Privacy Policy

Last updated: September 3, 2026

1. Introduction

Outlai ("we", "our", "us") operates the Outlai personal finance application and website (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

Account Information

When you create an account, we collect your name, email address, and a hashed version of your password. We never store passwords in plain text.

Financial Data

We collect transaction data that you manually enter or import, including amounts, descriptions, dates, and categories. If you use bank sync features, we collect account and transaction data through our third-party provider (Plaid).

Usage Data

We may collect information about how you access and use the Service, including your device type, browser type, IP address, and pages visited.

AI Processing Data

We ask your permission in the app before any of this is sent, and nothing is sent until you agree. You can withdraw that permission at any time under Settings › AI & data; the AI features then stop working and the rest of Outlai continues as normal.

Outlai's AI features are provided by two third-party AI services. This is exactly what each one receives:

Anthropic, PBC (Claude) — chat, Smart Add, receipt scanning, statement import, recommendations

• The text you type to Otto, and any receipt photo or bank statement file you choose to attach
• Transactions relevant to your question: merchant name, amount, date, currency, category, account name, whether the charge is pending or recurring, and any note or tag you added
• Aggregated spending summaries, your budgets, and your recurring charges
• Your preferred currency and timezone

Groq, Inc. — voice input only

• The audio recording of a voice message, so it can be transcribed to text. Audio is sent only while you are actively using the microphone.

Never sent to either service

• Your name or email address
• Your password or authentication tokens
• Any payment method, card, or billing details
• Bank credentials or account numbers

How it is used, and for how long. Both services process this data solely to produce the result you asked for — an answer, a parsed receipt, a transcription. Under Anthropic's and Groq's commercial terms, your data is not used to train their models, is not sold, and is not shared onward. Both are bound by contract to protections equivalent to those described in this policy. We do not send your data to any other AI service.

Requests are sent from our servers over encrypted connections when you use an AI feature; we do not send your data to these services in the background or on a schedule.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process transactions and categorize your spending
• Generate spending insights and recommendations
• Process payments and manage subscriptions
• Send you service-related communications
• Detect and prevent fraud or abuse

4. Data Sharing

We do not sell your personal information. We may share data with:

• AI services: Anthropic, PBC (AI answers, parsing and recommendations) and Groq, Inc. (voice transcription) — only after you have given permission in the app, only when you use an AI feature, and only the data itemised in section 2. Neither uses your data to train their models. See "AI Processing Data" above for the full list.
• Other service providers: Razorpay and Paddle (payments), Plaid (bank connections), Resend (transactional email), and Fly.io (hosting) — only as necessary to operate the Service
• Legal requirements: When required by law, regulation, or legal process

5. Data Security

We implement industry-standard security measures including:

• AES-256 encryption for sensitive data at rest
• TLS/HTTPS for all data in transit
• Bcrypt password hashing
• JWT-based authentication with token expiry
• Rate limiting to prevent abuse

6. Data Retention

We retain your account and transaction data for as long as your account is active. You may export your data at any time using the export feature. Upon account deletion, your data will be permanently removed within 30 days.

7. Your Rights

You have the right to:

• Access and export your data
• Correct inaccurate information
• Delete your account and associated data
• Opt out of non-essential communications

8. Cookies

We use essential cookies and local storage (Hive, secure storage) to maintain your session and preferences. We do not use third-party tracking cookies.

9. Children's Privacy

The Service is not intended for users under 13 years of age. We do not knowingly collect information from children under 13.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date.

11. Contact Us

If you have questions about this Privacy Policy, contact us at [email protected].