Privacy Policy

Your investments are personal. We collect as little as we can, keep it locked down, and never sell it. This page explains what we collect, why, who else handles it, and how you stay in control.

1. What We Collect

• Account: your email address, your password (stored only as a secure hash, so we can’t see it), your display name, and your settings, such as text size and dark mode.
• Your consent: the date and version of these documents you agreed to when you signed up.
• Your plan: what you add yourself: your goal and goal date, contributions, holdings (names, tickers, amounts, shares and prices), account types, hold horizon, confidence, your notes on why you bought something, your target mix and planned contributions.
• Linked accounts, only if you link one. See below.
• Basic technical information sent with every request, such as IP address, browser type and time. It appears in our providers’ short-lived logs, used for security and to keep things running.

We don’t collect your Social Security number, full account numbers, location, contacts, advertising identifiers, or what you do on other websites or apps.

Linked brokerage and retirement accounts

• Linking is optional and works through Plaid. You sign in through Plaid’s window; Invest Ahead never sees or stores your brokerage username or password. Plaid handles that sign-in under its own privacy policy.
• What we receive and keep: your institution’s name; each investment account’s name, type, last few digits, currency and balance; each holding’s name, ticker, type, shares, price, value and cost; and the account’s transactions, such as buys, sells, deposits, dividends, interest and fees. We also keep Plaid’s identifiers and the access key that lets us fetch updates. We don’t receive your full account number.
• What we do with it: show you what you own, what you’ve put in and your account’s activity. Access is read-only: Invest Ahead has no feature that buys, sells or moves anything.
• Unlinking: when you unlink, or delete your account, we ask Plaid to remove the connection and we delete the access key and the account data we stored. Contributions you logged yourself stay until you delete them.
• You can also see and manage what Plaid holds at my.plaid.com.

2. How We Use It

• To run Invest Ahead: showing you your plan, portfolio, projections and planning tools.
• To sign you in and keep your account secure.
• To send account emails you need, such as confirming your email address and password resets.
• To answer your messages and fix problems.
• To prevent abuse and fraud, and to meet legal obligations.

We don’t build advertising profiles, send marketing emails, or use your data to train AI models. We don’t make decisions about you with legal or similarly significant effects based on automated processing.

3. Who Else Sees Your Data

A small number of providers help run Invest Ahead. Each gets only what it needs for its job:

• Supabase: database, sign-in and account emails.
• Our hosting provider: serving the app, with short-lived request logs.
• Plaid: connecting your brokerage and sending us its data, only if you link one.

When the law requires it. We share information only in response to a valid legal request, or when it’s needed to protect someone from serious harm, and as little as possible.

If Invest Ahead changes hands. Your information stays protected by this policy, and we’ll tell you beforehand so you can delete your account first.

That’s everyone. We don’t sell your personal information, or "share" it for cross-context behavioral advertising, as California law defines those terms.

4. How We Keep It Safe

• Everything travels encrypted (HTTPS), and the database is encrypted at rest.
• Access rules in the database itself make sure each account can read only its own data.
• Passwords are stored only as secure hashes.
• The access key for a linked account is encrypted on our server before it’s stored.

No system is perfectly secure. If a breach affects your personal information, we’ll tell you, and the authorities where required, as quickly as the law requires.

5. How Long We Keep It

• Your data is kept while your account is open.
• When you delete something, it’s removed. When you delete your account in Settings, your data is permanently removed and linked accounts are disconnected.
• Copies in our providers’ backups roll off on their normal schedule, within about 30 days.

6. Cookies

We use only what the app needs: sign-in cookies to keep you signed in, and small preference cookies for text size and dark mode. Your browser may also remember small things on your device, such as an intro you’ve already seen. No analytics, advertising or third-party cookies, so there’s no cookie banner.

7. Your Rights and Choices

• See your data: everything we hold about you is shown in the app.
• Correct it: edit your entries and display name.
• Delete it: delete entries, unlink accounts, or delete your whole account in Settings.
• Get a copy of your data, or ask any question about it, by emailing us.

Depending on where you live (for example California and other U.S. states, the EU, the UK or Canada), you may have further rights, such as to object to or restrict processing, withdraw consent, or appeal a decision on a request. We honor these rights, won’t treat you differently for using them, and answer within 30 days. We may need to confirm it’s really you first. You can also complain to your local data protection authority.

8. Where Your Data Is Processed

Invest Ahead and its providers may process your information in the United States and other countries, with appropriate safeguards where the law requires.

9. Children

Invest Ahead is for people aged 18 and over (see the Terms). We don’t knowingly collect information from children under 13. If you believe a child has given us information, contact us and we’ll delete it.

10. Changes and Contact

We’ll update this page when Invest Ahead changes; the date at the top shows the latest version. For a significant change, we’ll tell you before it takes effect.

Questions or requests: email support@helmlife.app.