Privacy notice
Allende is a place for a family to see its money together and plan what happens next. That only works if you trust it with information about your money, so this notice says plainly what Allende collects, what it does with it, who else sees it, how long it keeps it, and how you delete it.
What Allende collects
| What | Where it comes from | Why |
|---|---|---|
| Your name and email address, and a Google account identifier | Google sign-in | To know which account is yours. Allende asks Google only for openid email profile and stores no Google tokens. |
| What you tell Allende about your money: income, bills, accounts, balances, commitments, goals, and the conversation itself | You, in conversation with the agent or in forms | To build and keep your household's financial picture. |
| Account names, balances and transactions from a bank you connect | Plaid, when you choose to connect a bank | To keep the picture current without you typing it in. |
| Documents you upload or that Allende downloads on your instruction (statements, bills) | You | To read facts off them, which you confirm before they count. |
| Technical logs: request times, errors, sign-in attempts | Your browser, automatically | To keep the service running and to detect abuse. Logs never include account numbers, balances or message text. |
Allende does not collect your bank password. Connecting a bank happens on Plaid's own pages; Plaid gives Allende a token that Allende stores encrypted.
Who else sees it
Allende uses a small number of services to work. Each sees only what its job needs.
- Members of your household. Allende is built around the idea that some things are shared and some are private. What each person can see is decided by the record itself — a transfer between two people is visible to both; someone's account balance is visible only to them. Nobody, including the household's creator, can read another member's private data.
- Google handles sign-in. Google's own privacy policy applies to your Google account.
- Plaid connects your bank when you choose to. Plaid's End User Privacy Policy applies to that connection, and you can manage or revoke it at my.plaid.com.
- AI model providers. The agent you talk to is a large language model. To answer you, Allende sends your message, recent conversation, and the parts of your household's picture the model needs to that provider (currently via OpenRouter and Anthropic). They use the data only to generate the response; Allende uses them under settings and terms that exclude training on your data. Allende never sends bank credentials or Plaid tokens to a model.
- Kernel runs the browser window that opens when you or Allende visit a website inside Allende. The page you see is rendered on Kernel's servers in the United States and streamed to you; what you type into it, including anything you type privately, goes to that website through Kernel's browser, and your signed-in session on that website is kept there, encrypted, so you do not start over next time. Kernel does not see the rest of your household's picture. Its privacy policy applies to that window.
- The people who run Allende. When they help you get set up, they can see your setup progress, your connections, and your recent conversation, and may ask the AI model about it. They never see your passwords or codes.
- Google Cloud hosts Allende. Data is stored in the United States on encrypted disks.
- Stripe, if you subscribe, handles payment. Allende never sees your card number.
Allende does not sell your data, does not share it with advertisers, and does not use it for any purpose other than running Allende for you.
How it is protected
- Everything travels over TLS 1.2 or better, and is stored on encrypted disks.
- Bank tokens and other credentials are additionally encrypted with a separate key, in a store that the main application database role cannot read.
- Every database query runs under row-level security keyed to the signed-in person, so one member cannot read another's private data even if the application had a bug.
- You can turn on two-step verification with an authenticator app. Allende requires it before a bank can be connected.
- The full security policy Allende operates under is published as a PDF. This notice is also available as a PDF.
How long it is kept
- Your household's records are kept for as long as your account exists, because a financial history that forgets is not useful.
- Sign-in sessions expire after 12 hours idle or 7 days at most. Expired sessions, sign-in attempts and other operational rows are purged automatically within 30 days.
- Technical logs are kept for 30 days.
- Backups are kept for at most 30 days, after which they are deleted.
Deleting your data
You can delete your account yourself, at any time, from Settings → Account → Delete my account. Deletion is immediate and cannot be undone:
- Any bank connections are removed at Plaid first, so no token to your bank survives anywhere.
- Your conversations, documents, accounts, observations and connections are deleted.
- A household that only you belong to is deleted entirely.
- In a household you share with others, records you share with them — a transfer between you, a commitment you both agreed to — stay with them, with your name removed. Their picture should not lose its history because you left.
- A single line in the audit log records that an erasure happened, with no personal data.
- Copies in backups age out within 30 days.
If you would rather someone else do it, or you cannot sign in, email the address below and it will be done within 7 days.
Your rights
Wherever you live, you can ask to see what Allende holds about you, correct it, export it, or delete it, and you can withdraw consent at any time by deleting your account. Allende does not make automated decisions with legal effect about you; the agent proposes, and people in your household decide.
Children
Allende is for adults managing a household's money. It is not directed at anyone under 18, and does not knowingly collect their data.
Changes
When this notice changes materially, you will be asked to read and agree to the new version the next time you sign in. The version date at the top always identifies what you agreed to.
Contact
Louis Anderson, who builds and operates Allende.
louisanderson2301@gmail.com