Privacy Policy

1. Privacy Philosophy & Sovereignty

Dime is built on the fundamental principle of financial data sovereignty. Unlike legacy budgeting apps that monetize your financial habits by selling aggregated transaction feeds to hedge funds and marketers, Dime treats your financial life as strictly confidential.

Whether you access Dime via our hosted platform or run a self-hosted instance, all database transactions, wallet balances, bill schedules, and shared expense books are stored within isolated, encrypted MongoDB collections. We do not inspect, monetize, or profile your spending behavior.

2. Information We Collect

We only collect data that is strictly required to provide you with personal finance management and collaboration capabilities:

• Identity & Authentication: Name, email address, session tokens, and cryptographic public key credentials generated when registering WebAuthn Passkeys. Plaintext passwords and private biometric keys never touch our servers.
• Financial Records: Accounts, wallets, currency codes, transactions (amounts, merchants, dates, categories, notes), split allocations, budgets, loan records, subscription contracts, and investment holdings.
• Receipt Images: Images of receipts and invoices you voluntarily upload or drag-and-drop for OCR processing.
• Collaborative Workspaces (Spaces): Organization names, invited partner/roommate email addresses, and group settlement balances.
• Security Logs: IP address, browser user-agent, and timestamp logs retained temporarily for brute-force prevention, session verification, and administrator audit trails.

3. How We Use Your Data

Your data is used solely to execute the features you interact with inside Dime:

• Calculating real-time net worth, cash flow trajectories, and financial health scores.
• Evaluating user-configured Automation Rules (e.g. matching merchants to categories).
• Generating renewal alerts for upcoming bills, subscriptions, and free trial expirations.
• Simplifying group debts and calculating minimal settlement transfers for shared spaces.
• Providing context to the AI Financial Coach when you deliberately prompt it for financial advice.

4. AI & OCR Processing (Google Gemini)

Dime utilizes Google Gemini vision and language models to power the AI Receipt Scanner and the AI Financial Coach:

• Receipt Scanning: When you upload a receipt, the image is transmitted securely via TLS encryption to the Gemini API solely for optical character recognition (OCR) and structured JSON extraction (merchant, date, total, line items).
• AI Financial Coach: When asking the coach a question, only the relevant aggregated financial figures (e.g., monthly burn rate, category totals) necessary to formulate an answer are provided to the model.
• No Model Training: Under our enterprise API terms, neither your receipt images nor your financial figures are ever retained or used to train Google's machine learning models.

5. Data Storage, Isolation & Security

Dime adheres to strict security and tenant isolation controls:

• Tenant Segregation: Every database query is strictly scoped by authenticated `userId` or validated `organizationId`. Cross-tenant data leakage is prevented at the database query layer.
• Encryption: Data in transit is secured using TLS 1.3. Production MongoDB database clusters enforce encryption-at-rest (AES-256).
• Two-Factor Authentication: We support both Time-Based One-Time Passwords (TOTP) and hardware FIDO2 passkeys for account protection.

6. Third-Party Services & Integrations

We minimize third-party dependencies. Dime integrates only with essential infrastructure providers:

• Exchange Rate Feed: Live exchange rates are queried periodically using public open rate APIs. No user data, account balances, or wallet IDs are ever transmitted with exchange rate queries.
• Transactional Email: Resend is used strictly to deliver verification emails, password resets, and organization invites.
• Zero Trackers: Dime contains zero third-party tracking scripts, zero Facebook/Google ad pixels, and zero cross-site behavioral cookies.

7. Your Rights, Data Export & Deletion

Under global privacy standards, including GDPR and CCPA, you retain complete authority over your records:

• Right to Export: You can export your full transaction log, wallets, contacts, budgets, and debt records into standard CSV or JSON format at any time.
• Right to Erasure (Deletion): You have the right to request immediate and complete deletion of your account. Upon account deletion, all associated transactions, wallets, receipts, goals, and credentials are permanently purged from our database.
• Right to Rectification: You can edit or re-categorize any transaction, wallet, or loan record directly within the workspace.

8. Cookies & Local Storage

Dime uses only strictly necessary first-party cookies:

• better-auth.session_token: Authenticates your encrypted session.
• theme: Stores your preference for dark or light mode.

We do not use advertising, marketing, or behavioral tracking cookies.