Privacy Notice

1. Who operates your account

The person or organization identified on the sign-in or account-creation screen operates this instance and is responsible for its handling of your information. Rooted Wealth can be installed on different servers; creating an account here does not create an account on every installation.

This notice describes the supplied Rooted Wealth features. Hosting, email delivery, security services, and backups depend on the operator’s deployment. Contact the operator for the location of its server, its service providers, or its retention practices.

2. Information collected

• Account information: your account identifier or username, email, password hash, verification status, account role, creation date, and any optional profile image. Self-service signup requires an email for verification and account recovery. A legal name, birth date, mailing address, or government identifier is not required for signup.
• Financial information you provide: portfolios, holdings, transactions, assets, debts, property details, scheduled and actual expenses, recurring income, distributions, tax assumptions, imports, and settings.
• Connected-service credentials: API keys you choose to save for market data, property estimates, or AI features. Credentials are used to authenticate the applicable provider requests.
• Security information: session records, verification and recovery-token records, terms-acceptance version and time, including account-specific Tax Planning Beta acknowledgments, access timestamps and IP addresses, and abuse-prevention signals. Administrators can view this app’s recent sign-in and IP activity history, retained for up to 90 days and limited to the latest 5,000 records per account. Hosting or proxy systems may also produce access and error logs.
• Plant progress: completed setup steps, plant level, XP, daily check-in streak and your plant-icon preference are saved to your account. Administrators can view plant progress and current streaks. These are app engagement features and do not measure investment returns.
• Instance usage metrics: daily active-account counts, account creation counts, page openings and navigation clicks, and approximate connected-user counts. Public signup progress is linked using a keyed email hash, without storing another copy of your email. Administrators see aggregate metrics; no financial records, searches, message text, or external analytics services are used for these metrics. Usage records are retained for up to five years. Account-linked activity is removed when the account is deleted; non-identifying aggregate counts remain until expiry.
• Feature information: market-data caches, generated summaries, and the prompts, conversation, and financial context submitted when you use an AI feature.

Do not place passwords, API secrets, identity documents, or information about other people in record names, notes, imports, or AI messages. Automated exclusions cannot reliably identify sensitive text you enter in free-form fields.

3. Why it is used

Information is used to create and secure your account, verify your email, help you recover access, save your records, calculate and display your financial views, retrieve requested data, provide connected features, and respond to support requests. Security information helps prevent abuse and investigate unauthorized access. Terms-acceptance records document the agreement made when creating an account.

Verification, recovery, and essential account notices are transactional messages. Supplying an email for account recovery does not subscribe you to marketing.

4. Connected services and other access

• Market, news, and property providers: requests can include ticker symbols, public article URLs, or property addresses and links needed for the feature. Providers may include Yahoo Finance, Alpaca, property websites, and RentCast when configured.
• AI Chat: when you send a message, the selected OpenAI or Google Gemini service receives your message, included conversation, and a summary of financial records and estimates across the app. For Gemini, review Google’s API terms: data handling differs between paid and unpaid services. The automatic context excludes login credentials, API keys, and dedicated property address/link fields. Free-form text you supply can still contain personal information.
• Receipt scanning: the default local scan processes the photo on this instance and sends nothing to an external OCR service. If you explicitly select AI analysis, that provider receives the receipt image to suggest editable fields. The app does not retain receipt images; only fields you confirm are saved as expenses. Hosting and proxy systems may temporarily buffer uploads. You can instead view the photo locally in your browser and enter the fields yourself.
• AI expense summaries: when you request a summary, your selected AI provider receives the selected month’s recorded adhoc total, up to 30 category totals, and the dates, descriptions, categories and amounts of up to 30 largest expenses. Notes and receipt images are excluded. Summaries are not generated automatically.
• AI news summaries: when AI is enabled, summaries may be generated as the relevant panel loads. Public article material, ticker context, and coarse relevance ranks are sent to your selected AI provider. Exact balances, quantities, and account names are excluded from these news-summary requests. A cached summary can be reused until refreshed or replaced.
• Optional AI web search: if enabled, search queries and related processing may involve search providers. Review the app’s AI settings before enabling it.
• Email delivery: the operator’s mail provider receives your email address and transactional message content to deliver verification, recovery, and account notices.
• Bot protection: if Cloudflare Turnstile is enabled, Cloudflare processes IP and browser/device security signals to distinguish people from automated traffic. See its Turnstile Privacy Addendum.
• Instance administrators and hosting providers: authorized operators can manage accounts, view account access details, back up or clear user data, and access stored files as part of operating the instance. Account separation does not make information inaccessible to the server operator.

Third parties process information under their own terms, privacy notices, and retention policies, potentially in other countries. The standard app does not include advertising trackers or a feature for selling account records. An operator must disclose any additional integrations or uses before introducing them.

5. Storage and security

Web accounts and records are stored on the server or NAS that hosts this instance. The standalone Android edition uses local app storage for its own records; its connected features still communicate with their providers. Exported backups are separate files controlled by whoever downloads or stores them.

JSON exports and downloaded database/recovery backups offer password protection, selected by default. Encryption and decryption use your browser or Android app interface; the backup password is not sent to the server. Keep it safe: it cannot be recovered or reset, and changing your login password does not change existing backup files. Encrypted downloads are temporarily held as ciphertext in server memory for delivery. This feature does not encrypt active databases, internal recovery copies, readable reports or CSV exports. Older unencrypted backups remain readable and importable.

Passwords are stored as password hashes rather than readable passwords. Account access controls and security protections reduce risk, but no system can guarantee against every breach, error, or loss. Stored records and saved API credentials are not end-to-end encrypted from the operator. The operator is responsible for deployment security, access restrictions, HTTPS, and backup handling.

6. Cookies and device storage

The app uses an essential session cookie for authentication and browser or device storage for app state and preferences. “Keep me signed in” permits a longer-lived session on that device. Logging out ends that device’s current session; it does not remove downloaded backups. Configured bot-protection or hosting services may use additional security storage.

7. Access, correction, and account deletion

You can review and edit your financial records in the app and export them through Backup & Restore. To delete your account, use the account deletion option in Settings → Account. Deletion removes your active account and associated app records, including saved API credentials and profile image, and ends its sessions. You can delete your account even when it is the only administrator account.

You can also request deletion without signing in or reinstalling: contact the support address on the sign-in screen from your account email and identify the instance and account. Do not send your password or recovery tokens. The operator may need to verify control of the account before acting. Use the same contact for account corrections or access to personal information.

The operator should explain the expected completion time and any information that must be retained for a lawful reason. Deletion does not erase copies you exported or independently supplied to third parties. Where a provider processed data on the operator’s behalf, the operator must address applicable deletion duties with that provider.

8. Retention

Account and financial records remain while your account is active or until removed. Security, acceptance, and support records may be retained only as reasonably needed for security, dispute resolution, or legal obligations. Expiring a recovery link makes it unusable but does not necessarily erase every related delivery or security log immediately.

Manual exports, recovery copies, server snapshots, and email-provider logs can outlast deletion of live records. Their retention depends on the operator and providers. Ask the operator for its backup deletion schedule and any specific retention period; retained backups should remain access-restricted and should not be used to restore a deleted account except where legally required.

9. Your rights and children

Depending on where you live and which laws apply to the operator, you may have rights to access, correct, delete, or receive a copy of personal information, restrict or object to processing, or complain to a regulator. Contact the operator to exercise applicable rights. Agreeing to the Terms of Service does not waive these rights or substitute for any separate consent required by law.

The Service is intended for adults 18 or older. The operator does not intend to collect children’s personal information. Contact the operator if you believe a child has created an account or provided information.