Privacy Policy
Headroom is a personal budgeting and cash-flow application. This policy explains how information is collected, used, protected, retained, and deleted, including financial information connected through Plaid.
Information we collect
Headroom may collect account registration and authentication information, household and budgeting information you enter, connected financial-account information, balances, transaction information, categories, and other data needed to provide the features you choose to use.
Plaid and connected financial accounts
Headroom uses Plaid to let you connect supported financial institutions. When you choose to connect an account, Plaid facilitates the connection and provides Headroom with authorized financial-account and transaction information. Headroom does not receive or store your online-banking username or password. Headroom stores the Plaid access token required to maintain your authorized connection in encrypted form.
How we use information
Information is used to provide budgeting, cash-flow, transaction-import, account-management, forecasting, categorization, security, troubleshooting, and related Headroom functionality. Headroom does not use financial data for unrelated advertising purposes.
Service providers
Headroom relies on service providers including Cloudflare for application hosting, database infrastructure, security, and delivery; GitHub for source-code management; and Plaid for financial-account connectivity. These providers process information as necessary to provide their respective services.
Security and encryption
Headroom uses HTTPS/TLS for data in transit. Plaid-derived account and transaction data is stored in Cloudflare D1, whose managed storage encrypts data at rest. Plaid access tokens receive an additional application-level AES-GCM encryption layer before storage. Headroom uses authentication, multi-factor authentication, session controls, authorization checks, household-level data isolation, and administrative access controls to reduce unauthorized access.
Data retention
Headroom retains information while it is needed to provide the service, maintain security and integrity, resolve disputes, or meet applicable legal obligations. Data that is no longer required should be deleted or de-identified. Headroom does not intentionally retain consumer financial data indefinitely without an operational, security, or legal reason.
Disconnecting a financial institution
You can disconnect a linked financial institution from Headroom. Disconnecting removes Headroom's active Plaid connection and stops future synchronization for that Plaid Item. Historical data may remain until it is deleted under the data-deletion process described below.
Your privacy and data rights
You may request access to, correction of, or deletion of personal information associated with your Headroom account, subject to information that must be retained for security, fraud prevention, dispute resolution, or legal requirements. Requests are verified before protected account information is disclosed or deleted.
Data deletion requests
To request deletion of your Headroom account or associated consumer financial data, contact Headroom using the support/contact method provided in the application. Following verification, Headroom will delete data that is not required to be retained for security or applicable legal obligations and will terminate active financial-data connections as appropriate.
Authentication and account security
Headroom uses account authentication and multi-factor authentication to protect access to financial information. Users are responsible for protecting their passwords, email accounts, MFA codes, and devices and should promptly revoke sessions or report suspected unauthorized access.
Children
Headroom is not intended for children and is not designed to knowingly collect financial-account information from children.
Changes to this policy
This policy may be updated when Headroom's functionality, data practices, service providers, or legal requirements materially change. The effective date above identifies the current version.
Contact
Privacy or data-rights questions may be submitted through Headroom's support/contact channel. The Headroom security and privacy owner is Jonathan Fitzgerald, Owner / Developer.