Privacy Policy

1. Who we are

EveryDolla is a personal finance app for Jamaica. It is made by EveryDolla, LLC (“EveryDolla”, “we”, “us”), and this policy covers our website at everydolla.tech, the web app, the EveryDolla iOS app and eVe, our assistant (together, the “Services”). We decide how your personal information is used, so we are responsible for it.

Questions about this policy or your information: info@everydolla.tech.

2. What we collect

Your account

When you sign in with Google or Apple, they send us your name, email address and, from Google, your profile photo. If you use Apple’s Hide My Email, we receive a private relay address instead of your real one. We never receive your Google or Apple password, and we do not offer sign-in with a password of our own.

Your money

• Purchases. For each purchase: the amount and currency, the merchant’s name, the date and time, your bank, the card it was made on (its last digits only) and a category. They come from your bank’s transaction alerts (see below), from expenses you add yourself, and from statements and receipts you give eVe.
• What you set up. The banks you pick (and your answer if we ask about another bank), your budgets, bills, funds and limits, your own categories, names and limits for your cards, and how you have filed merchants.

We never ask for, and never receive, your online banking password or your full card or account numbers. EveryDolla cannot move money.

Gmail, if you connect it

If you choose to connect a Gmail account, Google asks you to give EveryDolla read-only access to it. Google’s consent screen describes that permission broadly. EveryDolla uses it to receive the transaction alerts sent from the alert addresses of the banks you pick (spam and trash included, where alerts sometimes land). We also check whether alerts from the other banks we support are there, so we can ask if you want to add those banks. That check only counts them. We don’t open them, and all we keep is which banks have alerts and roughly how many. Nothing from those banks comes in unless you say yes. From each alert we keep the purchase details listed above, the message’s Gmail ID so we never import it twice, and a masked version of its subject line (every digit replaced) that helps spot duplicates. We do not keep the message itself, and apart from receipts (below) we never receive, keep or use any other email. We also keep the result of Gmail’s checks that the alert really came from your bank, so an alert that fails them is flagged for you to look at rather than counted. Our full commitments for Google data are in Section 4.

Outlook or Hotmail, if you connect it

If you choose to connect an Outlook or Hotmail account, Microsoft asks you to give EveryDolla a permission it calls Mail.Read. Microsoft describes it broadly. EveryDolla uses it only to receive the transaction alerts sent from the alert addresses of the banks you pick, Junk included. From each alert we keep the same purchase details as for Gmail, and the message’s Outlook ID so we never import it twice. We do not keep the message itself, and we never receive, keep or use any other email. You can disconnect the account in EveryDolla under Connections at any time. This stops all access and deletes our permission. To remove EveryDolla on Microsoft’s side too, go to Microsoft’s app permissions page and select EveryDolla. Purchases already imported stay until you delete them or your account.

Receipts, where receipt matching is on

Where receipt matching is available to you, EveryDolla also receives receipts, orders, invoices and bills from your connected Gmail and matches them to your purchases, so you can see what a charge was for. It is on unless you turn it off, in Account under Connections (“Match receipts to purchases”). It fetches only messages in Gmail’s Purchases category or with receipt, order, invoice, payment or bill in the subject, and leaves out spam and trash.

From each receipt we keep the sender’s name and web address, the order or document number, dates, the currency and amounts, the card’s last digits, what was bought (each item’s name, kind, price and any renewal date, and for an app, its name and picture) and a bill’s details, such as charges, usage, due dates and balances. We do not keep the email or its attachments: an attached PDF is read and then discarded. When you open the original email from a purchase, it is fetched from Gmail to show you and not kept. To show an app’s name and picture, we look up its App Store ID with Apple, which receives nothing about you. Receipts from services that suggest something sensitive, such as dating or health apps, are kept out of eVe.

Plus and payments

If you buy EveryDolla Plus or eVe credits on our website, Paddle takes your payment as our Merchant of Record. Paddle collects your card and billing details and keeps its own tax and payment records, under Paddle’s privacy notice. It sends us what we need to give you what you bought: your Paddle customer ID, your plan and its status, start, renewal and end dates, and each payment’s ID, product, amount, currency and date. We never receive your full card number.

If you buy in the iPhone app, Apple takes the payment through In-App Purchase. We receive each purchase’s transaction IDs, product, price, dates and status, linked to your account by a random ID the app attaches to the purchase. We never receive your Apple payment details.

We also keep your eVe credit balance and a record of the credits added to and used from it.

eVe, our assistant

• Chats. Your messages to eVe, her replies, and the charts, tables and drafts in them.
• Memories. Short notes you ask eVe to remember, and facts you tell her when she asks, such as your payday, income, goals, debts, dependants and housing. She never stores health or dating details. You can see, edit and delete them under eVe’s memory at any time.
• Documents. Statements and receipts you upload, and the purchases eVe reads from them.
• Voice. When you talk to eVe, your audio goes to our AI provider to be turned into text. We keep the text and never store the audio.
• Websites eVe opens for you. eVe can open a website on your behalf, for example to look up a bill. She takes each action only after you approve it. Passwords you type for such a visit are used once, in memory, and never stored. The site’s own session is kept encrypted for up to 15 minutes. The pages she read stay in your chat.

The iPhone app

• Notifications. If you allow them, your iPhone’s push addresses (for notifications, widgets and Live Activities), an ID the app makes for your installation, and the app version, iOS version, language and time zone. Notifications reach your phone through Apple’s push notification service, so their text passes through Apple. With “Show amounts in notifications and widgets” off (it’s on until you change it), they never include amounts.
• Widgets. A widget shows a summary the app keeps on your phone, such as this month’s spending, and follows the same “Show amounts” setting.
• App opens. The app records when it was opened and whether it was opened from a notification or widget, to time reminders. The website records when it was opened too. Kept for 90 days.
• Face ID and Touch ID. If you lock the app, iOS checks your face or fingerprint on the phone. We never receive it.
• Camera, photos and microphone. Used only when you scan or choose a receipt or statement, or dictate or talk to eVe. We receive only the picture, file or audio you give us, as described above.
• Crash reports. If the app crashes or freezes, it sends a report to Sentry with technical details: the app, the iOS or Android version and the phone model, and the part of the app that failed. A report holds no financial data, no screenshots and no personal details; the app removes amounts and email addresses before it leaves your phone. The website sends error reports the same way.
• App checks. When you sign in with Google, Apple’s App Attest and Google’s App Check confirm the request comes from the real EveryDolla app. They don’t tell us anything about you.

Reports you send us

If you report a problem with a purchase, we keep your report (its reason and any note you add) with the purchase, and email it to our team so someone can look into it.

Your device and how you use the Services

• Sign-in records. The IP address and browser or device type of each signed-in session, so you and we can spot sign-ins that aren’t yours.
• Usage analytics. Which pages are viewed and what is tapped or clicked, without your name or email attached. See Section 8. In the iPhone app these events are tied to your account ID, never your name or email, and you can turn them off under Privacy & data.
• Error reports. When something breaks, a report with technical details about the error. We write our reports so they leave out email addresses, amounts and other personal details.

We do not collect your precise location, your contacts or your photos, and we do not knowingly collect sensitive information such as health, religion or ethnicity.

3. How we use it

We use your information to:

• run your account and the Services: import your purchases, show your spending, cards and budgets, and answer your questions through eVe;
• file your purchases into categories, including with AI (see Section 5), and remember how you file merchants;
• sell and manage Plus and eVe credits, and make sure you don’t pay twice for the same plan;
• send you emails, as Emails we send describes;
• keep the Services and your account secure, and prevent fraud and abuse;
• fix problems and improve the Services, using analytics and error reports;
• answer you when you contact us, and tell you about important changes;
• meet our legal obligations and enforce our terms.

Every total is shown in Jamaican dollars. A purchase in another currency is counted at the J$ amount your bank billed, or at that day’s exchange rate when the bank didn’t say. We fetch the day’s rates from a currency data service, which receives nothing about you.

We do not sell your personal information, and we never use your financial information or anything from Gmail for advertising. To measure our own ads, our public pages use advertising tools from Meta and Google, as “Cookies and similar technologies” explains.

Where the law asks us to name a legal basis (for example in the UK or the EU), we rely on performing our contract with you when we provide the Services and sell you Plus or eVe credits; on your consent when you connect Gmail, upload a document or use voice, and for optional analytics where consent is required; on our legal obligations for payment records; and on our legitimate interests in keeping the Services secure and working well, and in sending you tips and offers you can turn off at any time.

4. Google user data

EveryDolla’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. In particular:

• What we access. With your permission, read-only access to your Gmail (the permission Google calls “gmail.readonly”), and your name, email address and profile photo when you sign in with Google.
• What we use it for. To import purchases from your banks’ transaction alerts into your EveryDolla account and to keep them up to date. We fetch only the alerts sent from the banks you choose. We also count the alerts from the other banks we support, without opening them, so we can ask if you want to add those banks; we keep only which banks have alerts and roughly how many. Where receipt matching is on, we also receive receipts, orders, invoices and bills to match them to your purchases, and keep only the details listed in Receipts.
• What we never do. We do not use Google user data for advertising, we do not sell it, and we do not use it to develop, improve or train generalized AI or machine learning models. We do not transfer it to others except as needed to provide or improve the features you use, for security, or to comply with the law.
• People. No one at EveryDolla looks at your Gmail messages. A person may look at data from an alert only with your permission (for example, to fix an import you reported), when needed for security or to investigate abuse, or when the law requires it.
• AI. To file a purchase into a category, we may send an AI provider its merchant name, with long runs of digits masked, and a price range. We never send the alert itself. To read the items on a receipt, we may send an AI provider the receipt’s text, with email addresses removed and long runs of digits masked. Those providers may not train their models on it (see Section 5).
• Your control. You can disconnect a Gmail account in EveryDolla under Connections at any time. This stops all access and revokes our permission with Google. You can also remove it at myaccount.google.com/permissions. Purchases already imported stay until you delete them or your account.

5. Artificial intelligence

Some features use AI models run by other companies (“AI providers”). What each one receives:

• Filing purchases into categories (OpenAI, Anthropic or Google Gemini): the merchant’s name with long runs of digits masked, a price range rather than the exact amount, and the names of your categories.
• Merchant logos (OpenAI): only the merchant’s name, never amounts, account numbers or personal details, so the model can name the brand’s website. We then fetch the logo for that website address from Logo.dev (see Who we share it with).
• eVe’s answers (Anthropic or OpenAI): your message, the recent conversation, your saved memories, and the financial details eVe looks up to answer, such as purchases, totals and budgets. Not your name or email address. If you ask something that needs the web, the provider may search the web with your question.
• Reading statements and receipts (OpenAI or Anthropic): the pages of the PDF or image you upload. Spreadsheet and bank export files (CSV, Excel, OFX) are read on our own servers and not sent to an AI provider.
• Voice (OpenAI): your audio, to turn it into text or to hold a live voice conversation, and the text eVe reads aloud.
• Reading receipts from Gmail (OpenAI or Google Gemini), where receipt matching is on and a receipt can’t be read without AI: the sender’s name and the text of the receipt and any attached PDF, with email addresses removed and long runs of digits masked.

We use AI providers only under terms that do not allow them to train their models on your data. Where a provider lets us turn off storing requests, we do. Each provider may keep requests for a short time to prevent abuse, under its own policy.

AI can be wrong. Check anything important, such as a category or an amount eVe read from a document, and don’t treat eVe’s answers as professional financial, tax or legal advice. eVe changes your budget only when you approve it, and you can undo a change.

6. Who we share it with

We share personal information only with companies that help us run the Services (“service providers”), under contracts that limit their use of it to that work:

• Hosting and storage: Vercel (the website and apps), Neon (our database), Trigger.dev (background work such as imports) and Cloudflare (where nightly backups of our database are kept).
• Payments: Paddle, which sells Plus and eVe credits on our website as our Merchant of Record, and Apple, for purchases in the iPhone app.
• Email: Resend, which delivers the emails we send you.
• Sign-in: Google and Apple.
• Bank alerts: Google or Microsoft, for the Gmail or Outlook account you connect.
• Notifications: Apple, whose push notification service delivers the iPhone app’s notifications.
• AI: OpenAI, Anthropic and Google, as described in Section 5.
• Analytics and error reports: PostHog and Sentry.
• Advertising measurement: Meta and Google, on our public pages only.
• Merchant logos: Logo.dev. Your device loads a merchant’s logo from it using the merchant’s website address; it receives no information about you beyond what any website receives when your device loads an image.

We may also share personal information:

• when you ask us to, or with your consent;
• when the law requires it, or to protect the rights, safety and property of our users, the public or EveryDolla;
• as part of a merger, acquisition or sale of all or part of our business, in which case this policy continues to protect it and we will tell you before it becomes subject to a different policy.

7. Where your information is kept

We and our service providers store and process information in the United States and other countries. When your information leaves your country, we protect it as this policy describes and use the safeguards the law requires, such as standard contractual clauses.

8. Cookies and similar technologies

We use a small number of cookies and similar technologies:

• Essential: to keep you signed in, protect sign-in and Gmail connection against forgery, carry a one-time message across a page change, and remember your view choices such as the period and filters you picked. The Services don’t work without them.
• Preferences on your device: your light or dark appearance, your card layout and unsent eVe drafts, kept in your browser’s storage.
• Checkout: when you open the checkout on our website, Paddle’s checkout runs on the page and may use cookies and similar technologies to take the payment and prevent fraud, under Paddle’s own policy.
• Analytics: PostHog sets a cookie and uses browser storage to see how the website and apps are used. It knows you by an account number, never your name or email, and amounts, merchant names and eVe conversations are hidden from it. You can turn it off in Account.
• Advertising measurement: on our public pages only (the home page, the free tools, the rates and guides pages, the about and policy pages, and sign-up and sign-in), the Meta Pixel and Google Analytics set cookies that tell us which of our ads and links bring people to EveryDolla. When you create an account on our website, we tell Meta and Google that a sign-up happened, with your email in a scrambled (hashed) form so it can be matched to an ad you saw. When you buy Plus or eVe credits on our website, we tell them about the purchase the same way, with its amount and currency. These tools never run in the signed-in app or in onboarding, and never receive your transactions, balances or anything from Gmail.

If your browser sends a Global Privacy Control signal, we don’t load the advertising tools. You can block or delete cookies in your browser’s settings; blocking essential cookies signs you out. We do not respond to browser “Do Not Track” signals, because there is no agreed standard for them.

9. Emails we send

Our emails come from eVe at mail.everydolla.tech and are delivered by Resend. There are four kinds:

• Account emails, such as a welcome, a warning that your bank alerts have stopped arriving, news about your plan, and confirmation that your account was deleted. They tell you things you need to know about your account, billing or security, so they can’t be turned off while you have an account.
• Tips and reminders: ideas for getting more from EveryDolla, and reminders when something needs you. On unless you turn them off.
• Offers and news: what’s new in EveryDolla, and the occasional offer. On unless you turn them off.
• Weekly recap: a short note from eVe on where your money went that week. Off unless you turn it on. Because it includes figures from your account, those figures pass through Resend to reach you.

Every email except account emails has an unsubscribe link at the bottom, which works in one step. You can also change your choices at any time under Account, then Emails, on the web or in the iPhone app. Tips, offers and the recap come at most once a day and three times a week, and only between 9 am and 7 pm Jamaica time.

Links in our emails carry tags that tell us which email and which link a visit came from, without your name or email address. We keep a record of which emails we sent you, not the emails themselves. Paddle and Apple send their own receipts and billing emails for the purchases they handle.

10. How long we keep it

• Your account and everything in it (purchases, budgets, categories, cards, eVe chats, memories, voice transcripts and what eVe read from documents): until you delete it, or your account.
• Uploaded documents: a receipt attached to a purchase is kept with that purchase until you remove it or delete the purchase. Any other original file is deleted automatically 30 days after eVe finishes reading it, or sooner if you remove it. The purchases read from a document stay with your account.
• Expenses you delete: removed for good 7 days after you delete them, the time you have to undo it.
• Bank alert messages and receipt emails: never stored.
• Receipts: a receipt matched to a purchase stays with it. One that isn’t matched is deleted after 30 days, or 75 days for a bill. If you turn receipt matching off, your receipts are hidden at once and deleted 90 days later. Disconnecting Gmail deletes them straight away.
• Your plan and eVe credits: with your account.
• Payment notices: the notices Paddle and Apple send us about each payment hold IDs, the product, amounts and dates, not your name or card. We keep them after an account is deleted, for our tax and accounting records and to resolve disputes. Paddle and Apple keep their own payment records under their own policies.
• Email records: which emails we sent you and your email choices, with your account. We don’t keep the emails themselves.
• Your iPhone’s push addresses and device details: until you sign out on that phone or delete your account.
• Websites eVe opens: the site’s session, for up to 15 minutes.
• Sign-in records: for as long as the session lasts.
• Usage counters for eVe’s daily limits: 7 days.
• When the app was opened: 90 days.
• A record of a deleted account: 12 months, then it is deleted. See below.

When you delete your account, everything in it is deleted from our systems except a short record: your name, your email address, the dates you signed up and left, the answer you gave to “Why are you leaving?” (if you gave one), your plan (free, or Plus and where you paid for it), whether you bought eVe credits, and counts of what the account held, such as how many cards or purchases it had and whether Gmail was connected. It holds no purchases, amounts, merchants, messages or eVe chats. We keep that record for 12 months to understand why people leave, then delete it. Backups that still hold your data expire within 15 days. We may keep information longer only where the law requires it, or to resolve a dispute or prevent fraud.

11. How we protect it

Information travels encrypted (HTTPS). Your Gmail permission, your sign-in tokens and your uploaded documents are stored encrypted, and we store no bank passwords. Access to our systems is limited to the people who need it to run the Services. No system is perfectly secure, so we cannot promise that information will never be accessed without permission, but we will tell you and the authorities as the law requires if a breach affects you.

12. Your choices and rights

You can, at any time:

• see and correct your information in the app;
• delete purchases, memories and documents, and disconnect Gmail under Connections;
• delete your account and everything in it, in the web app under Account, or in the iOS app. It happens right away and cannot be undone;
• ask us for a copy of your information, to correct or delete it, or to restrict or object to how we use it, by writing to info@everydolla.tech.

Depending on where you live, the law may give you further rights, including under Jamaica’s Data Protection Act, 2020, the EU and UK GDPR, and US state laws such as California’s. We honour these rights for everyone, wherever you live. We answer requests within 30 days and may need to confirm your identity first. We won’t treat you differently for using them. Where we rely on your consent, you can withdraw it at any time; that doesn’t affect what we did before.

In the EU and the UK, the GDPR gives you the right to access your information, correct it, have it deleted, restrict or object to how we use it, and receive it in a portable form. Our legal bases for each use are in Section 3, and Section 7 explains how we protect information sent to service providers in the United States. Write to info@everydolla.tech to use any of these rights.

If you are unhappy with how we handled your information, please tell us first. You can also complain to your data protection authority; in Jamaica, that is the Office of the Information Commissioner, and in the EU or the UK, the supervisory authority where you live.

California residents: we do not sell personal information. Our use of the Meta Pixel and Google Analytics on public pages, and telling Meta and Google about a sign-up or a purchase on our website, may count as “sharing” for cross-context behavioral advertising under California law. We treat a Global Privacy Control signal as your request to opt out, and you can also ask us to stop by contacting us. We use sensitive information only to provide the Services.

13. Children

The Services are not meant for children under 13, and we don’t knowingly collect information from them. Anyone under 18 needs a parent or guardian’s permission. If you think a child under 13 has given us information, write to info@everydolla.tech and we will delete it.

14. Changes to this policy

We will update this policy when the Services or the law change, and the date at the top will say when. If a change matters, we will tell you in the app or by email before it takes effect.

15. Contact us

Email info@everydolla.tech, or write to:

See also our Terms of Service and Refund Policy.