to sign in again. If the app keeps its sign-in after you remove it, it can keep working until then. Changing your Filoah password may not end the sign-in. Deleting your Filoah account ends it within about an hour.

4.6 Staff access (including admin.filoah.com)

Filoah staff means Filoah LLC’s members and anyone Filoah LLC authorizes to operate Filoah. Today Filoah staff is one person: Filoah LLC’s only member, who manages it. Claude, Grok Bot, and the companies behind them (Anthropic, Cursor, and xAI) are not Filoah staff.

Staff can see a person’s finances (the Financial Planning Data you enter), chat text, and per-user usage. They use Filoah’s admin tools to do that, including production https://admin.filoah.com. That host does not get the Google Analytics tag or the cookie banner.

We store plan chat. If you use plan chat, we keep the messages you send, the plan context used to respond, and the model outputs, and staff can read that stored chat.

Staff see the chat we saved, after the "[redacted]" step in Section 2.3. Staff can also see the short-term copy while we keep it.

Staff may use this access to run Filoah, keep it secure, fix problems, answer you when you write to us, and learn how people use Filoah so we can make it more useful to you. This access is by Filoah. When staff use Claude or Grok Bot to do it, Anthropic or Cursor also gets the data (and xAI may), as the next paragraphs say. None of this is a sale of personal information, and none of it is a disclosure to Google, advertisers, or an advertising network. Staff still do not send email, name, phone, Cognito sub, balances, ages, account names, chat text, or Financial Planning Data to Google Analytics 4. Staff may also have Claude or Grok Bot use this access to learn how people use Filoah, to improve Filoah, and to plan how we tell people about Filoah (our marketing), as the next paragraphs say.

Staff AI assistant. Filoah staff may use Claude, an AI assistant made by Anthropic, to find and fix problems and to answer support requests, and to do that Claude can read the data we store about you in our production systems, including your account details and email address, Financial Planning Data, uploaded files, and chat text. Staff may also use Claude to learn how people use Filoah, to improve Filoah, and to plan how we tell people about Filoah (our marketing), and Claude can read the same data to do that. When staff do this, Anthropic gets that data so Claude can work for us. In these sessions Claude can read your data but not change it. Our Claude account has the setting that lets Anthropic train on our chats turned off, so Anthropic does not use these sessions to train its models, except that it may use a session its safety systems flag to train the models its safety team uses (Section 6). We do not sell this data to Anthropic. Section 6 says how long Anthropic keeps these sessions.

Staff AI agent (Grok Bot). Filoah staff may also use Grok Bot, an AI agent made by Cursor that runs on models from xAI, for the same purposes. To do that, Grok Bot can read the data we store about you in our production systems, including your account details and email address, Financial Planning Data, uploaded files, and chat text. When staff do this, Cursor gets that data so Grok Bot can work for us, and xAI may get it as the model provider. We do not use Grok Bot to change your data, and the AWS login it uses can read your data but not change it. Our Cursor account has Privacy Mode turned on. Cursor says this means it and the model providers it uses, including xAI, do not use these sessions to train models. We do not sell this data to Cursor or xAI. Grok Bot needs Cursor to store data to run, so Privacy Mode does not mean Cursor stores nothing. Section 6 says what we know about how long these sessions are kept.

How we use what the staff AI tools learn. When Claude or Grok Bot reads your data to learn how people use Filoah, to improve Filoah, or to plan our marketing, it can read each person’s own data, not only totals across many people. We use what it learns to see what is true of many people together, for example which tools people use most or where people get stuck. The notes, counts, and ideas we write down from that work do not name you or include your details. We do not put your name, your words, or other details about you in our marketing, and we do not quote you in public unless you first say yes in writing. We do not use your data to choose who sees an ad, and we do not put it in an ad. What we learn about many people together may shape our marketing, including what our ads say. That is what we mean when we say we do not use your data, or Financial Planning Data, for advertising. This does not change the rest of this Policy: we do not sell your data, we do not send it to Google, advertisers, or advertising networks, and we do not use Financial Planning Data for advertising.

5. Cookies and similar technologies

Essential: Technologies required to run the site and authenticate you (for example Cognito session/auth tokens and normal browser storage needed for login). These are not the Google Analytics tag.

First-party analytics: Cloudflare Workers Analytics Engine counters as described in Section 2.6 (no advertising cookies in our configuration). These counters do not wait on the Google cookie banner.

Choice cookie: If the cookie banner is shown, we store your accept or reject choice in a first-party cookie on .filoah.com so filoah.com, www.filoah.com, and app.filoah.com share one answer. It holds only your choice, lasts 180 days, and is not a sign-in or an identifier. Admin hosts do not show the banner and do not get the Google Analytics tag.

Google Analytics 4 cookies (non-essential, consent first): Google Analytics 4 may set cookies or use identifiers for measurement, but only on https://filoah.com, https://www.filoah.com, and https://app.filoah.com, and only after you accept. The tag loads only after you accept (Accept all, or Analytics On and Save choices). Reject all is as easy as Accept all, and Reject all does not load any Google script. After you accept, Filoah’s own code also keeps a small note in your browser’s local storage, on your device only, so each one-time event is sent once. We do not load this property on workers.dev or app-dev hosts. See the Cookie and Analytics Notice (/cookies).

Not in use with this property: a Google ads account; remarketing; Google signals; Google AdSense or other third-party display ad networks; separate marketing pixels; session-replay SDKs.

Your controls:

• The cookie banner: the Google tag loads only after you accept; Reject all is as easy as Accept all and does not load any Google script; no Google script loads before that choice;
• Global Privacy Control: if your browser sends it, we treat it as Reject all (Section 2.6);
• Cookie choices, any time: the footer link on every page and the card on your Account page open the same Cookie choices window, show your saved choice, and let you change it (closing the Cookie choices window without pressing Reject all, Accept all, or Save choices saves nothing);
• Browser settings to block or delete cookies, including the first-party choice cookie on .filoah.com (blocking your browser's site storage may break sign-in; deleting the choice cookie means the banner asks again);
• Contact us (Section 13) for privacy requests, including opt-out of sale/sharing where applicable.

6. Retention

We retain personal information for as long as your account is active or as needed to provide the Service, and thereafter as required for legitimate business purposes (security, dispute resolution, legal compliance, backups) or as required by law.

Agreement records. We keep each record in Section 2.1 for as long as your account exists. When you delete your account, we delete all of them with your other data. Resetting your account data (Reset account, in Account settings) deletes your plans but keeps the records, because you are still a customer. We do not make a separate copy of the records to keep after you delete your account. Backup copies follow the schedule below.

Plan chat. We keep your chat history for as long as you have an account. It has no set end date. We keep it so you can scroll back to past chats. The short-term copy in Section 2.3 is deleted after about 90 days.

When your account is deleted. When you delete your account, or we close it for good, we delete your Financial Planning Data, your agreement records, and all of your plan chat from our live systems. We aim to do this within 60 days. We may keep some data longer if the law says we must, or to keep the Service safe, stop fraud, or settle a dispute. Backup copies are deleted on a rolling schedule.

Plan chat sent through OpenRouter is also subject to the retention practices of OpenRouter and of the model provider (Anthropic now, and OpenAI for chat sent while OpenAI was the provider), described in Section 10. Deleting your Filoah account does not control copies those providers keep for their own abuse monitoring, safety, or legal needs.

Support email. We keep support email, and our replies, in Gmail until you ask us to delete it. Deleting your account does not delete it, so ask us if you want it deleted too. We may keep it longer if the law says we must, or to settle a dispute. After we delete it, Google may keep copies for a time under its own terms.

Claude sessions. When Filoah staff use Claude (Sections 2.7 and 4.6), Anthropic keeps a record of the session. Our Claude account has the setting that lets Anthropic train on our chats turned off. With that setting off, Anthropic says it keeps a session for up to 30 days. If we save a session so we can come back to it, Anthropic keeps it until we delete it, and for up to 30 days after we delete it. We aim to delete a saved session that read your data when its task ends. Anthropic may keep a session longer:

• up to 2 years if its safety systems flag the session, and the safety scores for up to 7 years. Anthropic may also review a flagged session and use it to train the models its safety team uses;
• when the law requires it, to settle a dispute, or to enforce its usage policy.

Anthropic keeps feedback we send it for 5 years, including a session sent with the Claude Code /feedback, /bug, or /share commands, and may use feedback to train its models. It keeps a session we agree to share in a Claude Code survey for up to 6 months. We do not send feedback about, or share, a session that read your data. Claude sessions are not part of our live systems, so the 60-day deletion above does not cover them. Anthropic keeps them for the times listed here.

Grok Bot sessions. When Filoah staff use Grok Bot (Sections 2.7 and 4.6), Cursor stores the data Grok Bot needs to run, including files it copies or creates on a cloud computer during a run. Cursor has not given us a fixed time for how long it keeps this data, and the time depends on the kind of account. We may not be able to delete a Grok Bot session or its files ourselves. When we can, we delete a session that may have read your data, and any files it made, when its task ends. Grok Bot sessions are not part of our live systems, so the 60-day deletion above does not cover them. We do not send feedback about, or share, a Grok Bot session that may have read your data.

Measurement data held by Google for our Google Analytics 4 property, if you accepted, is subject to Google’s retention settings for that property. If you reject, we do not send the Section 2.6 events to Google.

7. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including:

• Encryption in transit (HTTPS/TLS) to our Workers and APIs;
• Cloud-provider encryption at rest for data stores we use;
• Access controls and least-privilege practices for operational access;
• Separation of environments where practical.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will investigate and notify you and regulators as required by law.

We do not claim SOC 2 certification for Filoah itself at this stage.

8. Your choices and rights

8.1 Account controls

You may update certain account information through the Service or by contacting us. You may request deletion of your account by emailing support@filoah.com (include the email on the account). The agreement screen links to support@filoah.com for this, so you can ask without agreeing. You can also delete your account yourself in Account settings, which opens after you agree. Account settings shows the date you most recently agreed to the Terms of Service and the Privacy Policy. Deleting your account deletes your agreement records (Section 6).

8.2 Marketing

Transactional and security emails are necessary for the Service. For optional marketing emails, use the unsubscribe link or contact us.

8.3 California residents (CCPA/CPRA-style rights)

If you are a California resident, you may have the right to:

• Know / access categories and specific pieces of personal information we collected;
• Delete personal information, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of sale or sharing of personal information. We do not sell personal information for money. We do not enable Google signals, remarketing, or a Google ads account. For the Google Analytics 4 disclosure in Section 4.4 (on https://filoah.com, https://www.filoah.com, and https://app.filoah.com only), Reject all on the cookie banner is the opt-out. It is as easy as Accept all, and no Google script loads before you choose. A Global Privacy Control signal from your browser is an opt-out too, in that browser (Section 2.6). After you have chosen, Cookie choices in the footer or on your Account page lets you turn Analytics Off at any time (turn it Off and press Save choices, or press Reject all). We do not sell or share Financial Planning Data, and we never send the Section 2.6 denylist (email, name, phone, Cognito sub, balances, ages, account names, chat text, or plan data) to Google;
• Limit use of sensitive personal information where the law provides that right. We do not use Financial Planning Data for advertising. Staff review in Section 4.6 is to run Filoah, keep it secure, fix problems, answer you when you write to us, and make it more useful to you. Staff use Claude and Grok Bot (Section 4.6) to find and fix problems, answer support requests, learn how people use Filoah, improve Filoah, and plan how we tell people about Filoah (our marketing), but not to choose who sees an ad;
• Non-discrimination for exercising privacy rights.

To submit a request, email support@filoah.com with the subject “Privacy Request.” We will verify your identity (for example via the email on your account) and respond within the time required by law (generally 45 days, with a permitted extension when needed). You may use an authorized agent as permitted by law.

Sensitive personal information. Financial Planning Data you enter (which can include ages, balances, and account names) may be considered sensitive under some state laws. We use it to provide the Service you request, including sending it to the AI services that run Filoah Chat when you use it (Section 2.3). As described in Section 4.6, Filoah staff can also see those finances, stored chat text, and per-user usage, to run Filoah, keep it secure, fix problems, answer you when you write to us, and make it more useful to you. Staff may use Claude, made by Anthropic, to read them when we find and fix problems or answer support requests (Section 4.6). Staff may also use Claude to read them to learn how people use Filoah, to improve Filoah, and to plan how we tell people about Filoah (our marketing) (Section 4.6). Our account setting does not let Anthropic use them to train its models, except for a session its safety systems flag (Section 6). Staff may also use Grok Bot, made by Cursor and running on models from xAI, in the same way. Cursor says that with Privacy Mode on, which our Cursor account has, it and the model providers it uses, including xAI, do not use those sessions to train models (Section 4.6). We do not use that information for advertising. We do not send it to Google Analytics 4. Where the law lets you limit certain uses of sensitive personal information, including using it to plan our marketing, email us as described above.

8.4 Other U.S. state privacy laws

Residents of other states with consumer privacy laws may have similar rights to access, delete, correct, or opt out of certain processing (including the analytics disclosure in Section 4.4). Contact us using the same email address, use Reject all on the cookie banner, use Cookie choices later, or turn on Global Privacy Control in your browser. We will process requests consistent with applicable law.

8.5 International users

The Service is U.S.-hosted (AWS regions such as us-east-2 and Cloudflare’s global edge). Plan chat sent through OpenRouter may be processed by OpenRouter and Anthropic (and, for earlier chat, OpenAI) in the United States or other locations they use. Support email kept in Gmail, and Claude sessions in which Filoah staff read your data (Sections 2.7 and 4.6), may be processed by Google and Anthropic in the United States or other locations they use. Grok Bot sessions (Sections 2.7, 4.6, and 6) may be processed by Cursor and, as the model provider, xAI in the same way. If you accept, Google Analytics 4 may process the Section 2.6 events in the United States or other locations Google uses. That tag runs only on https://filoah.com, https://www.filoah.com, and https://app.filoah.com. We do not load it on development or staging hosts. If you access the Service from outside the United States, you understand your information will be processed in the United States, which may have different data-protection rules than your country.

For every visitor to https://filoah.com, https://www.filoah.com, or https://app.filoah.com, the Google tag loads only after you accept. Reject all is as easy as Accept all and does not load any Google script. No Google script loads before that choice. We do not currently market the Service as fully GDPR-ready for EU/UK residents. If that changes, we will update this Policy.

9. Children’s privacy

The Service is for adults (18+). We do not knowingly collect personal information from children under 18 (or under 13 where that is the applicable COPPA threshold for any incidental website interaction). If we learn we have collected such information, we will delete it. Contact us to report a concern.

A parent or other adult may enter details about a child, such as a name or a birth year and month (Section 2.2). That is information from the adult, not from the child. We handle it like the rest of your Financial Planning Data. That includes sending it to the AI services that run Filoah Chat (Section 2.3), except the names you give children in About You.

10. AI-specific disclosures

• Plan chat may send your messages and the plan data described in Section 2.3 to Amazon Bedrock or to OpenRouter to generate a response. That plan data can be everything you entered in your plans and Current Finances, including names, notes, and amounts, apart from what Section 2.3 says plan chat does not send. OpenRouter sends them to the model provider, which is currently Anthropic (the Claude models). Before we moved to Anthropic, it was OpenAI.
• When plan chat goes through OpenRouter, we set it to use Anthropic as the only model provider and to avoid providers that may train on your data.
• By agreeing to this Policy, you agree that plan chat sends this data to these AI services when you use it. You choose what you type, and you can choose not to use plan chat.
• Outputs can be wrong. They are not advice (see Terms).
• We configure and use Bedrock and OpenRouter to provide the feature; we do not claim your chats train unrelated public models.
• Under their published terms for API traffic, OpenRouter does not store prompts or replies unless the customer opts in, and Anthropic does not use API inputs or outputs to train its models by default. Filoah has not opted in to OpenRouter storing chat, and has not opted in to any use of chat to train models. While OpenAI was the provider, OpenAI did not use API data to train its models unless the customer opted in, and Filoah had not opted in.
• Anthropic says it deletes API inputs and outputs within 30 days. It may keep them longer if its safety systems flag them (up to 2 years, and its safety scores for up to 7 years) or the law requires. OpenRouter says it keeps request details such as token counts and timing, but not the chat text.
• OpenAI, the earlier provider, may keep plan chat it received for up to 30 days to monitor for abuse, or longer if the law requires.
• Do not type secrets into chat. That means passwords, full account numbers, or Social Security numbers. Our "[redacted]" step (Section 2.3) can miss things, and the AI service still gets what you typed.
• We store plan chat (messages you send, plan context used to respond, and model outputs). Filoah staff can read that stored chat, as described in Section 4.6. We keep chat history until your account is deleted (Section 6).
• Chat text and plan context are not sent to Google Analytics 4.
• An AI app you connect yourself through our MCP server (Section 4.5) is not plan chat. The company that runs that app, not Filoah, decides how it handles what our tools send it. The instructions our tools give its AI model are a request, not a control.
• Filoah staff also use Claude, an AI assistant made by Anthropic, to help with support email (Section 2.7) and to find and fix problems (Section 4.6). This is separate from plan chat. Plan chat uses Anthropic’s business API through OpenRouter (and may use Anthropic models through Amazon Bedrock), which has its own terms and settings (Sections 4.1 and 6).
• Our Claude account has the setting that lets Anthropic train on our chats turned off, so Anthropic does not use those sessions to train its models, except for a session its safety systems flag. Section 6 says how long Anthropic keeps them.
• Filoah staff may also use Grok Bot, an AI agent made by Cursor that runs on models from xAI, for the same support and problem-fixing work (Sections 2.7 and 4.6). This is separate from plan chat. Plan chat does not use Cursor or xAI.
• Our Cursor account has Privacy Mode turned on. Privacy Mode is a Cursor setting that keeps data out of training. Cursor says that with it on, Cursor and the model providers it uses, including xAI, do not use those sessions to train models. Cursor still stores the data Grok Bot needs to run. Section 6 says what we know about how long these sessions are kept.
• Filoah staff may also use Claude and Grok Bot to read the data we store about you to learn how people use Filoah, to improve Filoah, and to plan how we tell people about Filoah (our marketing) (Section 4.6). We use what we learn about many people together. We do not put your details in our marketing, and we do not use your data to choose who sees an ad. This is separate from plan chat.

11. Third-party links

The Service may link to third-party sites (including Google). Their privacy practices are their own. Review their policies before providing information to them.

12. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated Policy and change the “Last Updated” date (and Version). For material changes, we will provide additional notice when required (email or in-product).

If a change matters (for example, a new way we use your information, a new company that gets it, or a smaller right for you), the app also asks you to read what changed and agree again before you continue (Terms Section 16). For any other change, continued use after the effective date means you acknowledge the updated Policy, except where consent is required by law.

13. Contact

Privacy and data-rights requests:

• support@filoah.com

Please include enough detail for us to locate your account and fulfill the request.

© 2026 Filoah LLC. All rights reserved.