Privacy Policy

Last updated: June 27, 2026

Torv is operated by Torv LLC (“Torv,” “we,” “us”), the controller responsible for the personal information described in this policy.

1. What We Collect

Torv collects only what is needed to deliver the service:

• Account email and authentication credentials
• Tax profile information you enter (filing status, state, deductions)
• Categories, rules, and contribution goals you create
• Financial-institution data you authorize us to access through our aggregation provider: account balances and metadata, transactions, investment holdings and activity, and liability information

2. How We Use It

To generate your financial statements, tax projections, retirement analyses, and the other features of the service. That is all.

We do not sell your data. We do not share it with third parties for marketing, advertising, or any purpose unrelated to delivering the service to you.

3. Service Providers

• Finicity (a Mastercard company) and MX securely connect your financial accounts. You authenticate in their secure window; your bank credentials are never stored by Torv. Their terms and privacy notices are presented when you connect an account.
• Infrastructure providers in the United States host our application, database, and email. They process your data only as needed to operate the service and are bound by confidentiality and security obligations.
• Logo matching: to show merchant logos, we query a logo provider (Brandfetch) with a normalized merchant name to find a candidate logo, then send that name, an approximate spending category (e.g. "Groceries"), and the candidate logo image to an AI provider to verify the match. We do not include your account balances, transaction amounts, dates, account numbers, raw bank descriptors, or other personal identifying information, and the AI provider does not use this data to train its models.
• Paystub format reading (optional): when you import a paystub whose layout we can't recognize automatically, we ask for your permission before doing anything. Only if you approve it — each time, after reviewing exactly what would be sent — do we send a de-identified outline of the paystub to an AI provider (Anthropic) to learn its layout. That outline is structural labels and cell positions only: every dollar amount is replaced with a placeholder, and names, Social Security numbers, addresses, and account numbers are removed before anything leaves your device. We show you the exact content first and let you remove any remaining label by tapping it. Your actual figures are read and reconciled locally in your browser and are never sent. The provider returns only the layout structure and does not use this data to train its models.

4. Security

We encrypt data in transit (TLS). Sensitive personal information — including your email, account names, and authentication secrets — is additionally encrypted at the application layer before it is stored, and our backups are encrypted. No system is perfectly secure; use a strong, unique password and enable multi-factor authentication.

5. Your Rights

You may at any time:

• Export your data
• Delete individual records or your entire account
• Disconnect any linked financial institution
• Reach us through our contact form to exercise any of these rights, including the rights granted by the California Consumer Privacy Act

When you delete your account, your data is immediately and permanently purged from our live systems. Encrypted backups kept solely for disaster recovery may retain residual copies until they age out of our backup cycle (at most ~100 days); these backups are never used to restore deleted accounts.

6. Connected Financial Institution Data

Data retrieved from your financial institutions through Torv is for personal informational and planning purposes and does not represent the official record of your accounts. Refer to your institution for official records.

You may disconnect any institution from inside Torv at any time. You may also revoke access through your institution's own settings. Torv cannot move money or transact on your behalf.

7. GLBA Notice

To the extent the Gramm-Leach-Bliley Act applies, Torv collects nonpublic personal financial information from your connected institutions as described above. We do not disclose it to nonaffiliated third parties except as necessary to deliver the service, as permitted by law, or with your consent.

8. Changes

We may update this policy. Material changes will be communicated by email or in-app notification before they take effect.

9. Contact

Privacy questions or requests: contact form.