MoneyRoom can
- Read balances and transactions you authorize through Plaid.
- Organize cards, benefits, usage, points, and spending in your workspace.
- Use connected activity to support tracking and recommendation features.
Security & Trust / Architecture first
Understand the boundary.
A finance product should show where access begins, where it ends, and which controls remain yours. This is the operating model behind MoneyRoom.
How the connection works
A limited path, drawn in full.
The connection has five distinct stages. The line below is the entire path from institution sign-in to the data products MoneyRoom requests.
Your bank password never touches our servers. MoneyRoom receives a short-lived public token from Plaid, not the credentials entered in Plaid Link.
MoneyRoom exchanges the public token for a Plaid access token. We store the access token encrypted and decrypt it only when making an authorized request to Plaid.
Read-only, by construction. The configured products read balances and transactions; MoneyRoom does not configure payment or transfer products.
Capability boundary
What a connection can do — and what it can't.
Connected data can make the product useful. It does not give the product authority to act on the underlying account.
MoneyRoom cannot
Move money or initiate a payment through the Plaid products it requests.
MoneyRoom does not receive the bank credentials entered in Plaid Link.
Data map
Identity and app data stay separate.
The system resolves a signed-in identity first, then uses that owner boundary for app-data access and diagnostics.
- A
Supabase Auth
Account authentication, sign-in sessions, and identity recovery.
- B
Turso / libSQL
Cards, benefits, usage, connected activity, and app preferences.
- C
Owner boundary
Reads are scoped to the resolved owner and fail closed when the required owner context is missing.
- D
Scrubbed diagnostics
Request bodies, headers, cookies, query strings, and direct user identity are removed or scrubbed before an error event is sent.
Control surfaces
The exit controls are part of the product.
The same Settings area that manages the workspace also exposes portability, connection, notification, and account controls.
Export
Download a full JSON backup or focused cards, credits, and usage CSV files.
Settings / AdvancedDisconnect
Remove a connected institution and begin Plaid item revocation.
Settings / ConnectionsDelete
Delete the account through a confirmed flow that cancels billing, removes the auth identity, and purges owner-scoped app data.
Settings / AdvancedNotifications
Choose the iOS push notification categories that are useful to you.
Settings / Push notificationsThe reminders we send name card nicknames and credit amounts only - never account numbers, masks, or tokens.
Processors & policies
Named systems. Direct policy paths.
MoneyRoom's policies name the principal processors involved in delivering the service and explain the categories of data they handle.
01Plaid
Connected-account data you authorize
Policy02SupabaseAccount authentication and sign-in
Policy03TursoApplication database hosting
Policy04SentryScrubbed error diagnostics
Policy05VercelApplication hosting and aggregate usage analytics
PolicyWe do not sell your personal information.
Honest limits
Resilience is not the same as certainty.
- 01
Connected data can be delayed, unavailable, or stale. MoneyRoom cannot make a third-party data source more current than the source itself.
- 02
If Plaid cannot confirm removal, the encrypted token is retained in a revoke-only retry record while local cleanup proceeds.
- 03
Account deletion purges owner-scoped app data; the Privacy Policy describes narrow legal, tax, fraud-prevention, security, and audit retention exceptions.
The threshold
Review the boundary. Then decide.
MoneyRoom is designed to make a private financial workspace useful without giving it authority over the accounts it reads.
Start free