Privacy Policy

Effective date: July 3, 2026

Waffle ("we," "us," or "our") operates the personal finance coaching app available at heysyrup.com. Your privacy matters to us, and we've written this policy in plain language so you know exactly what happens with your information.

1. What We Collect

We only collect information you actively provide:

• Account information - your email address and a securely hashed password (we never store your password in plain text).
• Financial data you enter - budgets, goals, spending categories, transactions, and any receipts you scan.
• Bank data you choose to sync - only if you connect a bank through Plaid (see Section 5), we receive read-only transaction and account information from that bank so the app can work. Connecting a bank is optional; you can use Waffle fully without it.
• Chat messages - the conversations you have with Syrup, our AI coach.

2. What We Do NOT Collect

3. How We Use Your Data

Your data is used for one purpose: providing you with personalized financial coaching through Waffle. This includes:

• Authenticating your account and keeping your data secure.
• Displaying your budgets, goals, and spending summaries.
• Powering conversations with Syrup, our AI coach (see Section 4 below).

4. AI Coaching & Anthropic Disclosure

Important details:

• Only the context needed for your current conversation is sent - not your entire account history.
• Anthropic processes this data solely to generate a response. Anthropic does not store your data beyond processing the request, in accordance with their data usage policies.
• Anthropic does not use your data to train their models.
• Syrup provides coaching and educational guidance only - never professional financial advice. See our Terms of Service.

5. Third-Party Services

We rely on a small number of trusted third-party services to operate Waffle:

Supabase (Authentication & Database)

Your account credentials and financial data are stored in Supabase, a cloud-hosted PostgreSQL database with built-in authentication. Data is encrypted at rest and in transit. Supabase's infrastructure is hosted on AWS.

Plaid (Optional Bank Connections)

If you choose to connect a bank, the connection is made through Plaid, a third party that specializes in secure bank connections. Your bank username and password are entered on Plaid's own secure screen and are never visible to or stored by Waffle. Plaid provides us read-only transaction and account data - we request only Plaid's Transactions product, nothing more, and we never receive the ability to move money. Your bank data is never used for credit, lending, or eligibility decisions. Plaid's handling of your data is governed by Plaid's privacy policy. You can disconnect a bank at any time in the app; disconnecting deletes the synced bank data from our systems and revokes Plaid's access to your bank.

Anthropic (AI Coaching)

As described in Section 4, your financial context is sent to Anthropic's API for AI coaching responses. Anthropic acts as a data processor on our behalf. Your bank login credentials are never part of what we send - we never have them.

Cloudflare (Hosting & Delivery)

Waffle is hosted on Cloudflare Pages. Cloudflare provides content delivery and security services (e.g., DDoS protection). Cloudflare may process standard web request metadata (IP address, user-agent) as part of delivering the site.

6. Local Storage

Waffle uses your browser's localStorage to cache certain data on your device for offline access and faster loading. This data stays on your device and is never transmitted to third parties. You can clear it at any time through your browser settings.

7. Data Retention

We retain your account data and financial information for as long as you maintain an active Waffle account. When you delete your account, all of your data is permanently removed from our systems, including data stored in Supabase. There is no recovery after deletion.

8. Your Rights

You have full control over your data. Through the Waffle app, you can:

• Access - View all financial data associated with your account at any time.
• Export - Request a copy of your data by emailing [email protected].
• Delete - Permanently delete your account and all associated data, directly in the app (Profile → Delete account). Deleting your account also disconnects any linked banks and deletes the synced bank data.
• Disconnect a bank - Remove a bank connection anytime in the app without deleting your account.

You can also contact us at [email protected] for assistance with any of these.

9. California Residents (CCPA)

If you are a California resident, you have the right to:

• Know what personal information we collect and how it is used.
• Request deletion of your personal information.
• Not be discriminated against for exercising your privacy rights.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. To exercise your rights, use the in-app controls or email [email protected].

10. European Residents (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have additional rights under the GDPR, including:

• The right to access, rectify, or erase your personal data.
• The right to restrict or object to processing.
• The right to data portability.
• The right to withdraw consent at any time.

Our legal basis for processing your data is your consent (when you create an account) and the performance of our service. You may exercise any of these rights by contacting us at [email protected].

11. Children's Privacy

Waffle is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete that information promptly. If you believe a child has provided us with personal data, please contact us at [email protected].

12. Security

We take reasonable measures to protect your information, including encryption in transit (TLS/HTTPS) and encryption at rest in our database. Passwords are hashed and never stored in plain text. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or by email. The "Effective date" at the top of this page indicates when the policy was last revised. Your continued use of Waffle after changes are posted constitutes acceptance of the updated policy.

14. Contact Us

If you have questions or concerns about this Privacy Policy or your data, reach out to us:

• Email: [email protected]
• Website: heysyrup.com