← Back to Skill Acquired
Privacy Policy
Last updated: September 12, 2026
The Short Version
- Your financial data is yours. We never sell it or share it with advertisers.
- AI features use Anthropic's API. Your data is deleted within 7 days and never used to train AI models.
- All data is encrypted in transit (HTTPS) and at rest (Cloudflare infrastructure).
- You can delete your account and all associated data at any time.
- We don't track you across the web. No analytics cookies, no ad networks.
Who We Are
Skill Acquired is a personal finance platform operated at skillacquired.io. We help you track spending, manage budgets, monitor debts, and understand your finances with minimal effort.
What Data We Collect
| Data Type | Why We Collect It |
|---|
| Email and password | Account authentication |
| Bank account and transaction data | Categorization, budgeting, and spending insights. Arrives either from a CSV you upload or from a bank connection you make through Plaid. |
| Bank connection tokens (from Plaid) | Keeping a connection you authorized alive so transactions can sync. Encrypted before storage. |
| Amazon order data (from browser extension) | Matching purchases to bank transactions |
| Budget categories and amounts | Budget tracking and alerts |
| Debt information (balances, rates, types) | Debt tracking and payoff planning |
| Subscription details | Recurring charge monitoring |
| AI chat messages | Providing financial assistance via AI |
We do not collect: social security numbers, full bank account numbers, credit card numbers, government IDs, or location data. We never see or receive your online banking username or password.
Connecting a Bank (Plaid)
You can connect a bank account so that transactions arrive on their own instead of being uploaded by hand. That connection is made through Plaid, a regulated data provider used by thousands of financial apps.
Your bank username and password are entered into Plaid’s own secure window and are sent to your bank by Plaid. They are never sent to Skill Acquired, never pass through our servers, and are never stored by us. We could not see them if we wanted to.
What we receive and store when you connect a bank:
- An access token from Plaid that represents the connection you authorized. It is encrypted with AES-GCM before it is written to our database, using a key that is not stored in that database.
- The institution name and the account names, types and masked last four digits of the accounts you chose to share.
- Account balances and transactions: date, amount, merchant or description, and the category Plaid assigns.
You can disconnect a bank at any time from the Accounts screen. Disconnecting tells Plaid to revoke the connection and erases our copy of the token in the same step, so neither side can use it again. Transactions already synced stay in your account as your own financial history until you delete them or close your account.
Plaid handles the data it collects under Plaid’s own privacy policy, and Plaid gives you tools to see and manage the connections you have made across every app.
How AI Processes Your Data
Skill Acquired uses Anthropic's API to power smart categorization and the AI chat assistant. Here's exactly what happens:
When you import transactions, your transaction descriptions (not full bank statements) are sent to Anthropic's API through our secure server for categorization. When you use the AI chat, your message and relevant financial context are sent to generate a response.
Important facts about this process:
- All AI requests go through our server. Your browser never contacts Anthropic directly.
- Anthropic automatically deletes all API inputs and outputs within 7 days (reduced from 30 days as of September 2025).
- Your data is never used to train AI models. This is Anthropic's default commercial API policy — it is not an opt-out we selected, it is a flat restriction with no override. This protection applies regardless of any changes to Anthropic's consumer product policies.
- We do not send Anthropic your name, bank account numbers, Social Security numbers, or raw bank statements. Only transaction descriptions (e.g., merchant names) and amounts are included in categorization requests.
- You control exactly how much AI you use. In Settings, choose from three levels: no AI (fully manual), smart categorization only (transaction descriptions sent for sorting), or full AI (categorization plus chat assistant). You can change your level anytime, and the app remains fully functional at every level.
Where Your Data Lives
- Database: Cloudflare D1 (SQLite-compatible, encrypted at rest)
- File storage: Cloudflare R2 (encrypted at rest)
- API: Cloudflare Workers (serverless, no persistent servers)
- Region: Data is processed in Cloudflare's global network.
All connections use HTTPS. HTTP requests are automatically upgraded.
Who Can See Your Data
Only you. Your financial data is isolated to your account. Other users cannot see your data.
Admin access to individual user data requires a Support PIN that you generate and share voluntarily. All admin data access is logged in an audit trail.
Third-Party Services
| Service | Purpose | Data Shared |
|---|
| Anthropic (API) | AI categorization and chat | Transaction descriptions, chat messages |
| Resend | Transactional email | Email address only |
| Cloudflare | Hosting and infrastructure | All app data (encrypted) |
| Plaid | Bank account connection and transaction sync | Your bank credentials go to Plaid, never to us. Plaid returns account and transaction data. |
We do not use analytics services, advertising networks, or tracking pixels.
What We Don't Do
- We never sell your data to anyone.
- We never share your data with advertisers.
- We never use your data to train AI models. Anthropic's commercial API terms prohibit this by default, and we do not opt in to any data-sharing programs.
- We never see your bank username or password. A bank connection is authorized through Plaid, and Plaid holds those credentials, not us.
- We never move money. Skill Acquired can read the transactions you share with it and nothing else. There is no payment, transfer or trading capability in the product.
- We never store passwords in plain text. All passwords are hashed with PBKDF2 (100,000 iterations).
Your Rights
- Export all your data at any time (JSON backup from Settings)
- Delete your account and all associated data
- Disable AI features while keeping full manual functionality
- Request information about what data we hold about you
When you delete your account, all data is permanently removed from our database.
Data Retention
- Your account data: Retained while your account is active.
- Closing your account: Your account is closed immediately and you have 7 days to sign in and undo it. After that everything is erased automatically.
- Bank connection tokens: Erased the moment you disconnect the bank, and on account erasure.
- AI processing: Inputs and outputs deleted by Anthropic within 7 days. We keep no copy.
- Audit logs: Retained for the life of your account, included in your export, and erased with your account.
- Login attempts: Retained for 90 days for security, then deleted.
- Kept after erasure, on purpose: a record that your account agreed to a specific version of these terms, and a counter of what your AI usage cost to run. Neither contains your transactions. They exist so we can prove what you agreed to and what we spent.
Security Measures
- HTTPS encryption on all connections
- Encrypted data at rest (Cloudflare D1 and R2)
- PBKDF2 password hashing (100,000 iterations)
- Session-based auth with httpOnly, Secure cookies
- Optional two-factor authentication (TOTP/MFA)
- Progressive account lockout on failed logins
- IP-based rate limiting on authentication endpoints
- Server-side AI API key management (never exposed to browsers)
- Bank access tokens encrypted with AES-GCM before storage, with the key held outside the database
- A documented information security policy and data retention policy, reviewed quarterly
Children's Privacy
Skill Acquired is not intended for users under 18. We do not knowingly collect data from minors.
Changes to This Policy
If we make material changes, we will notify you via the app or email before the changes take effect. We will never retroactively weaken your privacy protections without your consent.
Contact
Questions about your privacy? Email us at [email protected]
Reporting a security problem? Email [email protected]. We read it and we will respond.