Privacy Policy

Effective and last updated September 13, 2026

This policy explains how Revlo handles personal information when you visit revlo.money, create an account, use your financial workspace, link an eligible account, purchase Revlo Plus, or contact support.

1. Scope

In this policy, “Revlo,” “we,” and “us” refer to the operator of the Revlo website. This policy covers Revlo’s handling of your information. Banks, payment processors, and other providers also have their own responsibilities and privacy notices. Our Terms of Service govern use of the website; our Financial Disclosures explain the limits of its calculations and connections.

2. Information we collect

• Account information: the name and email you enter, a unique account identifier, email-verification status, and account and authentication activity. Passwords submitted through Revlo are passed securely to Supabase Auth for authentication; Revlo does not save passwords in its financial-record database. Supabase manages password credentials and sessions.
• Information you enter: account names and balances; transaction descriptions, categories, dates and amounts; budgets; recurring-payment schedules; investment quantities, entered prices and cost basis; assets, debts and financial goals. These records can reveal sensitive details about your finances and activities. Do not enter information about other people unless you have authority to do so.
• Linked-account information: if you choose Stripe Financial Connections, we receive permitted information from Stripe and participating institutions, including connection identifiers, institution and account labels, account type, available account details such as the last four digits, balances, and posted transaction information. Revlo currently requests balance and transaction permissions. Availability varies by institution. Bank login credentials are entered in the bank or connection provider’s flow, not stored as Revlo financial records.
• Subscription and billing information: when you use Stripe Checkout or its billing portal, Stripe collects payment and billing details. Revlo receives customer and subscription identifiers, subscription status and billing-period information to administer access. Revlo does not provide its own form for full payment-card numbers or security codes and does not store those numbers in its financial-record database.
• Technical information: our hosting and service providers process request and security information such as IP address, request time, requested page, browser/device information, response status and errors. We use this information for delivery, troubleshooting and abuse prevention.
• Support communications: your email address, the content you send, and information needed to investigate or respond. Share only what is needed for your request.

The public demo contains illustrative records. Demo edits are temporary. Revlo does not currently implement a generative-AI feature or send your financial records to OpenAI for AI insights. Automatic categories and dashboard summaries use application rules and calculations.

3. How we use information

We use information to authenticate accounts; save and display your records; calculate budgets, reports, investment totals and net worth; retrieve data you authorize from linked accounts; process and manage Revlo Plus subscriptions; send verification, recovery and service messages; answer requests; maintain and secure the service; investigate misuse; and meet applicable legal obligations. We do not use your financial records to make lending, employment, insurance or investment decisions about you.

We do not sell personal information or share it for cross-context behavioral advertising. The current website does not implement advertising pixels or targeted-ad profiles. Service providers may process information for their own permitted purposes, including fraud prevention, as explained in their notices.

4. Providers and disclosures

• Cloudflare: hosts the website and API, stores financial records and provider identifiers in D1, and processes delivery, security and operational data. Cloudflare privacy policy.
• Supabase: provides account authentication, verification and recovery, stores authentication/account information, and uses email delivery services for account messages. Supabase privacy policy.
• Stripe: provides optional financial-account connections, Checkout and billing management. We send your email and a customer association to Stripe when you use these services, and exchange connection or subscription information as needed. Stripe and participating institutions process the information you provide within their flows. Stripe privacy policy.

Information may also be disclosed to service providers assisting with support and email delivery; where reasonably necessary to comply with law, valid legal process, or protect rights and security; and in a business transfer, subject to applicable protections and notice requirements. Your workspace is not a public profile, and the current app does not offer sharing with other Revlo users. Providers and authorized support personnel may process information where needed to operate the service; “private workspace” does not mean that no service provider can access it.

5. Cookies and browser storage

Revlo uses cookies for authentication and session renewal and a preference cookie for the sidebar. Your light, dark or system theme preference is saved in local storage on your device. Stripe and Cloudflare may use cookies or similar technologies in their own flows for operation, fraud prevention and security. Blocking cookies can prevent login or checkout. Clearing local preferences does not delete server-held financial records or cancel a subscription.

Revlo does not change its necessary service processing in response to the older Do Not Track browser signal. We do not currently conduct personal-data sales or targeted-ad sharing for an opt-out preference signal to stop. We will honor applicable legally required privacy choices if those practices change.

6. Your controls and requests

• Records and export: you can edit permitted records and export the transaction/report data supported by the CSV controls while your workspace is accessible. Those CSV files are not a complete account-data export. For access, correction or a broader copy—including after paid access ends—contact us; you do not need to buy a subscription to submit a privacy request.
• Account settings: you can request an email change or a password reset from Settings. Complete the verification steps in the messages you receive; provider settings may require confirmation at both email addresses.
• Bank access: use an available Remove/Disconnect control or contact us to request disconnection, including if your subscription has ended. You may also have controls with Stripe or your institution. Successful disconnection stops future access through that connection; it does not itself erase previously imported transactions or information retained by Stripe or your bank.
• Billing and deletion: manage or cancel Revlo Plus using the Stripe billing portal reached from Settings → Subscription. Account deletion is available in Settings → Account. Cancellation, disconnection, and deletion are different actions. Review the result of each action and contact support if it fails or cannot be completed.

7. Retention and deletion

Financial records are generally retained while your account is open, unless you delete permitted records or request deletion. Canceling Plus or disconnecting a bank does not automatically erase existing records. Account deletion removes your active workspace records and requests removal of your authentication account; if provider removal cannot be completed, the app will identify that further support is needed.

Information may remain in provider backups, security logs, support correspondence, or payment/tax records for legitimate security, recovery, dispute-resolution or legal purposes. Retention depends on the information’s purpose, applicable obligations, and provider backup cycles. We do not promise that every copy disappears immediately or that Stripe or your bank will erase records they are independently required to retain. We will assess deletion requests under applicable law and explain material exceptions.

8. Security and international processing

Revlo uses HTTPS, server-validated authentication, access controls tying financial records to your account, and restricted storage of private service credentials. No online service is guaranteed secure or uninterrupted. Use a unique password, protect your email account and devices, and contact us promptly about suspected unauthorized access. Revlo is not represented as independently security-certified or compliant with a specific regulatory framework merely because a provider has certifications.

Cloudflare, Supabase, Stripe and their service providers operate across jurisdictions. Depending on provider locations and configuration, information may be processed in the United States and other countries with different privacy laws. We do not promise US-only storage. Applicable transfer requirements must be met; using Revlo is not a waiver of your privacy rights.

9. Age restriction

Revlo is intended only for people at least 18 years old who can legally enter a contract. We do not knowingly permit accounts for minors. If you believe a minor has supplied personal information, contact us so we can investigate and take appropriate steps.

10. Privacy rights

Depending on where you live and which laws apply to Revlo, you may have rights to access, correct, delete or receive a copy of personal information; withdraw consent; object to or restrict certain processing; and appeal a denied request or complain to a regulator. Not every privacy statute applies to every business or request. Nothing here limits rights that cannot lawfully be limited.

Send requests to the contact address below. We may reasonably verify your identity and an authorized agent’s authority without asking for your password. We will respond within the period required by applicable law, explain relevant exceptions or verification needs, and will not unlawfully discriminate because you exercise a privacy right. To appeal a decision where available, reply to our response or email us with the subject “Privacy appeal.”

11. Changes

We will update the effective date when this policy changes. For material changes, we will provide an appropriate notice, such as a website notice or an account email, and obtain consent where required before applying a new use of your information. Review this policy when you use a new feature.

Contact

For questions, privacy requests, billing help, or concerns about these documents, email support@revlo.money. Do not send passwords, full card numbers, or bank login credentials.