Privacy Policy

Households are separate

Each household's data is its own. Everything Argus stores for a household is tied to that household's owner, and every screen reads only the signed-in household's records. Nobody in one household can see another's, and nothing is pooled or compared between them.

Inside a household, the owner chooses who else can sign in. Family members see and change the same books. A bookkeeper sees every account and transaction and can categorize them. The owner can remove either at any time, which deletes that person's login.

What the operator can and cannot see

The operator has their own household like anyone else. In Argus, for a household that is not their own, the operator can see only:

• the owner's email address;
• when the household was created;
• how many bank connections it has, as a number;
• how many people can sign in to it, as a number;
• when someone in it last opened Argus;
• whether it is paused, and its two limits: bank connections, and merchant lookups a day.

The operator cannot see, in Argus, another household's balances, transactions, bank or account names, merchants, categories, notes, budgets, bills, loans or invoices, and there is no setting that turns that on. The operator can pause a household and can remove one.

One limit on that should be said plainly. The operator runs the servers and the database Argus is stored in, and controls the key that bank tokens are encrypted with. Someone in that position has the technical means to read the database directly, outside the application. Argus gives them no screen for it, but it cannot prevent it. Accept an invitation only from someone you would trust with that.

What data Argus holds

With a household's explicit authorization, Argus stores for that household:

• Bank and card data from Plaid — account names, balances, transactions, holdings and loan details, for accounts the household connects.
• Invoice data from QuickBooks — invoice numbers, amounts, dates, customer names and balances, for companies the household connects via Intuit's OAuth flow.
• Bills and invoices from BILL, if the household connects it.
• Data the household enters or uploads — budgets, savings goals, categories, business entities, bills, loans, notes, tags and statement files imported by hand.
• Sign-in details — each person's name and email address, passkey public keys, a password stored only as a salted hash, and an authenticator secret if one is set up. Argus never sees a biometric.
• When each person last opened Argus, and, for a device with alerts switched on, the address its notifications are sent to.

How it is stored

Data is held in a private PostgreSQL database. Access and refresh tokens for Plaid, QuickBooks and BILL are encrypted at rest with AES-256-GCM under a key held only in the application environment, and are decrypted only at the moment a request is made to that provider. One key protects every household's tokens.

Who it is shared with

Argus does not sell or rent financial data, and passes it on only as listed here. There is no advertising, no third-party analytics and no tracking. Data reaches the following third parties, and only for the purpose named:

• Plaid, Intuit (QuickBooks) and BILL, as the sources of the data a household chooses to connect, under their own privacy policies.
• Vercel, which hosts the application, and the database host the operator uses, which stores everything listed above.
• Resend, which sends Argus's emails when the operator has switched email on: invitations, password reset links, one-time sign-in links, and notices that a login changed or that an accountant's key was made or emailed. It receives the address each message goes to and the message itself, with any link in it. None of these messages contains a balance, a transaction or any other financial figure. One message can carry a key that reads transactions: if a household's owner chooses to email an accountant's key to their accountant, that message holds the key and passes through Resend, which also receives the accountant's address and the owner's as the reply address.
• Apple, Google or Mozilla, whichever runs the notification service for a device, when someone switches alerts on for it. Depending on which alerts the household chooses, an alert can include an amount, a merchant name and an account name. Each one is encrypted so that only that device can read it: the notification service carries it without being able to see what it says.
• Anthropic, but only if the operator has switched the optional merchant features on. There are two. First, for a transaction Argus has not been able to categorize automatically, Argus sends the merchant's statement descriptor, the transaction amounts at that merchant, the nickname of the account it was charged to, and the household's own category names, in order to get back a description of what the business is. That description is only ever a suggestion someone in the household confirms. Second, for a merchant that has no logo and no known website, Argus sends the merchant's name, tidied from the bank's wording, and the bank's broad category for it, and nothing else, so that Anthropic's model can search the web for the address of the merchant's website. A name that reads as a transfer, a payment through a service such as Venmo or PayPal, rent, income, a fee, a street address or an account reference, or that contains an @, is not sent. Argus cannot always tell a person's name from a business's, so when the bank lists a person as the merchant, that person's name can be sent. Argus does this on its own only for merchants the bank has filed as purchases; a merchant known only from an imported file is sent only when someone in the household presses the button to look for logos. Argus keeps an address that matches the merchant's name without asking the household. In neither case are account numbers, balances or credentials sent. An account nickname or a statement descriptor can contain a name if that is what it says.
• Merchants' own websites. To show a merchant's logo, Argus's server requests the icon from that merchant's public website, including a website found by the search described above. The website receives one request from Argus's server, not from a household's device, and it carries nothing about the household: the website learns only that something asked for its icon.

Separately, a household's owner can create a key that lets their accountant's software fetch transactions from Argus: the date, amount, merchant, account name and last four digits, the bank's reference for the transaction, company, a business, deductible or personal marking, and the household's note. That system receives them only once the owner has created a key, and only until the key is revoked or expires twelve months later. A key stops answering while its household is paused, and is deleted when the household is closed or removed. Argus cannot take back what that system has already fetched.

How long it is kept

Argus is a financial record, so transactions, balances and invoices are retained for as long as the household keeps its Argus. That is the point of it: a budget compares this month to last year, and the year-end export for an accountant reaches back over prior tax years. Nothing is retained for a purpose beyond that.

• Provider tokens are destroyed with the connection record they belong to, in the same operation. A destroyed token cannot be recovered and cannot be used to read anything further.
• Financial data is deleted from the database when the household is closed or removed, in the same operation. Copies in the database host's own backups, if it keeps any, are outside Argus's reach and expire on that host's schedule.
• The security log records sign-ins, changes to how people sign in, invitations, keys and downloads, with the network address each came from. The owner of a household can read their own household's log, which includes the addresses their family and bookkeeper signed in from. Lines are deleted after 400 days, or with the household.
• Sign-in credentials — passkey public keys, password hashes and second-factor secrets — are deleted with the login they belong to.

This policy is reviewed once a year, and whenever a new provider or a new kind of data is added.

Disconnecting, taking your data and deletion

A QuickBooks company can be disconnected at any time from the Business screen. Disconnecting revokes the grant with Intuit, so Argus can no longer read from that company, and the stored tokens are destroyed.

A bank connection is disconnected from the Accounts screen at any time. Disconnecting revokes the connection with Plaid so no further data can be retrieved, destroys the stored access token, and removes the accounts and transactions that came in through it.

A household's owner can take their data and go. In Settings, Download my transactions saves every transaction as a spreadsheet file. Close my Argus then deletes the household: every login in it, every bank connection (each is revoked with Plaid first), QuickBooks access, and every account, transaction, budget, bill, loan, goal, rule and setting. It asks for the owner's email address to be typed first, and it cannot be undone.

The operator can remove a household, which does exactly the same thing, and can pause one, which deletes nothing. A paused household cannot be opened, so its owner cannot download from it until the pause is lifted.

Contact

Questions about this policy, and requests about your data, go to the operator: the person who invited this household's owner. If that wasn't you, the owner knows who it is.