Privacy Policy

1. Who we are & scope

Onbramble Inc. operates Bramble, a US-based personal-finance app for net-worth tracking, savings goals (“pots”), spending and “money leak” insights, debt payoff, and financial education (“Money School”). This Policy applies to personal information we process as a controller (the party that decides why and how data is used) through the Service. It takes effect on July 24, 2026.

It does not cover third parties' own handling of your data (for example, your bank or Apple), which is governed by their own privacy policies.

2. Data we collect

Information you provide

• Account & identity: name, email address, date of birth (to confirm you are 18+), and postal address where required for account setup or compliance.
• Authentication data: credentials used to secure your account, and settings such as a PIN or biometric unlock (biometric data stays on your device and is handled by iOS — we never receive it).
• Support & communications: messages you send us and information you choose to share when contacting support.

Bank account data — via Stripe Financial Connections

When you link a bank account, the connection is handled by Stripe Financial Connections on a read-only basis. Through Stripe we request only:

• balances — account names, types, and current/available balances; and
• transactions — transaction amounts, dates, descriptions, and categories.

Information collected automatically

• Device & app data: device model, operating-system version, app version, language, and similar technical details.
• Usage & analytics: in-app events (for example, screens viewed or features used) and diagnostic/crash data, used to keep the app working and improve it. See our Cookie Policy for what the website sets.

3. How we use your data

We use personal information to:

• provide the net-worth, spending, pots, and debt-payoff features;
• categorize transactions and detect recurring payments and “money leaks”;
• deliver Money School educational content;
• authenticate you, enable account recovery, and keep the Service secure;
• provide customer support and respond to your requests;
• maintain, debug, and improve the Service and develop new features;
• process subscriptions and manage your entitlements;
• comply with legal obligations and enforce our terms.

We do not use your bank transaction data to serve third-party advertising, and we do not sell it. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

4. Legal bases for processing (EEA/UK)

Where the EU or UK GDPR applies, we rely on these legal bases:

• Contract: to provide the Service you sign up for (accounts, aggregation, subscriptions).
• Legitimate interests: to secure, debug, and improve the Service, prevent fraud, and communicate about it — balanced against your rights.
• Consent: for linking bank accounts and any optional analytics that require it; you can withdraw consent at any time.
• Legal obligation: to meet record-keeping, tax, and compliance requirements.

5. Sharing & sub-processors

We share personal information only with service providers that help us run Bramble, under contracts that limit their use of the data to providing services to us. Our key sub-processors are:

• Supabase — database, authentication, and hosting. Privacy
• Stripe — Financial Connections (read-only bank data) and payment processing. Privacy
• Apple App Store and RevenueCat — subscription purchase, billing, and entitlement management. Apple · RevenueCat
• Resend — transactional email (e.g. sign-in and account notices). Privacy

We may also disclose information: (a) to comply with law or valid legal process; (b) to protect the rights, safety, and security of our users, the public, or Bramble; and (c) in connection with a merger, acquisition, or sale of assets, in which case we will notify you and any successor will remain bound by this Policy. Some of these providers process data in the United States.

6. We do not sell your data

7. Data retention

We keep personal information for as long as your account is active and as needed to provide the Service. When you delete your account, we delete or de-identify your personal and bank-derived data within a commercially reasonable period, except where we must retain limited records to comply with legal, tax, accounting, or security obligations, or to resolve disputes. You can revoke a bank connection at any time in the app, which stops further data retrieval for that account.

8. Security

We take security seriously and use industry-standard safeguards, including:

• encryption of data in transit (TLS) and at rest;
• row-level security (RLS) and least-privilege access so that data is scoped to the account it belongs to;
• read-only bank access, so credentials never touch our systems;
• access controls, logging, and regular review of our providers.

No method of transmission or storage is 100% secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and regulators as required by law.

9. Your rights & choices

Depending on where you live, you may have the right to:

• access and receive a copy of your personal information;
• correct inaccurate information;
• delete your information;
• export/port your data in a portable format;
• opt out of certain processing and withdraw consent;
• object to or restrict processing where applicable.

10. US state privacy rights (CCPA/CPRA & similar)

If you are a California resident (or a resident of another US state with a comprehensive privacy law), you have the right to:

• Know what personal information we collect, use, and disclose;
• Delete personal information we hold about you, subject to exceptions;
• Correct inaccurate personal information;
• Opt out of the “sale” or “sharing” of personal information and of certain targeted advertising — though, as noted, we do not sell or share your personal information; and
• Non-discrimination for exercising your rights.

The categories of personal information we collect are described in Section 2. We collect these to provide the Service as described in Section 3. To exercise your rights, use the in-app controls or email support@onbramble.com. You may use an authorized agent; we may need to verify your identity before acting on a request.

11. EU/UK privacy rights (GDPR & UK GDPR)

Bramble is offered to US residents, but if you access the Service from the European Economic Area, United Kingdom, or Switzerland, the GDPR/UK GDPR may apply. In that case, Onbramble Inc. is the controller of your personal data. In addition to the rights above, you have the right to lodge a complaint with your local supervisory authority (for example, your national Data Protection Authority, or the UK ICO). Our legal bases are described in Section 4. For any GDPR request or to reach our privacy contact, email support@onbramble.com.

12. Children

Bramble is not directed to children. The Service is intended only for adults aged 18 and over, and we do not knowingly collect personal information from anyone under 18 (and never from children under 13). If we learn that we have collected such information, we will delete it. If you believe a minor has provided us information, contact support@onbramble.com.

13. International data transfers

We are based in the United States, and our providers may process and store data in the United States and other countries. Where required, we use appropriate safeguards (such as the European Commission's Standard Contractual Clauses) for transfers of personal data outside the EEA/UK.

14. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you in the app or by email. Your continued use of the Service after an update means you accept the revised Policy.

15. Contact us

Questions, requests, or complaints about privacy? Contact Onbramble Inc. at support@onbramble.com, and we will respond promptly.