Privacy Policy
Last updated: September 2, 2026
Effective Date: March 25, 2026
WealthMutant ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal and financial information when you use WealthMutant ("the Service"). By using the Service, you agree to the practices described in this policy.
1. Data We Collect
Account Information
When you create an account, we collect:
- Email address — used for authentication, transactional emails, and account recovery
- Name (optional) — used for personalization within the app
- Password — stored as a salted cryptographic hash; we never store plaintext passwords
Financial Data
All financial data you enter is yours alone. We collect:
- Transaction records — payee names, amounts, dates, categories you enter manually
- Bank accounts and asset accounts — names, balances, and types you define
- Budgets — budget categories, limits, and rollover settings
- Goals and targets — emergency fund targets, debt payoff amounts, investment milestones
- Net worth snapshots — computed from your accounts at the time of calculation
WealthMutant does not connect to your bank, does not use Plaid or any bank aggregator, and does not import transactions automatically. All data is entered manually by you.
Usage Analytics
We use PostHog to understand how the product is used. When you are signed in, these events are associated with your account so we can tell one person's session from another's. They include:
- Pages visited and features used
- Session duration and frequency
- Device type and browser (no fingerprinting)
We never send your financial figures to our analytics provider. No balance, transaction amount, net worth value, payee name or account name is included in an analytics event. This is a rule we hold ourselves to in code, not only in this policy.
Two things are switched off deliberately:
- Session recording — we do not record your screen, ever
- Automatic click capture — PostHog can capture the text of anything you click, which on a finance dashboard would be your own numbers. We disabled it in August 2026 and send only the events we have written and reviewed ourselves
Error Monitoring
We use Sentry to catch crashes and bugs. An error report can include the page you were on, your browser, and a stack trace. Financial values are stripped before the report leaves your browser or our server. Sentry is not used to track what you do.
2. Third-Party Services
We use the following services to operate WealthMutant. Each is contractually bound to protect your data:
| Service | Purpose | Data Shared |
|---|---|---|
| Supabase | Database, authentication, and file storage | All app data stored encrypted in their infrastructure (AWS US East) |
| Razorpay | Payment processing | Name, email, purchase amount at checkout only. PCI DSS SAQ A compliant — we never see your card number |
| Resend | Transactional email delivery | Email address and message content (receipts, OTPs, account alerts) |
| Loops.so | Marketing email | Email address, opt-in status. Unsubscribe at any time |
| Vercel | Hosting and CDN | Server access logs (IP, timestamp, URL) — retained 30 days |
| PostHog | Product analytics | Which pages and features you use, your account ID, device and browser. Never financial values |
| Sentry | Error and crash reporting | Error details, page URL, browser. Financial values are stripped before sending |
| Anthropic | Powers the AI assistant | Only when you use it — see below |
| Upstash | Rate limiting (abuse and brute-force protection) | Your IP address and email, held briefly against a counter |
| Optional sign-in | Only if you choose "Sign in with Google". Your Google password is never shared with us |
We do not sell your data to any third party. We do not share financial data with any service beyond what is required to operate the platform.
The AI Assistant
The AI assistant is the one feature that sends your financial data outside our own infrastructure, and it only does so when you use it. When you ask it a question, it can look up your account balances, credit-card payables, remaining loan principal, transaction summaries and monthly totals, and it sends what it looked up to Anthropic in order to answer you.
Two things bound this. It reads only your own data — every lookup runs under the same row-level security as the rest of the app and is additionally filtered to your user ID, so the assistant cannot widen its own scope. And it is read-only: it can look at your figures, never change them.
If you never open the assistant, none of your financial data is sent to Anthropic. Anthropic does not train models on data submitted through their API.
3. How We Use Your Data
We use your data exclusively to:
- Provide the Service — store, compute, and display your financial data within the app
- Send transactional communications — payment receipts, password reset emails, trial expiry notices, and account alerts
- Improve the product — study which features are used, and fix the errors we see reported
- Prevent fraud and abuse — detect account sharing, unauthorized access, and policy violations
- Comply with legal obligations — respond to lawful requests from Indian regulatory authorities when legally required
4. Data Security
Your security is built into the architecture:
- Encryption at rest — All data is encrypted at rest by Supabase using AES-256
- Encryption in transit — All connections use TLS 1.2 or higher; HTTP is redirected to HTTPS
- Row-Level Security (RLS) — Database policies ensure users can only access their own data; no shared data access is possible at the database layer
- No staff access — WealthMutant staff do not have access to your financial data in normal operations. Support requests are handled without viewing transaction-level data
- Authentication — Supabase Auth with bcrypt password hashing. OAuth (Google) does not expose your password to us
- Payment security — Razorpay handles all card processing with 3D Secure / OTP authentication. We store only a Razorpay payment ID — never card details
5. Data Retention
Your financial data stays for as long as your account does: you entered it, and it is yours until you change it, delete it, or delete the account. The operational records the Service produces around it run on fixed clocks, enforced by scheduled jobs rather than good intentions:
| Record | Kept for |
|---|---|
| AI assistant conversations | 90 days |
| Generated insights | 180 days |
| The log of emails we sent you (delivery records, not your inbox) | 180 days |
| In-app notifications | 90 days. Milestone notifications (a completed Mutation Path level, for example) stay until you delete your account |
| Internal events that trigger alerts, once handled | 90 days |
| Payment records | 7 years, as Indian tax law requires |
When you delete your account, everything above is removed with it inside the 60-day window described under Account Deletion. Two records survive on purpose:
- Payment records. A minimal archive (payment ID, order ID, amount, currency, and dates) is kept for the 7-year tax period. It contains no transactions, budgets, or balances.
- A deletion record. We keep your email address and the dates your account was deactivated and deleted, indefinitely. This is our proof that we deleted your data when you asked. It is the only personal information that outlives your account, and it is never used to contact you.
6. Your Rights
You have the following rights regarding your data:
Access and Correction
You can view and edit all your data directly within the app at any time. Account information can be updated in Settings.
Data Export (Portability)
You can export your transactions, budgets, and account history as a CSV file from the app. This export contains all your financial data in a portable format.
Account Deletion
You can deactivate your account from Settings → Account → Deactivate. Upon deactivation:
- Your account is immediately locked
- All personal and financial data is permanently deleted after 60 days — including the login identity itself, so your email address is no longer registered with us and can be used to start over with a fresh account
- After the 60-day window, deletion is irreversible and we cannot recover your data
- The two archival records described in Data Retention (the 7-year payment archive and the deletion record) are kept; anonymized, aggregate data (e.g. total number of users) may also be retained
To request immediate deletion, email privacy@wealthmutant.com with the subject line "Immediate Data Deletion Request."
Opt-Out of Marketing Email
All marketing emails include an unsubscribe link. You can also email privacy@wealthmutant.com to opt out. Transactional emails (receipts, security alerts) cannot be disabled while your account is active.
7. Cookies
We use the following cookies:
| Cookie | Purpose | Type |
|---|---|---|
sb-…-auth-token | Keeps you signed in | httpOnly, Secure, SameSite=Lax |
wm_pricing_region | Shows prices in your region's currency | Readable by the page, SameSite=Lax, expires after 1 day |
wm_guest_order | Links your payment to your new account during guest checkout | httpOnly, Secure, expires with the order |
affiliate_session | Signs affiliate partners into their dashboard | httpOnly, Secure, SameSite=Lax |
ph_…_posthog | PostHog's own identifier for usage analytics | Readable by the page |
wm_pricing_region is readable by the page because the page needs it to show the right currency.
It holds a two-letter country code and nothing else. It is not used to decide what you are charged:
that is resolved on our server from the request itself, so changing this cookie cannot change your
price.
We do not use third-party advertising cookies or tracking pixels.
8. Children
WealthMutant is not intended for use by individuals under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact privacy@wealthmutant.com and we will delete it immediately.
9. International Users (GDPR and CCPA)
GDPR (European Users)
If you are located in the European Economic Area (EEA), you have rights under the General Data Protection Regulation including: the right to access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and the right to object. Our legal basis for processing your data is performance of a contract (providing the Service you signed up for).
To exercise GDPR rights, email privacy@wealthmutant.com. We will respond within 30 days.
CCPA (California Users)
California residents have the right to know what personal information we collect, the right to delete personal information, and the right to opt-out of the sale of personal information. We do not sell personal information. To submit a CCPA request, email privacy@wealthmutant.com.
10. Changes to This Policy
We will notify you of material changes to this Privacy Policy via email at least 30 days before the changes take effect. The updated date will be reflected at the top of this document. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.
11. Contact
For privacy-related questions, data requests, or concerns:
- Email: privacy@wealthmutant.com
- Response time: Within 5 business days
WealthMutant operates under the laws of India. Data processing is subject to the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (India).