Privacy Policy

Effective October 14, 2026

The short version

We collect what you put into Sphinx Money and what we need to run it securely. Nothing more.
We never sell your data, never share it for advertising, and there are no ads, analytics trackers or third-party scripts in the app.
We don't connect to your bank. You decide what goes in, by entering or importing it yourself.
You can export your data and delete your account at any time. Deletion is permanent.

1. Who we are

Sphinx Money (the "Service") is operated by Happy Raccoon, LLC ("we", "us" or "our"), Albuquerque, New Mexico, USA. We are responsible for the personal information described in this policy. Questions? Write to support@sphinx.money.

2. Information we collect

Information you give us

Account details: your email address, username, first and last name, password (stored only as a one-way hash), passkeys (we store the public key, never your device's private key), profile photo, language, region and currency preferences.
Financial information you enter or import: accounts and balances, transactions, merchants, categories, tags, notes, credit card statements and payments, budgets, goals, recurring items, investment holdings and activity, retirement plan inputs, and real estate or other assets you own.
Files: attachments such as receipts, statements, warranties and documents you upload, and files you import (such as CSV exports from other apps).
Household information: who you invite to a household and the data you choose to share or split with them. If you add information about another person, please make sure they are comfortable with it.
Messages to us: anything you send when you contact support.

Information from sign-in providers

If you sign in with Google or Apple, that provider tells us your name, email address and whether your email is verified, along with an identifier for your account with them. We don't receive your password for those services and we don't ask for access to your contacts, files or anything else.

Information collected automatically

Technical and security logs: IP address, browser or device type, the time and type of request, and error information. We use these to keep the Service running, debug problems and prevent abuse. Our request logs don't record URL query strings.
Session information: a record of each active sign-in, including its IP address and browser, so sessions can expire and you can sign out of your other devices.

We do not knowingly collect sensitive categories of information such as health data. Please don't put Social Security numbers, full card numbers or account passwords in notes or attachments.

3. Cookies and local storage

We use only what the Service needs to work:

a session cookie that keeps you signed in (httpOnly, so scripts can't read it);
a security cookie that protects against cross-site request forgery;
local storage in your browser for preferences such as theme, language, the selected period and dashboard layout;
when a property map is shown, Mapbox's map component keeps a random identifier in local storage, replaced every 24 hours, so Mapbox can count map loads (see section 5).

We don't use advertising cookies, cross-site tracking, or third-party analytics. Because these cookies are strictly necessary, there is no cookie banner.

4. How we use your information

To provide the Service: store your data, calculate balances, reports and performance, and show it to you and the household members you share with.
To create and secure your account: verify your email, sign you in, detect suspicious activity and enforce rate limits.
To communicate with you: account and security emails (verification, password reset), important changes to the Service or these policies, and replies to your support requests. We don't send marketing email without your consent.
To maintain and improve the Service: fix bugs, monitor performance and plan capacity, using technical logs rather than your financial details wherever possible.
To comply with the law and protect our rights and those of our users.

We don't sell your personal information, we don't share it for cross-context behavioral advertising, and we don't use your financial data to build marketing profiles or to train third-party AI models.

Where the EU or UK GDPR applies, our legal bases are: performing our contract with you (running the Service), our legitimate interests (security, fraud prevention and improving the Service, balanced against your rights), compliance with legal obligations, and your consent where we ask for it.

5. Who we share it with

We share personal information only with service providers that help us run the Service, under agreements that limit their use of it to providing services to us, and only as much as each needs:

Provider	What for	What they receive
Cloudflare	Network delivery, TLS and protection against attacks	Network traffic to and from the Service, including IP addresses
Resend	Sending account emails	Your email address, name and the email content
Google, Apple	Sign in with Google or Apple, if you choose it	The sign-in request; see section 2
Mapbox	Address search and maps for assets and real estate, when you use them	The address text you search for (sent by our servers). When a property map is shown, your browser loads it directly from Mapbox, which receives your IP address, the map's location and a map-load record Mapbox uses for billing; we turn off Mapbox's optional performance metrics
RentCast	Property value estimates, when you request one	The property address

To show market prices, exchange rates, dividends and institution logos, our servers request public data from providers such as Yahoo Finance, Parqet, Financial Modeling Prep and Google's favicon service, and serve the results to you from our own domain. Those requests contain ticker symbols, currency codes or website domains only, never your identity or account information.

We may also disclose information:

To household members you invite, limited to the data you share with that household.
For legal reasons, when we believe in good faith it is required by law, subpoena or court order, or necessary to protect the safety, rights or property of our users, the public or us. Where allowed, we will tell you about requests for your data.
In a business transfer, such as a merger or acquisition, in which case this policy will continue to apply to your information and we will notify you.

6. How long we keep it

Your account and content are kept for as long as your account exists.
When you delete your account, your account, financial data and uploaded files are deleted from our live systems right away. Copies may remain in encrypted backups for a limited period until those backups are overwritten on our regular rotation.
Technical and security logs are kept only as long as needed for security and troubleshooting, and then deleted.
We may keep limited information longer when the law requires it or to resolve disputes.

7. How we protect it

All traffic to the Service is encrypted in transit with TLS. Passwords are stored as salted one-way hashes, and sign-in links and reset tokens are kept only in hashed form. Access between users is enforced on our servers on every request, so one user can never read another's data unless it was shared through a household. Access to production systems is restricted to the people who operate the Service. No method of storage or transmission is perfectly secure, but we work hard to protect your information, and we will notify you and the relevant authorities of a breach affecting your personal information as the law requires.

8. Your choices and rights

Wherever you live, you can:

Access and correct your information directly in the Service and in Settings.
Export your transactions from the Service, or ask us for a copy of all the personal information we hold about you.
Delete your account and its data at any time from Settings → Security.
Revoke Sphinx's access to your Google or Apple sign-in from that account's settings.

Depending on where you live (for example under the GDPR in the EU and UK, or under the California Consumer Privacy Act and other US state privacy laws), you may also have the right to restrict or object to certain processing, to data portability, to withdraw consent, and to not be discriminated against for exercising these rights. To exercise any right, email support@sphinx.money from the address on your account. We will respond within the time the law requires (usually 30 to 45 days), and we may need to verify your identity first. You may use an authorized agent where the law allows. If you're in the EU or UK, you can also lodge a complaint with your local data protection authority.

9. International transfers

We are based in the United States, and your information is processed and stored there and in the other countries where our service providers operate. Where the law requires it, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, for these transfers.

10. Children

The Service is not intended for anyone under 18, and we don't knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the Service evolves. If a change is material, we will tell you by email or in the Service before it takes effect. The date at the top shows when it last changed.

12. Contact

Happy Raccoon, LLC
Albuquerque, New Mexico, USA
support@sphinx.money