Privacy Policy

Last updated: September 30, 2026

Torv is operated by Torv LLC (“Torv,” “we,” “us”), the controller responsible for the personal information described in this policy.

1. What We Collect

Torv collects only what is needed to deliver the service:

• Account email and authentication credentials
• Sign-in details for each device you sign in on: its IP address, device and browser type, approximate location (city and region, from the IP address), and a random identifier kept in a cookie on that device. You can see them under Account → Where you're signed in, and they're deleted when that sign-in ends
• Security records: the IP address and browser type recorded with sign-ins, password changes and changes you make to your records, erased after 30 days; and the IP address and browser type from when you accepted our Terms and this policy, kept while you have an account
• Tax profile information you enter (filing status, state, deductions)
• Household details you enter for planning: optional names or initials for you and a spouse, and birth years for your household
• If you sign up to keep a plan or tax estimate you made on our free tools, what you entered in them: it's held, encrypted, with your sign-up until you verify your email, then moved into your account. If you don't verify within 24 hours, it's deleted
• Categories, rules, and contribution goals you create
• Financial-institution data you authorize us to access through our aggregation provider: account balances and metadata, transactions, investment holdings and activity, and liability information

2. How We Use It

To generate your financial statements, tax projections, retirement analyses, and the other features of the service. That is all.

We do not sell your data. We do not share it with third parties for marketing, advertising, or any purpose unrelated to delivering the service to you.

3. Service Providers

• Finicity (a Mastercard company) and MX securely connect your financial accounts. You authenticate in their secure window; your bank credentials are never stored by Torv. Their terms and privacy notices are presented when you connect an account.
• Infrastructure providers in the United States host our application, database, and email. They process your data only as needed to operate the service and are bound by confidentiality and security obligations.
• Sentry receives technical error reports when something in Torv fails, so we can diagnose and fix it. Reports contain the error and where in the code it happened — not your financial data — and identify you only by your pseudonymous account id.
• Analytics: we use no third-party analytics service and no advertising network. Torv itself records which pages you open while signed in, against your pseudonymous account id, so we can see which parts of the product are used; those records stay in our own database and are read as counts. Separately, because Cloudflare provides the delivery and security layer that every request to Torv passes through, it necessarily processes request metadata — including the address requested and your IP address — in order to route and protect the service.
• Logo matching: to show merchant logos, we query a logo provider (Brandfetch) with a normalized merchant name to find a candidate logo, then send that name, an approximate spending category (e.g. "Groceries"), and the candidate logo image to an AI provider to verify the match. We do not include your account balances, transaction amounts, dates, account numbers, raw bank descriptors, or other personal identifying information, and the AI provider does not use this data to train its models.
• Paystub format reading (optional): when you import a paystub whose layout we can't recognize automatically, we ask for your permission before doing anything. Only if you approve it — each time, after reviewing exactly what would be sent — do we send a de-identified outline of the paystub to an AI provider (Anthropic) to learn its layout. That outline is structural labels and cell positions only: every dollar amount is replaced with a placeholder, and names, Social Security numbers, addresses, and account numbers are removed before anything leaves your device. We show you the exact content first and let you remove any remaining label by tapping it. Your actual figures are read and reconciled locally in your browser. If that outline is not enough to read the layout, we ask a second time, separately, before sending the same de-identified outline with its dollar amounts included — still with no name, Social Security number, address, or account number — and only if you approve that too. The provider returns only the layout structure and does not use this data to train its models.

4. Security

We encrypt data in transit (TLS). Sensitive personal information — including your email, account names, and authentication secrets — is additionally encrypted at the application layer before it is stored, and our backups are encrypted. No system is perfectly secure; use a strong, unique password and enable multi-factor authentication.

5. Your Rights

You may at any time:

• Export your data
• Delete individual records or your entire account
• Disconnect any linked financial institution
• Reach us through our contact form to exercise any of these rights, including the rights granted by the California Consumer Privacy Act

To delete your account, sign in and open Account (from the menu under your initial, top right), then Danger Zone, then Delete account. If you can't sign in, ask through our contact form and we'll delete it for you.

When you delete your account, your data is immediately and permanently purged from our live systems. Encrypted backups kept solely for disaster recovery may retain residual copies until they age out of our backup cycle (at most ~100 days); these backups are never used to restore deleted accounts.

6. Connected Financial Institution Data

Data retrieved from your financial institutions through Torv is for personal informational and planning purposes and does not represent the official record of your accounts. Refer to your institution for official records.

You may disconnect any institution from inside Torv at any time. You may also revoke access through your institution's own settings. Torv cannot move money or transact on your behalf.

7. GLBA Notice

To the extent the Gramm-Leach-Bliley Act applies, Torv collects nonpublic personal financial information from your connected institutions as described above. We do not disclose it to nonaffiliated third parties except as necessary to deliver the service, as permitted by law, or with your consent.

8. Changes

We may update this policy. Material changes will be communicated by email or in-app notification before they take effect.

9. Contact

Privacy questions or requests: contact form.