Privacy Policy

1. Who we are

EveryDolla is a personal finance app for Jamaica. It is made by EveryDolla, LLC (“EveryDolla”, “we”, “us”), and this policy covers our website at everydolla.tech, the web app, the EveryDolla iOS app and eVe, our assistant (together, the “Services”). We decide how your personal information is used, so we are responsible for it.

Questions about this policy or your information: info@everydolla.tech.

2. What we collect

Your account

When you sign in with Google or Apple, they send us your name, email address and, from Google, your profile photo. If you use Apple’s Hide My Email, we receive a private relay address instead of your real one. We never receive your Google or Apple password, and we do not offer sign-in with a password of our own.

Your money

• Purchases. For each purchase: the amount and currency, the merchant’s name, the date and time, your bank, the card it was made on (its last digits only) and a category. They come from your bank’s transaction alerts (see below), from expenses you add yourself, and from statements and receipts you give eVe.
• What you set up. The banks you pick (and your answer if we ask about another bank), your budgets, bills, funds and limits, your own categories, names and limits for your cards, and how you have filed merchants.

We never ask for, and never receive, your online banking password or your full card or account numbers. EveryDolla cannot move money.

Gmail, if you connect it

If you choose to connect a Gmail account, Google asks you to give EveryDolla read-only access to it. Google’s consent screen describes that permission broadly. EveryDolla uses it to receive the transaction alerts sent from the alert addresses of the banks you pick (spam and trash included, where alerts sometimes land). We also check whether alerts from the other banks we support are there, so we can ask if you want to add those banks. That check only counts them. We don’t open them, and all we keep is which banks have alerts and roughly how many. Nothing from those banks comes in unless you say yes. From each alert we keep the purchase details listed above, the message’s Gmail ID so we never import it twice, and a masked version of its subject line (every digit replaced) that helps spot duplicates. We do not keep the message itself, and we never receive, keep or use any other email. We also keep the result of Gmail’s checks that the alert really came from your bank, so an alert that fails them is flagged for you to look at rather than counted. Our full commitments for Google data are in Section 4.

eVe, our assistant

• Chats. Your messages to eVe, her replies, and the charts, tables and drafts in them.
• Memories. Short notes you ask eVe to remember, such as your payday. You can edit or delete them at any time.
• Documents. Statements and receipts you upload, and the purchases eVe reads from them.
• Voice. When you talk to eVe, your audio goes to our AI provider to be turned into text. We keep the text and never store the audio.
• Websites eVe opens for you. eVe can open a website on your behalf, for example to look up a bill. She takes each action only after you approve it. Passwords you type for such a visit are used once, in memory, and never stored. The site’s own session is kept encrypted for up to 15 minutes. The pages she read stay in your chat.

The iPhone app

• Notifications. If you allow them, your iPhone’s push addresses (for notifications, widgets and Live Activities), an ID the app makes for your installation, and the app version, iOS version, language and time zone. Notifications reach your phone through Apple’s push notification service, so their text passes through Apple. With “Show amounts in notifications and widgets” off (it’s on until you change it), they never include amounts.
• Widgets. A widget shows a summary the app keeps on your phone, such as this month’s spending, and follows the same “Show amounts” setting.
• Face ID and Touch ID. If you lock the app, iOS checks your face or fingerprint on the phone. We never receive it.
• Camera, photos and microphone. Used only when you scan or choose a receipt or statement, or dictate or talk to eVe. We receive only the picture, file or audio you give us, as described above.
• Crash reports. If the app crashes or freezes, it sends a report to Sentry with technical details: the app, iOS and phone model, and the part of the app that failed. A report holds no financial data, no screenshots and no personal details; the app removes amounts and email addresses before it leaves your phone. The website sends error reports the same way.
• App checks. When you sign in with Google, Apple’s App Attest and Google’s App Check confirm the request comes from the real EveryDolla app. They don’t tell us anything about you.

Reports you send us

If you report a problem with a purchase, we keep your report (its reason and any note you add) with the purchase, and email it to our team so someone can look into it.

Your device and how you use the Services

• Sign-in records. The IP address and browser or device type of each signed-in session, so you and we can spot sign-ins that aren’t yours.
• Usage analytics. Which pages are viewed and what is tapped or clicked, without your name or email attached. See Section 8. In the iPhone app these events are tied to your account ID, never your name or email, and you can turn them off under Privacy & data.
• Error reports. When something breaks, a report with technical details about the error. We write our reports so they leave out email addresses, amounts and other personal details.

We do not collect your precise location, your contacts or your photos, and we do not knowingly collect sensitive information such as health, religion or ethnicity.

3. How we use it

We use your information to:

• run your account and the Services: import your purchases, show your spending, cards and budgets, and answer your questions through eVe;
• file your purchases into categories, including with AI (see Section 5), and remember how you file merchants;
• keep the Services and your account secure, and prevent fraud and abuse;
• fix problems and improve the Services, using analytics and error reports;
• answer you when you contact us, and tell you about important changes;
• meet our legal obligations and enforce our terms.

Every total is shown in Jamaican dollars. A purchase in another currency is counted at the J$ amount your bank billed, or at that day’s exchange rate when the bank didn’t say. We fetch the day’s rates from a currency data service, which receives nothing about you.

We do not sell your personal information, and we never use your financial information or anything from Gmail for advertising. To measure our own ads, our public pages use advertising tools from Meta and Google, as “Cookies and similar technologies” explains.

Where the law asks us to name a legal basis (for example in the UK or the EU), we rely on performing our contract with you when we provide the Services; on your consent when you connect Gmail, upload a document or use voice, and for optional analytics where consent is required; and on our legitimate interests in keeping the Services secure and working well.

4. Google user data

EveryDolla’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. In particular:

• What we access. With your permission, read-only access to your Gmail (the permission Google calls “gmail.readonly”), and your name, email address and profile photo when you sign in with Google.
• What we use it for. To import purchases from your banks’ transaction alerts into your EveryDolla account and to keep them up to date. We fetch only the alerts sent from the banks you choose. We also count the alerts from the other banks we support, without opening them, so we can ask if you want to add those banks; we keep only which banks have alerts and roughly how many.
• What we never do. We do not use Google user data for advertising, we do not sell it, and we do not use it to develop, improve or train generalized AI or machine learning models. We do not transfer it to others except as needed to provide or improve the features you use, for security, or to comply with the law.
• People. No one at EveryDolla looks at your Gmail messages. A person may look at data from an alert only with your permission (for example, to fix an import you reported), when needed for security or to investigate abuse, or when the law requires it.
• AI. To file a purchase into a category, we may send an AI provider its merchant name, with long runs of digits masked, and a price range. We never send the alert itself, and those providers may not train their models on it (see Section 5).
• Your control. You can disconnect a Gmail account in EveryDolla under Connections at any time. This stops all access and revokes our permission with Google. You can also remove it at myaccount.google.com/permissions. Purchases already imported stay until you delete them or your account.

5. Artificial intelligence

Some features use AI models run by other companies (“AI providers”). What each one receives:

• Filing purchases into categories (OpenAI or Google Gemini): the merchant’s name with long runs of digits masked, a price range rather than the exact amount, and the names of your categories.
• Merchant logos (OpenAI): only the merchant’s name, never amounts, account numbers or personal details, so the model can name the brand’s website. We then fetch the logo for that website address from Logo.dev (see Who we share it with).
• eVe’s answers (Anthropic or OpenAI): your message, the recent conversation, your saved memories, and the financial details eVe looks up to answer, such as purchases, totals and budgets. Not your name or email address. If you ask something that needs the web, the provider may search the web with your question.
• Reading statements and receipts (OpenAI or Anthropic): the pages of the PDF or image you upload. Spreadsheet and bank export files (CSV, Excel, OFX) are read on our own servers and not sent to an AI provider.
• Voice (OpenAI): your audio, to turn it into text or to hold a live voice conversation, and the text eVe reads aloud.

We use AI providers only under terms that do not allow them to train their models on your data. Where a provider lets us turn off storing requests, we do. Each provider may keep requests for a short time to prevent abuse, under its own policy.

AI can be wrong. Check anything important, such as a category or an amount eVe read from a document, and don’t treat eVe’s answers as professional financial, tax or legal advice. eVe changes your budget only when you approve it, and you can undo a change.

6. Who we share it with

We share personal information only with companies that help us run the Services (“service providers”), under contracts that limit their use of it to that work:

• Hosting and storage: Vercel (the website and apps), Neon (our database) and Trigger.dev (background work such as imports).
• Sign-in: Google and Apple.
• Notifications: Apple, whose push notification service delivers the iPhone app’s notifications.
• AI: OpenAI, Anthropic and Google, as described in Section 5.
• Analytics and error reports: PostHog and Sentry.
• Advertising measurement: Meta and Google, on our public pages only.
• Merchant logos: Logo.dev. Your device loads a merchant’s logo from it using the merchant’s website address; it receives no information about you beyond what any website receives when your device loads an image.
• Payments, once paid plans exist: Stripe for payments on our website, and Apple for purchases in the iOS app.

We may also share personal information:

• when you ask us to, or with your consent;
• when the law requires it, or to protect the rights, safety and property of our users, the public or EveryDolla;
• as part of a merger, acquisition or sale of all or part of our business, in which case this policy continues to protect it and we will tell you before it becomes subject to a different policy.

7. Where your information is kept

We and our service providers store and process information in the United States and other countries. When your information leaves your country, we protect it as this policy describes and use the safeguards the law requires, such as standard contractual clauses.

8. Cookies and similar technologies

We use a small number of cookies and similar technologies:

• Essential: to keep you signed in, protect sign-in and Gmail connection against forgery, carry a one-time message across a page change, and remember your view choices such as the period and filters you picked. The Services don’t work without them.
• Preferences on your device: your light or dark appearance, your card layout and unsent eVe drafts, kept in your browser’s storage.
• Analytics: PostHog sets a cookie and uses browser storage to see how the website and apps are used. It knows you by an account number, never your name or email, and amounts, merchant names and eVe conversations are hidden from it. You can turn it off in Account.
• Advertising measurement: on our public pages only (the home page, the free tools, the rates and guides pages, the about and policy pages, and sign-up and sign-in), the Meta Pixel and Google Analytics set cookies that tell us which of our ads and links bring people to EveryDolla. When you create an account on our website, we tell Meta and Google that a sign-up happened, with your email in a scrambled (hashed) form so it can be matched to an ad you saw. These tools never run in the signed-in app or in onboarding, and never receive your transactions, balances or anything from Gmail.

If your browser sends a Global Privacy Control signal, we don’t load the advertising tools. You can block or delete cookies in your browser’s settings; blocking essential cookies signs you out. We do not respond to browser “Do Not Track” signals, because there is no agreed standard for them.

9. How long we keep it

• Your account and everything in it (purchases, budgets, categories, cards, eVe chats, memories, voice transcripts and what eVe read from documents): until you delete it, or your account.
• Uploaded documents: a receipt attached to a purchase is kept with that purchase until you remove it or delete the purchase. Any other original file is deleted automatically 30 days after eVe finishes reading it, or sooner if you remove it. The purchases read from a document stay with your account.
• Expenses you delete: removed for good 7 days after you delete them, the time you have to undo it.
• Bank alert messages: never stored.
• Your iPhone’s push addresses and device details: until you sign out on that phone or delete your account.
• Websites eVe opens: the site’s session, for up to 15 minutes.
• Sign-in records: for as long as the session lasts.
• Usage counters for eVe’s daily limits: 7 days.

When you delete your account, we delete your personal information from our systems. Copies in backups are removed as those backups expire, within a limited period. We may keep information longer only where the law requires it, or to resolve a dispute or prevent fraud.

10. How we protect it

Information travels encrypted (HTTPS). Your Gmail permission, your sign-in tokens and your uploaded documents are stored encrypted, and we store no bank passwords. Access to our systems is limited to the people who need it to run the Services. No system is perfectly secure, so we cannot promise that information will never be accessed without permission, but we will tell you and the authorities as the law requires if a breach affects you.

11. Your choices and rights

You can, at any time:

• see and correct your information in the app;
• delete purchases, memories and documents, and disconnect Gmail under Connections;
• delete your account and everything in it, in the web app under Account, or in the iOS app. It happens right away and cannot be undone;
• ask us for a copy of your information, to correct or delete it, or to restrict or object to how we use it, by writing to info@everydolla.tech.

Depending on where you live, the law may give you further rights, including under Jamaica’s Data Protection Act, 2020, the EU and UK GDPR, and US state laws such as California’s. We honour these rights for everyone, wherever you live. We answer requests within 30 days and may need to confirm your identity first. We won’t treat you differently for using them. Where we rely on your consent, you can withdraw it at any time; that doesn’t affect what we did before.

In the EU and the UK, the GDPR gives you the right to access your information, correct it, have it deleted, restrict or object to how we use it, and receive it in a portable form. Our legal bases for each use are in Section 3, and Section 7 explains how we protect information sent to service providers in the United States. Write to info@everydolla.tech to use any of these rights.

If you are unhappy with how we handled your information, please tell us first. You can also complain to your data protection authority; in Jamaica, that is the Office of the Information Commissioner, and in the EU or the UK, the supervisory authority where you live.

California residents: we do not sell personal information. Our use of the Meta Pixel and Google Analytics on public pages, and telling Meta and Google about a sign-up, may count as “sharing” for cross-context behavioral advertising under California law. We treat a Global Privacy Control signal as your request to opt out, and you can also ask us to stop by contacting us. We use sensitive information only to provide the Services.

12. Children

The Services are not meant for children under 13, and we don’t knowingly collect information from them. Anyone under 18 needs a parent or guardian’s permission. If you think a child under 13 has given us information, write to info@everydolla.tech and we will delete it.

13. Changes to this policy

We will update this policy when the Services or the law change, and the date at the top will say when. If a change matters, we will tell you in the app or by email before it takes effect.

14. Contact us

Email info@everydolla.tech, or write to:

See also our Terms of Service and Refund Policy.