Privacy policy

Last updated September 7, 2026

Who is responsible for your information

Sumloom is responsible for the personal information used to provide the budgeting service. You can contact the operator about privacy or exercise your rights through the contact form.

Information you provide

We process your email address, display name, authentication information, household name, household membership and role, invitations, preferences, and onboarding status. Passwords are handled by Supabase and are not stored in the Sumloom application database. We also store the financial information you choose to enter, including account names and balances, categories, assignments, transactions, transfers, adjustments, goals, notes, and imported CSV content.

We store support contact details, topics, messages, responses, and delivery status. Signed-in requests are linked to the user and household and use the account name and email address. Do not include passwords, bank credentials, or payment-card details.

Information collected when you use Sumloom

We process session and request information needed to authenticate you, secure the service, prevent abuse, diagnose failures, and operate the application. This may include timestamps, requested paths, browser user agent, error identifiers, user and household identifiers, and a one-way hash derived from an address or email for rate limiting. We record daily activity at user and household level without recording which pages or financial values were viewed.

No bank credentials or bank connections

Sumloom is manual by design. We do not connect to financial institutions and do not request or store bank usernames, bank passwords, or bank-connection tokens.

Payments

Paddle is the merchant of record for paid subscriptions. Paddle collects and processes payment details, billing addresses, tax information, transaction information, invoices, refunds, disputes, and fraud-prevention data under its own privacy policy. Sumloom receives and stores the Paddle customer, subscription, price and status identifiers needed to provide paid access. Sumloom does not receive or store complete payment-card numbers.

How we use information

We use personal information to create and secure accounts, synchronize household budgets, provide shared household features, calculate entitlements, process subscriptions, send authentication and service emails, answer support and privacy requests, prevent fraud and abuse, troubleshoot errors, maintain backups, comply with legal obligations, and improve the reliability of the service.

Legal bases

Where data-protection law requires a legal basis, we process information as needed to perform our contract with you, to comply with legal obligations, and for legitimate interests such as securing, supporting, and improving Sumloom. Where consent is required, you may withdraw it without affecting processing that occurred before withdrawal.

Household sharing

Sumloom is a shared household service. Members of the same household can access shared household financial information and may see other members’ names, email addresses, and roles where needed for collaboration. Do not add someone to a household unless they should have access to its shared information.

Service providers

We use Supabase for authentication and database infrastructure, Vercel for application hosting and request delivery, Resend for transactional and support email, and Paddle for subscription billing as merchant of record. These providers process information only as needed to deliver their services and may maintain their own security, fraud-prevention, compliance, and legal records.

We may also disclose information when required by law, to protect users or the service, to investigate fraud or security incidents, or as part of a business transfer subject to appropriate safeguards. We do not sell personal information or share it for cross-context behavioral advertising.

Cookies and similar technologies

Sumloom uses essential authentication and security cookies so you can sign in and keep a secure session. We do not use advertising cookies or third-party behavioral analytics. Paddle may use cookies or similar technologies within its hosted checkout and customer portal for payment, fraud prevention, and compliance.

Retention

Account and household information is retained while the account or household exists. Financial information remains available during read-only access after a trial or subscription ends and is removed through the applicable account or household deletion flow. Support requests and responses are retained while needed to respond, maintain a support record, resolve disputes, and meet legal obligations. Processed billing webhook records are eligible for deletion after 90 days, and expired rate-limit records are eligible for deletion after two days.

Transactional email metadata, security records, audit records, payment records held by Paddle, and copies in backups may be retained longer where needed for security, fraud prevention, financial reporting, dispute handling, backup recovery, or legal compliance. Backup copies are removed according to the backup provider’s normal retention cycle.

Security

We use access controls, household authorization, database row-level security, encrypted HTTPS connections, signed billing webhooks, multi-factor authentication for platform administration, rate limiting, and restricted service credentials. No online service can guarantee absolute security, so you should use a unique password and promptly report suspected unauthorized access.

International processing

Our service providers may process information in countries other than your own. Where required, transfers are supported by contractual protections or another lawful transfer mechanism provided by the relevant service provider.

Your choices and rights

You can update profile and household information in the application and export household information from Settings. Depending on where you live, you may also have rights to access, correct, delete, restrict, or object to processing, receive a portable copy, withdraw consent, or complain to a data-protection authority.

You can permanently delete your account from Settings. A household owner must transfer ownership before deleting their account while other members remain. Provide the request email address when asking us to find support records.

Changes to this policy

We may update this policy when the service, providers, or legal requirements change. We will update the date above and provide additional notice when a change materially affects how personal information is used.

Contact

For privacy requests, use the contact form and choose “Privacy or data request.” Responses are sent by email. Email replies are not monitored; use the secure “Contact Sumloom” link to follow up.