Privacy Policy

1. Information we collect

1.1 Account information

When you create an account we collect your email address, a password (stored only as a modern salted hash — we cannot read it), your country, currency, and timezone. If you enable multi-factor authentication, we store the enrolment data needed to verify you. If you opt in to text alerts, we store your mobile number and when you consented (section 6a).

1.2 Financial information you enter

The heart of the app is data you type in yourself: budget categories and planned amounts, income, transactions and payees, savings funds, debts and balances, goals, insurance inventory entries, notes, and due dates. This data belongs to your household and exists so the app can do budget maths for you.

1.3 Household and Couple Accord information

If you invite a partner, we store the household relationship between your two accounts. The Couple Accord feature asks each partner to privately record money-story reflections, ranked financial values, and an independent financial snapshot. These responses are private by default and encrypted. Your partner cannot see them — and we do not surface, summarise, or infer anything from them — until you explicitly choose to share them. See section 5.

1.4 Bank connection data (optional)

If you choose to connect a bank account, the connection is made through a regulated financial data aggregation provider (such as Plaid). You authenticate directly with your bank through the provider — we never see, receive, or store your bank username or password. We receive account names, types, balances, and transaction records (date, amount, merchant or payee description) for the accounts you authorise. Access tokens from the provider are encrypted with dedicated keys, separate from other data.

1.5 Payment information (paid plans)

Subscriptions are processed by our billing provider (such as Stripe). Card numbers are entered directly into the billing provider’s secure components and never touch our servers. We receive only your subscription plan, status, and billing period.

1.6 Technical and usage data

Like most web services, our servers log IP address, browser type, and request metadata for security, fraud prevention, and troubleshooting. We record a limited set of product-usage events (for example, “budget balanced” or “next month created”) to understand which features work. These events are deliberately stripped of financial content — see section 7.

1.7 The iPhone and Android apps

The Citadel Money apps sign in to the same account and read and write the same household data on our servers. They collect nothing beyond what is described above, apart from:

• A push token — if you allow notifications, the address Apple or Google issues so we can deliver the reminders you choose. It identifies your phone to the notification service and nothing more.
• Crash and performance reports — when the app crashes, and for a sample of ordinary use, a technical report (device model, operating system, the screen involved, and the error or timing) goes to our error-tracking provider. These reports are not linked to your account, and the contents of the app’s requests are removed before they leave your phone.
• What stays on your phone — your signed-in session, in the phone’s secure keychain; the figures you last saw, kept for up to 24 hours so the app works without a signal, behind the app lock; and any transaction you add while offline, until it is sent. Signing out removes all of it.

The app lock uses your phone’s own Face ID, fingerprint, or passcode check. We never receive biometric data.

1.8 What we do not collect

We never collect or store: your bank credentials, full card numbers, your partner’s unshared Couple Accord responses in readable form, advertising identifiers, or data from third-party ad or tracking networks. Citadel Money contains no advertising SDKs and does not track you across other companies’ apps or websites.

2. How we use your information

• To run the service: calculate your budget, sync your data across devices, and keep your household’s plan current for both partners.
• To import and categorise transactions from bank accounts you have connected.
• To send transactional emails: verification, password reset, partner invitations, sign-in alerts, export-ready notices, and deletion confirmations. These emails never contain your transaction details or balances.
• To send optional budget reminders you control — channel, timing, and cadence are set by you and can be turned off.
• To send the push notifications you turn on in the app. A notification never contains an amount or a payee — a lock screen is more public than an inbox — and each kind can be turned off in the app’s settings.
• Only if you opt in: to send the text messages described in section 6a, to the mobile number you gave us.
• To manage your subscription and unlock paid features.
• To secure the service: detect fraud, enforce rate limits, and investigate abuse.
• To respond to support requests you initiate.
• To improve the product using the sanitised usage events described in section 7.
• Only if your household turns on AI features: to have an AI model write plain-language explanations for a budget draft (section 6). The amounts in a draft are always worked out by Citadel Money itself, and nothing is applied until you confirm it.

What we will never do: we do not sell, rent, or lease your data. We do not use your financial data for advertising or allow anyone else to. We do not build marketing profiles from your transactions. The app never moves your money, and no automated guidance is applied without your explicit decision.

3. Where your data lives

• On our servers — your budget, transactions, and household data are stored in our database, encrypted at rest and in transit, so they can sync between your devices and your partner.
• With our service providers — the specific sub-processors listed in section 6, each under a data-processing agreement, and each receiving only what its function requires.
• Nowhere else — your financial data is not distributed, syndicated, or made available to data brokers, advertisers, or analytics firms.

4. Bank connections

Connecting a bank account is always optional — Citadel Money works fully with manual entry. If you do connect:

• You authenticate directly with your bank through the aggregation provider’s secure interface. Your credentials never pass through Yost Group systems.
• Access tokens are encrypted with dedicated, rotated keys, and decryption is restricted to the sync process alone.
• We display only account names and the last four digits — full account numbers are never shown or written to our application logs.
• You can disconnect an institution at any time in Settings. Disconnecting stops all future imports; previously imported transactions remain in your budget history unless you delete them.
• You may also revoke the provider’s access directly through your bank or through the provider’s own privacy portal.

The aggregation provider’s handling of your data is governed by its own privacy policy, which is presented to you before you connect your first account.

5. Sharing between partners

Citadel Money is built for couples, so it is worth being precise about what your partner can and cannot see:

• Shared by design: the household budget, transactions, accounts, funds, debts, goals, and phase progress. Both members of a household see the same plan — that is the point of the product.
• Private by default: your Couple Accord money-story reflections, ranked values, and draft financial snapshot. Each partner controls if and when these are shared, and can edit before sharing. Unshared responses cannot be retrieved, queried, or inferred by the other partner — this isolation is enforced in our systems and covered by our security testing.
• Personal spending: households can set up personal spending categories for each partner. Your partner sees the allocation totals; transaction-level visibility within those categories is configurable by the household.
• Access control: the household owner can revoke a partner’s access at any time. Material changes to the budget are recorded in an audit trail visible to the household.

6. When we share information

We share data only with the service providers required to operate Citadel Money, and only the minimum each needs:

• Hosting and database providers — store the service’s encrypted data.
• Bank data aggregator — facilitates the account connections you authorise (section 4).
• Billing provider — processes subscription payments (section 1.5).
• Email delivery provider — sends the transactional emails described in section 2.
• Error-tracking and monitoring tools — receive technical diagnostics with financial data redacted.
• Push notification service (Expo) — relays the notifications you turn on in the app, through Apple or Google, to your phone. It receives your phone’s push token and the notification’s text, which never contains an amount or a payee.
• Text message provider (ClickSend) — only if you opt in to text alerts. It receives your mobile number and the message’s text, which never contains an amount, a payee, or a link, and sends it through the mobile carriers.
• Home value provider (RentCast) — only for a home you add with its address on a paid plan. It receives that home’s address and, if you give them, its type, bedrooms, bathrooms and size, to estimate its value — when you add it, when you ask for an update, and once a month after that. It receives nothing else about you or your household. We store the street address encrypted. You can value a home yourself instead, and nothing is sent.
• AI model provider (Anthropic) — only if a member of your household turns on AI features in Settings › Privacy, which is off by default. For each budget draft it receives the month, your category and group names, the planned and spent amounts behind each proposed change, what is left to assign, and your Citadel Map phase. For each question to Ask Citadel it receives the question, the last few messages of that conversation, and the figures looked up to answer it: budget line and category names with their planned, spent and remaining amounts, spending by month, your Citadel Map phase and progress, your emergency fund, your debts by the names you gave their budget lines with what they owe, and your net worth totals. It never receives your payees, account or bank names, account numbers, individual transactions, or Couple Accord answers. We do not keep your questions or the answers. Either partner can turn this off at any time.
• Legal requirement — we would disclose information only if compelled by valid legal process directed at us, and we would notify you unless legally prohibited.

Every provider operates under a data-processing agreement. None may use your data for its own purposes. We do not sell or share personal information for cross-context behavioural advertising as defined by the CCPA/CPRA.

6a. Text messages (SMS)

Text alerts from Citadel Money are sent by Yost Group LLC, only to a number you add and confirm in Settings › Security, and only after you tick the consent box there.

• Your mobile number is never sold, rented, or shared with third parties or affiliates for their marketing or promotional purposes. Text opt-in data and consent are not shared with any third party, except the text message provider and carriers that deliver the messages you asked for.
• We send transactional messages only: confirmation codes, security notices, and the alerts you choose. Message frequency may vary. Message and data rates may apply.
• Reply STOP to any message to opt out, or HELP for help. You can also email info@yost.group.
• We keep a record of when you consented and, if you reply STOP, when you opted out, so that no further texts are sent to that number.

The rest of the program’s terms are in section 8a of the Terms of Service.

7. Analytics

We measure how the product is used so we can improve it — but our analytics are deliberately blind to your finances. Usage events are limited to feature actions and coarse buckets (for example, “transaction created — split: yes”).

Analytics events never include: dollar amounts, balances, payee or merchant names, transaction descriptions, notes, account names or identifiers, email addresses, or anything from Couple Accord responses.

8. Data retention and deletion

• Deleted transactions: recoverable by you for 30 days, then permanently removed.
• Export: you can export your budgets and transactions to CSV, and request a complete copy of all personal data we hold, at any time from Settings.
• Account deletion: you can delete your account and household data from Settings. Deletion requires identity re-verification (to protect you from someone else destroying your financial records), followed by a short recovery window, after which data is permanently removed from production systems and rotated out of backups on our standard backup schedule.
• Bank connection tokens: deleted when you disconnect an institution or delete your account.
• Push tokens: switched off when you sign out on that phone, sign out everywhere, or uninstall the app, and deleted 90 days later; deleted with your account.
• Mobile number: deleted when you remove it in Settings › Security or delete your account. Records of texts sent are deleted after 30 days.
• Billing records: retained as required by tax and accounting law.
• Households with two members: deleting your own account removes your personal data; shared household records that your partner also owns (the joint budget) remain with the household unless the household itself is deleted by its owner.

You may also email us to request access, correction, or deletion of any data we hold. We respond within 30 days.

9. Security

• TLS encryption for all traffic; encryption at rest for databases, backups, and file storage.
• Passwords hashed with a modern memory-hard algorithm (Argon2id class); we never store or transmit them in readable form.
• Bank provider tokens and private Couple Accord responses encrypted with separate, rotated keys.
• Multi-factor authentication available, and required for sensitive actions such as changing your email, exporting all data, deleting your household, or managing bank connections.
• Authorisation checks on every request so one household can never read another’s data — verified by automated security tests.
• No full account numbers or financial details in application logs or error reports.
• Independent penetration testing and continuous dependency and secret scanning.

No online service can promise perfect security. If a breach affects your personal data, we will notify you and the appropriate authorities as required by law, and tell you plainly what happened and what we are doing about it.

10. Not financial advice

Citadel Money provides budgeting tools and educational guidance built on the Citadel Map framework. It does not provide individualised investment, tax, insurance, or legal advice, and it never executes trades, changes payroll contributions, cancels insurance, refinances loans, or moves money. Every recommendation in the app requires your explicit decision before anything is applied to your plan.

11. Children’s privacy

Citadel Money is a financial service intended for adults. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Education-planning features may store information about your children that you enter (such as a name and target college year) — that data is part of your household record and is protected and deletable like everything else. If you believe a child has created an account, contact us and we will delete it promptly.

12. Your rights (GDPR / CCPA)

If you reside in the EEA, UK, or California, you have the right to:

• Access the personal information we hold about you.
• Correct or delete it.
• Object to or restrict processing.
• Receive a copy in a portable format (available directly in Settings as CSV and full export).
• (CCPA) Opt out of “sale” or “sharing” of your data — we do neither.

To exercise any of these rights, use the tools in Settings or email us at the address below. We do not discriminate against users who exercise these rights. Note that one partner cannot use these rights to obtain the other partner’s private, unshared Couple Accord responses.

13. Changes to this policy

We will update this page when we make material changes and revise the “last updated” date above. Material changes — especially anything affecting bank data, partner sharing, or retention — will be announced inside the app before they take effect.

Contact

Questions, requests, or concerns about this policy or your data? Reach out directly — we respond to every message.

Yost Group LLC — Rick Yost
rick@yost.group