Privacy Policy

1. Who operates Tabula

Tabula is operated by [INSERT LEGAL OPERATOR NAME] ("we", "us"). Privacy questions and requests may be sent to [INSERT PRIVACY CONTACT EMAIL]. These placeholders must be replaced before this page is submitted to Google OAuth branding review.

2. Information we collect

• Account and sign-in information: name, email address, authentication identifiers, password authentication records (passwords are intended to be stored as one-way hashes), verification status, and session information.
• Financial tracking information you enter: region, bank name, account type, last four digits of an account number, balance amounts, effective dates, and historical balance snapshots.
• Google sign-in information: when you choose Google sign-in, the app requests basic identity information needed for authentication, such as your email, name, and Google account identifier. It does not request access to Gmail, Google Drive, or your bank accounts.
• Operational information: information required to maintain security and diagnose issues, which may include request metadata such as IP address, device/browser characteristics, and application logs collected by hosting and authentication infrastructure.

3. How we use information

We use information to create and protect user accounts, authenticate sign-ins, send account verification or password-reset emails, display balances and historical trends, generate user-requested Excel/PDF exports, prevent misuse, troubleshoot errors, and operate the service.

4. Service providers

Tabula's current architecture uses Vercel for application hosting, Supabase PostgreSQL for data storage, Better Auth software for application-managed authentication, Resend for transactional email where configured, and Google when you elect to use Google sign-in. Each provider may process relevant information as required to perform its function, subject to its applicable terms and privacy commitments. This list should be reviewed if the deployment changes.

5. Cookies and sessions

Tabula uses authentication cookies or comparable session technologies to keep you signed in and to protect authenticated pages. Disabling essential cookies may prevent sign-in. We do not describe marketing or analytics cookies here; if such tools are added, this policy must be updated accordingly.

6. Sharing and disclosure

We do not design Tabula to sell your financial tracking information. Information may be processed by the service providers identified above, disclosed when legally required, or shared at your request—for example, when you download or distribute an exported report. You are responsible for safeguarding any reports you download.

7. Storage, security, and retention

Tabula is designed to keep database credentials on the server and limit account-record access to the authenticated account owner. No online system can promise absolute security. Data is retained while needed to provide the service, meet legitimate operational requirements, or comply with applicable law. The operator must establish and document actual retention and deletion timelines before claiming a specific schedule.

8. Your choices and requests

You may update or remove tracked accounts through the app's available features and request access, correction, or deletion of personal information by contacting [INSERT PRIVACY CONTACT EMAIL]. Removal of a tracked account does not necessarily delete the login identity or all operational records. Requests will be handled subject to applicable legal and security obligations.

9. Children

Tabula is not intended for children under 18. If an operator learns that a child submitted personal information, they should contact the privacy address above for review and appropriate action.

10. Changes and contact

We may update this policy as the product or applicable requirements change. The effective date above will reflect published revisions. For questions, contact [INSERT PRIVACY CONTACT EMAIL].