Privacy policy

This Privacy Policy explains how Meadowlark LLC ("Meadowlark," "we," "us," or "our") collects, uses, and discloses personal information when you use our website, application, and related services (collectively, the "Service"). It also explains the choices and rights available to you.

In short:

• We collect the information needed to provide and secure Meadowlark.
• If you connect a financial institution, we receive financial account and transaction data through Plaid.
• We do not sell your personal information for money.
• We do not provide your linked financial data or payment details to advertising or analytics providers.
• We disclose information only to the service providers described below, when you direct us to, or when required for legal or safety reasons.

Please contact us at hello@meadowlarkapp.com with privacy questions or requests.

When you create or use an account, we collect information such as your name, email address, password or Google sign-in details, email-verification status, profile image if provided by Google, timezone, theme preference, and account settings. Passwords are stored in hashed form rather than as readable text.

We also keep authentication records such as session tokens, login provider identifiers, IP address, browser or device user agent, session expiration time, and whether two-step verification is enabled. If you enable an authenticator app, we store its setup secret and your recovery codes in encrypted form. These records help us keep you signed in and protect your account.

If you connect a financial institution through Plaid, we may receive and store:

• institution and account information, including account name, type, subtype, currency, masked account number, status, and available and current balances;
• transaction information, including amount, date, description, merchant, category, pending status, location, counterparties, and payment-related metadata supplied by your institution; and
• connection information, including Plaid identifiers, consent status, synchronization history, and error information.

We store the Plaid access token needed to maintain your connection. That token is encrypted separately using authenticated encryption. Meadowlark does not receive or store the online banking password you provide to Plaid or your financial institution.

You may also provide financial information directly by creating accounts or transactions, adding balances, notes, categories, or merchants, and importing transaction files. Imported files may include the file name, column headings, original row data, and any mappings or validation results needed to complete the import.

Stripe collects and processes your payment method, billing address, and payment details. We do not store your complete card number. We receive limited subscription information from Stripe, such as your Stripe customer and subscription identifiers, subscription status, price, trial dates, billing period, and cancellation status.

When you use the Service, we and our providers may automatically collect information such as your IP address, browser and device type, operating system, approximate location derived from your IP address, pages viewed, page URLs, referring page, dates and times, interactions with the Service, and cookie or similar identifiers.

We use Google Analytics on public website pages to understand visits and marketing attribution. Google Analytics is not loaded on authenticated financial app pages. We use Sentry to identify errors, monitor performance, and diagnose reliability problems. Sentry may receive a pseudonymous account identifier, application resource and request identifiers, route information, error messages, stack traces, release details, and performance traces. We configure this monitoring to exclude names, email addresses, IP addresses, financial content, request bodies, cookies, authentication headers, credentials, URL query parameters, and provider payloads.

If you contact us, we collect your contact details and the contents of your message. We also keep records needed to send and manage service emails, such as email verification, password reset, security, support, subscription, and policy notices. We do not send marketing emails.

We collect information:

• directly from you when you create an account, enter data, import a file, or contact us;
• from Plaid and your financial institutions when you choose to connect an account;
• from Google if you choose Google sign-in;
• from Stripe when you start or manage a subscription; and
• automatically through the Service, cookies, logs, analytics, and monitoring tools.

We use personal information to:

• create, authenticate, and secure your account;
• connect financial institutions and import, synchronize, categorize, organize, and display your financial information;
• process subscriptions, trials, payments, and cancellations;
• provide support and send necessary service communications;
• operate, maintain, troubleshoot, and improve the Service;
• measure usage and understand which features are useful;
• detect fraud, abuse, security incidents, and technical problems;
• enforce our Terms of Service; and
• comply with law and protect the rights, safety, and integrity of our users and Service.

We do not use your linked financial information or transaction details for targeted advertising.

Meadowlark uses cookies and browser storage for the following purposes:

• Authentication and security: to keep you signed in, protect sessions, complete optional two-step verification, and prevent abuse. Our authentication session normally lasts up to 7 days. Temporary two-step verification cookies expire after about 10 minutes.
• Preferences: to remember your theme and briefly capture your browser timezone during registration.
• Account linking: to temporarily maintain Plaid connection state during the linking process.
• Analytics: on public website pages, Google Analytics may use cookies or similar identifiers to measure visits and marketing attribution across sessions. Google Analytics is not loaded on authenticated financial app pages.

You can block or delete cookies using your browser settings. Blocking essential cookies may prevent sign-in or other parts of the Service from working. You can learn about Google Analytics controls at Google Analytics Opt-out.

Because there is no consistent industry standard, Meadowlark does not currently respond to browser "Do Not Track" signals. See the state privacy rights section below for information about legally recognized opt-out requests.

We do not disclose personal information to unrelated third parties for their own purposes. We disclose only the information reasonably needed by the following providers to perform services for us:

• Plaid: connects financial institutions and supplies account, balance, and transaction information you request.
• Stripe: processes payment information and manages subscriptions, billing, taxes, and fraud prevention.
• PlanetScale: hosts the database where Service data is stored.
• Render: hosts Meadowlark's application programming interface and server-side application.
• Cloudflare: provides secure hosting, proxying, network protection, and traffic delivery.
• Sentry: provides error reporting, performance monitoring, and diagnostic services.
• Google: provides Google sign-in and Google Analytics.
• Resend: delivers account, security, and other service emails.

These providers process information under their own privacy terms and, where applicable, our service agreements with them.

We may also disclose information:

• when you ask us to or give us consent;
• to comply with a valid subpoena, court order, law, or other binding legal process;
• when reasonably necessary to investigate fraud or abuse, respond to an emergency, or protect rights, safety, and security; or
• as part of a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of Meadowlark, subject to appropriate confidentiality protections and notice where required by law.

We may use and disclose information that has been aggregated or deidentified so that it cannot reasonably identify you. We will not attempt to reidentify deidentified information.

Meadowlark does not sell personal information for money. We do not currently use personal information for cross-context behavioral advertising, and we do not provide linked financial information, transaction details, or payment details to analytics or advertising platforms.

We disclose the usage, device, and performance information described above to Google Analytics. Some privacy laws may define certain analytics disclosures as a "sale" or "sharing" even when no money is exchanged. You may ask us to opt you out of disclosures that are legally considered a sale, sharing, or targeted advertising by contacting hello@meadowlarkapp.com.

PostHog, Meta analytics, and Reddit analytics are not currently active in the Service. If we enable any of them, we will update this policy before they collect information and provide any consent or opt-out controls required by law.

We keep account and financial information while your account is open so we can provide the Service. When you disconnect an institution within Meadowlark, you can choose to keep its saved history or delete it. If Plaid explicitly tells us that you revoked an account or connection at your bank, we delete the affected saved data. If an account instead disappears from a successful bank response, we make its balances and transaction history unavailable immediately and schedule deletion after 7 days. You can reconnect during that period; we restore access only after Plaid verifies that the reconnect session finished successfully.

If you request account deletion, we will delete or deidentify personal information associated with your account unless we need to retain it for a legitimate reason, such as completing a transaction, complying with tax or accounting rules, preventing fraud, resolving disputes, enforcing agreements, or maintaining security. Information may remain in encrypted backups until they expire under our database provider's backup schedule.

We delete expired authentication records after 7 days, successfully processed Plaid webhook records after 30 days, failed Plaid webhook records and completed synchronization records after 90 days, and Stripe webhook deduplication identifiers after 400 days. If deleting a revoked Plaid connection also deletes its webhook record, we keep a minimal, non-identifying deletion audit for 30 days. It records when and why deletion occurred, its source and scope, the number of accounts deleted, and an optional delivery fingerprint. It does not contain a user, connection, or account identifier, provider payload, financial value, or error message. Sentry may retain error and performance events for up to 90 days. Render keeps dashboard service logs for 7, 14, or 30 days depending on our workspace plan. Cloudflare Worker tracing is disabled, and Worker logs are configured without Cloudflare dashboard persistence. Other provider-held network, security, payment, diagnostic, and legal records follow the provider's applicable retention periods.

We use administrative, technical, and organizational safeguards designed to protect personal information. Data is encrypted in transit and at rest. Cloudflare provides secure proxying with TLS 1.3 enforced at the network edge, and Plaid access tokens receive an additional layer of authenticated encryption before storage. We also use access controls, secure authentication cookies, provider webhook verification, and monitoring.

No system can guarantee absolute security. Please use a unique password and contact us promptly if you believe your account has been compromised.

You may:

• review and update certain profile and financial information in the Service;
• disconnect a linked financial institution through the Service;
• control cookies through your browser;
• request access to or a portable copy of your personal information;
• request correction or deletion of your personal information; and
• object to or opt out of certain processing where applicable law provides that right.

You can delete your account from the Security page in Settings. To make another privacy request, get help with deletion, or use an alternate request channel, email hello@meadowlarkapp.com. Tell us which right you want to exercise and provide enough information for us to locate your account. We may need to verify your identity before completing a request. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and verification of your identity.

We will respond within the time required by applicable law. We will not discriminate against you for exercising a privacy right. A request may be limited or denied where an exception applies, and we will explain the reason when required.

Before Plaid Link opens, Meadowlark asks you to consent to our collection, processing, storage, and ongoing synchronization of the financial data you choose to share. We record the policy version and time of acceptance for your account. You can stop future collection by disconnecting the institution and can delete saved data through the Service.

Depending on where you live and subject to applicable exceptions, state law may give you the right to know the categories and specific pieces of personal information we collect, know the categories of sources and recipients, access, correct, delete, or obtain a copy of your information, and opt out of qualifying sales, sharing, targeted advertising, or profiling. The sections above provide our notice of the categories collected, sources, purposes, and recipients.

Financial account and login information may be considered sensitive personal information. We use this information only to provide and secure the Service and for other purposes permitted without a right to limit under applicable law. We do not knowingly sell or share the personal information of anyone under 18.

The Service is intended only for people who are at least 18 years old. We do not knowingly collect personal information from children. If you believe a child has provided personal information to Meadowlark, please contact us so we can investigate and delete it where appropriate.

Meadowlark is based in the United States, and we and our providers primarily process information in the United States. Some providers may process information in other countries. Those countries may have privacy laws different from the laws where you live.

We may update this Privacy Policy as the Service, our providers, or legal requirements change. We will post the updated policy with a new effective date. If a change materially affects your privacy rights or how we use personal information, we will provide reasonable advance notice by email, through the Service, or by another appropriate method.

For privacy questions, complaints, or requests, contact:

Meadowlark LLC
2108 N St, Suite N
Sacramento, CA 95816
United States
hello@meadowlarkapp.com