Vantage Privacy Policy

Version 3 · Last updated 15 September 2026

This document is the same policy the app displays under Settings → Data & Privacy → Privacy Policy. The in-app copy lives in Vantage/Core/Legal/LegalDocuments.swift and the two must stay in sync — if they ever disagree, the version shown in the app at the time you agreed is the one that governs, and the divergence is a bug.

In short

Your financial data stays on this iPhone. Vantage has no user accounts, no server that stores your ledger, and no way to look at your transactions. It does not sell your data, does not run ads, and has no analytics turned on unless you turn them on. The only time anything leaves this device is when you connect a bank — which goes through a data provider you sign in with directly — or when you turn on AI assistance, which sends a redacted summary and nothing else.

This summary is not the policy. The policy is below.

Contents

1. Who this is from
2. Where your data lives
3. What leaves this device, and when
4. What Vantage does not do
5. Who else is involved
6. What the AI feature sends
7. How long things are kept
8. Your rights and how to use them
9. What Vantage cannot delete
10. Children
11. Security
12. Financial privacy law
13. Changes to this policy
14. Appendix A — categories of information
15. Appendix B — what each data provider sees

1. Who this is from

Vantage is an iOS app published by Bryant De Luna-Peralta. Questions about this policy, or requests about your data, go to bryantd2138@gmail.com. A postal address for formal requests is 4609 Colony Rd Apt B, Charlotte, NC 28226, USA. The website for this app is https://www.bryantdeluna.com; this policy is also published at https://vantage-bryant.fly.dev/privacy.

This policy covers the Vantage iOS app. It does not cover your bank, your card issuer, or the data providers named below, each of which has its own policy governing what it does with your information.

2. Where your data lives

Your accounts, balances, transactions, budgets, goals, categories, rules and notes are stored in a database file on this device, inside the app's own container. Vantage has no user account system, so there is nothing to sign into and no copy of your ledger on a server anywhere.

Two consequences follow, and the second one is the unwelcome half. First, nobody at Vantage can see your finances, because there is nothing to see. Second, your device's backup is your only backup — if you lose the phone and have no iCloud or encrypted local backup, the data is gone and cannot be restored by us.

• Financial data: stored on device, in the app's SwiftData store.
• Access tokens for connected institutions: stored in the iOS Keychain, never in the database file.
• Preferences (theme, sync settings, saved transaction searches, and the tax estimate's settings — how you file, your line of work, figures you typed): stored on device in app preferences.
• An audit log of what the app did with your data: stored on device, capped at 5,000 entries and 180 days, and containing no amounts, balances, account numbers or transaction descriptions.

3. What leaves this device, and when

Nothing leaves this device except in the cases listed here. There is no background telemetry, no crash reporting unless you switch it on, and no analytics SDK in the app.

• When you connect an institution: the data provider you chose retrieves your account and transaction data and returns it to this device. See Who else is involved below.
• When a connected account syncs: a request goes to the Vantage backend, which holds the credentials the data provider requires and forwards the request. The backend passes data through; it is not a copy of your ledger.
• When you turn on AI assistance: a redacted summary of the transactions relevant to your question is sent to an AI provider. This is off by default and can be turned off again at any time.
• When you export your data: the file goes wherever you send it. That is your choice and outside Vantage's control once it leaves the share sheet.
• When you use the Google Sheet importer: your Sheet is yours, and Vantage reads it with credentials you configured.

About the Vantage backend

The backend exists for one reason: every data provider authenticates with a client secret and issues a long-lived access token, and neither may live inside an iOS app, because an app binary can be unzipped and read by anyone who downloads it. The backend holds those secrets so the app does not have to.

What the backend holds: provider client secrets, the access token for each institution you have connected, and an opaque per-install device token used to authenticate this copy of the app. What it does not hold: your transactions, your balances, your budgets, your notes, or any copy of your ledger. It requests data from the provider, hands it to your device, and forgets it. If you self-host the backend — which is how Vantage is designed to be run — you control that server yourself.

4. What Vantage does not do

These are commitments, not aspirations. If any of them changes, this policy changes with it and the version number goes up, which means the app asks you again.

• Vantage does not sell your personal information, and does not share it for cross-context behavioural advertising. Under the CCPA/CPRA definitions of "sell" and "share", there is nothing to opt out of because it does not happen.
• Vantage contains no advertising SDKs, no ad identifiers, and no third-party trackers.
• Vantage does not use your financial data to train any machine-learning model, its own or anyone else's.
• Vantage does not build a profile of you for marketing, and there is no marketing list unless you explicitly opt into one.
• Vantage never stores your banking username or password. The sign-in happens inside the data provider's own flow, and the app never sees those credentials.

5. Who else is involved

Connecting a bank account requires a third party. Vantage supports several, and which one is used depends on the institution you pick. Each of them acts as a service provider processing your data so the connection can work, under its own agreement with you and its own privacy policy.

Inside the app, Settings → Data & Privacy → Connections shows exactly which provider each connection uses, what it can access, and how to revoke it. The AI assistant, if you turn it on, uses an AI provider under a contract that prohibits training on the content sent.

• Account aggregation: Plaid, Teller, MX, Finicity, Akoya, SnapTrade or Coinbase, depending on the institution.
• AI assistance (only if you turn it on): an AI provider, receiving redacted, aggregated summaries. Which provider — Anthropic, OpenAI or Google — is set on the Vantage server, is named in the app beside the AI Assistance switch and under every answer it gives, and is reached through the Vantage backend so that no API key sits inside the app. Each is used under its commercial API terms, which do not permit training on the content sent.
• Apple: the App Store handles distribution and any purchases. Apple's own terms apply to that relationship.
• Nobody else. There is no CRM, no email platform holding your address, no analytics vendor and no advertising network.

Appendix B sets out, provider by provider, what each one can see, what it cannot, where the data goes, and how to revoke it.

6. What the AI feature sends

AI assistance is off unless you turn it on, and the on-device analysis — categorization, recurring detection, insights, forecasts — runs either way without sending anything anywhere.

When it is on and you ask a question, Vantage assembles the smallest summary that could answer it and runs a redaction pass over it before it leaves the device. Account numbers, card masks, routing numbers, names, street addresses, email addresses and phone numbers are removed. Amounts are rounded into ranges rather than sent exactly. The redaction is verified before the request is sent, and the request is blocked if verification fails.

If you have used the Taxes screen, the summary also carries the tax estimate's rounded totals, your filing status and the line of work you chose — never an employer, a deposit, or a figure you typed from a pay stub.

When a question needs a figure the summary does not carry — spending at one merchant, or in one month — the AI provider can ask the app for it, and the app computes that one figure on your phone and sends it back rounded, under the same rules as the summary: never an individual transaction, a date, or an account. The disclosure under every answer lists each figure that was asked for and what went back.

The request travels to the AI provider named in the app by way of the Vantage server, which forwards it and keeps no copy. Nothing that identifies you goes with it: no name, no account, no device identifier — the provider sees a question and a summary arriving from Vantage's server, not from you. The server counts how many questions each phone asks a month, so it can apply a monthly allowance; it keeps the count, never the question.

The audit log records that a request happened, where it went, and how much was redacted. It does not record what was asked or what came back.

You turn this on and off at Settings → Data & Privacy → Permissions → AI Assistance. Turning it off takes effect immediately and requires no confirmation.

7. How long things are kept

Your ledger is kept until you delete it. Vantage does not expire your data on its own, because a spending history that silently truncates is worse than useless for the thing this app is for.

The exceptions are the two things that are not your ledger: the audit log, capped at 5,000 entries or 180 days, whichever comes first; and export files, which are written to a temporary folder and cleaned up when you next open the export screen or when iOS reclaims the space.

Deleting an account inside Vantage deletes its transactions on this device. Deleting everything wipes the database, the Keychain items, the preferences and the caches. Neither reaches data already held by a data provider or by your bank — see What Vantage cannot delete.

8. Your rights and how to use them

Depending on where you live, you may have rights to access, correct, delete and port your personal information — under the CCPA/CPRA in California, under comparable laws in a growing number of other US states, and under the GDPR in the EU and UK. Vantage is built so that you can exercise all of them yourself, immediately, without asking anyone.

Because the data is on your device and there is no account to verify, there is no identity-verification step and no waiting period. There is also, honestly, no way for us to fulfil a request about your ledger even if you sent one — we cannot see it.

9. What Vantage cannot delete

Data that a data provider already holds is held by that provider, not by Vantage, and deleting your Vantage data does not reach it. Disconnecting an institution in Vantage revokes the provider's access token, which stops further retrieval — but the provider may retain what it already collected under its own retention policy and its own agreement with you.

Plaid, for example, operates a portal at my.plaid.com where you can see which apps have access to your accounts and ask Plaid to delete the data it holds. The other providers have their own processes. The app's deletion screen links to each of them, and says plainly which ones you have to handle yourself.

Deleting your Vantage data also does not reach your bank. Your institution's own records are unaffected by anything you do in this app.

10. Children

Vantage is not directed to children and is not intended for anyone under 13. It does not knowingly collect personal information from children under 13, which under COPPA it could not do without verifiable parental consent — and given that the data never reaches us, we would have no way to identify it if it did.

If you are between 13 and 18, use Vantage only with a parent or guardian's involvement. If you believe a child has used the app on a device you control, deleting the app and its data removes everything, since none of it left the device.

11. Security

Financial data on this device is protected by iOS file protection, which means it is encrypted at rest with a key tied to your device passcode. Access tokens for connected institutions live in the Keychain with device-only accessibility, so they are not readable from a backup restored onto another device. Traffic to the Vantage backend and to every data provider uses TLS.

You can add a Face ID, Touch ID or passcode lock in Settings. None of this helps if your device has no passcode set — that is the foundation everything else rests on.

No system is perfect. If there is a breach affecting data we hold, we will notify affected people as required by the applicable state breach-notification law and, where the GLBA Safeguards Rule applies, the FTC.

12. Financial privacy law

US financial privacy law — the Gramm-Leach-Bliley Act and Regulation P — governs how financial institutions handle nonpublic personal information. Whether it reaches an app like Vantage depends on facts about how the app operates, and this is one of the areas flagged for a lawyer rather than assumed. Regardless of how that question resolves, Vantage is built to the standard the rule describes: collect the minimum, disclose what is collected, do not sell it, and let people opt out of anything they did not ask for.

13. Changes to this policy

When this policy changes materially, its version number goes up and Vantage asks you to review it again the next time you open the app. Previous consent to an earlier version stops counting at that moment — the app treats an outdated agreement as no agreement, which is the point of storing a version alongside the date.

Typo fixes and clarifications that do not change what happens to your data do not bump the version and do not re-prompt.

Appendix A — categories of information

Provided in the shape the CCPA asks for, so that this document can serve as a notice at collection. "Collected" here means the information exists in the app at all, including when it never leaves your device — which is the more useful reading for you, even though it is broader than the definition Apple and some statutes use.

Retention: your ledger until you delete it; the audit log for 5,000 entries or 180 days; export files until the temporary directory is cleaned. See section 7.

Sources: you, and the data providers you choose to connect. Nowhere else. Vantage does not buy data, enrich it from third parties, or compile information about you from public sources.

Appendix B — what each data provider sees

This mirrors the per-connection disclosure the app shows before a link flow opens and again on the connection detail screen. Every entry marked unverified means the wording and URL have not yet been checked against that provider's current agreement by a human — see LEGAL_CHECKLIST.md, section 2.7. Where an entry is unverified, treat the link as a starting point rather than an authoritative destination.

Plaid Inc. — verified

Sees: the accounts you select at your institution and their balances; transaction history, typically up to 24 months; account and routing numbers where the institution provides them and the connection needs them; account holder name and contact details held by the institution; investment holdings and liability details for accounts that have them.

Does not see: your banking password — you enter it in Plaid's flow, and neither Plaid nor Vantage stores it for reuse in a way Vantage can see; accounts at that institution you did not select; anything after you disconnect, once the access token is revoked.

Data path: you sign in through Plaid Link. Plaid returns an access token to the Vantage backend, which stores it and uses it to retrieve your data. The retrieved data is sent to this device and stored here. Plaid also retains the data it collected, under Plaid's own end-user privacy policy.

To revoke: disconnect the institution in Vantage — this revokes the token with Plaid and stops further retrieval. To also ask Plaid to delete what it already holds, use Plaid Portal at my.plaid.com, which lists every app that has access to your accounts.

Policy: <https://plaid.com/legal/>

Teller Engineering, Inc. — unverified

Sees: the accounts you select and their balances; transaction history for those accounts; account identity details the institution exposes.

Does not see: accounts you did not select; anything after you disconnect the enrollment.

Data path: you sign in through Teller Connect. Teller returns an enrollment token to the Vantage backend, which uses it to retrieve your data. The data is stored on this device.

To revoke: disconnect the institution in Vantage, which deletes the enrollment with Teller. Some institutions also let you revoke third-party access from your online banking settings, which is worth doing as a belt-and-braces step.

Policy: <https://teller.io/>

MX Technologies, Inc. — unverified

Sees: the accounts you select and their balances; transaction history, cleansed and categorized by MX; account identity details the institution exposes.

Does not see: accounts you did not select; anything after the member connection is deleted.

Data path: you sign in through MX Connect. MX holds the connection and returns data to the Vantage backend, which forwards it to this device.

To revoke: disconnect the institution in Vantage, which deletes the member record at MX. MX also operates a consumer data-access site; check its current address before relying on it.

Policy: <https://www.mx.com/privacy-policy/>

Finicity Corporation, a Mastercard company — unverified

Sees: the accounts you select and their balances; transaction history for those accounts; loan and mortgage details where the institution provides them.

Does not see: accounts you did not select; anything after the customer record is deleted.

Data path: you sign in through Finicity Connect. Finicity holds the connection and returns data to the Vantage backend, which forwards it to this device.

To revoke: disconnect the institution in Vantage. Finicity operates a consumer portal for viewing and revoking data access and for deletion requests; confirm its current address before relying on it.

Policy: <https://www.finicity.com/privacy/>

Akoya LLC — unverified

Sees: the accounts you select at participating institutions; balances and transaction history, scoped to what you authorized at the institution.

Does not see: your credentials — Akoya is token-based and the institution authenticates you directly; any data outside the scopes you granted at the institution's own consent screen.

Data path: authorization happens at your institution, which issues a token to Akoya. The Vantage backend uses that token to retrieve only the scopes you granted. Because the institution issues the token, the institution's own consent dashboard is usually where the connection can be seen and revoked.

To revoke: disconnect the institution in Vantage, and also revoke the connection in your institution's own third-party access or data-sharing settings, which is the authoritative place for an Akoya connection.

Policy: <https://akoya.com/privacy>

SnapTrade (Passiv Technologies Inc.) — unverified

Sees: brokerage account balances and positions; account activity where the brokerage exposes it.

Does not see: trading permissions — Vantage requests read-only access and never places orders; bank accounts or cards, since SnapTrade is brokerages only.

Data path: you authorize the brokerage through SnapTrade's flow. SnapTrade holds the authorization and returns holdings and balances to the Vantage backend, which forwards them to this device.

To revoke: disconnect the brokerage in Vantage, which deletes the authorization at SnapTrade. Most brokerages also list connected third-party apps in their own security settings.

Policy: <https://snaptrade.com/privacy>

Coinbase, Inc. — unverified

Sees: wallet balances for the accounts you authorize; transaction history for those wallets.

Does not see: any ability to trade, send or withdraw — Vantage requests read scopes only; wallets held anywhere other than Coinbase.

Data path: you authorize Vantage through Coinbase's OAuth flow. The resulting token is held by the Vantage backend and used to read balances and transactions.

To revoke: disconnect in Vantage, and revoke the application in your Coinbase account's connected-applications settings — the Coinbase side is authoritative.

Policy: <https://www.coinbase.com/legal/privacy>

Google LLC (Sheets and Apps Script)

Sees: the specific Google Sheet you configured, through a deployment you created and control.

Does not see: any other file in your Google Drive; your Google account credentials.

Data path: Vantage calls an Apps Script deployment you set up yourself, authenticated with a shared secret you generated. The Sheet is in your Google account and governed by Google's terms with you, not by any agreement Vantage has.

To revoke: remove the deployment in Apps Script, or clear the configuration in Vantage. Both stop the connection immediately.

Policy: <https://policies.google.com/privacy>

CSV, OFX and QFX statement import — no third party

Sees: the file you pick, once, at the moment you pick it.

Does not see: anything else on your device; any network — nothing is uploaded, because there is nothing to upload to.

Data path: the file is parsed on device and the rows are written to the local store. No request is made to any server.

To revoke: nothing to revoke. Delete the imported account to remove its rows.

Manual accounts — no third party

Sees: what you type in.

Does not see: anything at all — there is no connection of any kind.

Data path: stored on this device only.

To revoke: nothing to revoke. Delete the account to remove it.

Vantage Privacy Policy, version 1, 9 September 2026. The in-app copy of this document is the authoritative one for any consent you gave inside the app.