BackUp

Privacy Policy

Effective October 27, 2026

BackUp helps you plan bills around your paychecks, understand financial activity and follow your goals. This policy covers getbackupnow.com and the BackUp app. Contact support@getbackupnow.com with privacy questions or requests. Some connections and automation features remain in development or depend on provider availability.

Information we collect

How we use information

We use information to operate and secure your account, build and reconcile your bill plan, show checking insights, track goals, provide requested AI features and updates, respond to support and prevent abuse. Forecasts depend on available information and may be incomplete.

Learning from your bill choices

We save your confirmations, dismissals, bill corrections and bills added from transactions to improve your own account's bill detection. This includes the evidence shown when you answer, your choice and the relevant account and transaction references. Forgetting a learned rule adds a reset record; it does not delete a bill from your plan.

Sharing business-merchant feedback across BackUp accounts is optional and off by default. If you enable it in Settings, eligible business merchant names and bill/not-bill choices may improve detection for other users. Shared learning excludes payment amounts, transaction histories, personal payment-recipient names and catch-all payment platforms. A merchant needs at least five distinct opted-in voters supporting a label and at least 80% agreement. We may use de-identified scoring features from eligible opted-in feedback to evaluate detector accuracy; we do not automatically change scoring thresholds or train a new model from your answer.

You can turn sharing off in Settings. Your votes then stop contributing to future shared learning. Feedback remains subject to the account retention, deletion and restricted-record rules below. Account deletion requests also exclude the account's votes while the request is active. No cross-account learning dataset is sent to an external AI provider.

Google account data: access, use and storage

When you choose Google sign-in, Google and our authentication provider, Supabase, provide or process your Google account identifier, verified email address, name and basic profile information, which may include a profile-picture URL. BackUp uses this information to authenticate you, identify your account and associate you with your own saved workspace. We do not request access to your inbox, contacts, calendar or Drive files through Google sign-in.

Supabase stores your linked Google identity and authentication profile. BackUp stores the account identifier, email address and profile details needed for your workspace in its database. Authentication and session records keep you signed in; HTTPS protects data in transit and access controls restrict account records to authorized access. We retain account and identity information while needed to provide your account and for the limited security, legal and recovery purposes described below.

We use Google account data for account access and related user-facing features, not advertising, sale, creditworthiness decisions or training general-purpose AI models. Google sign-in information is processed by Google, Supabase and our hosting provider, Cloudflare, as necessary to deliver and secure login. Your email or profile is not sent to Gemini merely because you sign in. Supported AI features separately process the limited information described in the AI processing section.

You can remove BackUp from your Google account connections to revoke future Google access. Revoking access does not automatically delete your saved BackUp account or financial plan. Use the account-deletion request in Settings or contact support@getbackupnow.com to request deletion of your account and linked Google identity. Requests are verified and reviewed; necessary restricted records and encrypted recovery copies are handled under the retention rules below.

Bill emails and documents

You can upload supported bill documents or paste bill or statement text into the app for review. These are documents you choose to provide; Google sign-in does not retrieve them from your Google account.

You can also forward bill emails to a personal BackUp forwarding address. Forwarded messages are read once to extract bill details; message bodies and attachments are not stored, and a limited excerpt may be sent to Google Gemini when rules cannot read a message. Extracted bill facts and limited message metadata are saved for your review. Forwarded bills update your plan only after you approve them. You can turn off a forwarding address in the app.

Pasted document text is processed temporarily to extract bill information rather than saved as a document copy. BackUp stores relevant metadata and extracted bill facts, matches and signals. Previously stored document and connection records remain subject to the retention and deletion controls below.

When supported AI extraction needs help interpreting a pasted document, a limited excerpt may be sent to Google Gemini. BackUp attempts to remove sensitive patterns and unrelated text first; this filtering cannot guarantee removal of every personal detail.

BackUp's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We use that information for user-facing features you request, not advertising, sale to data brokers, creditworthiness decisions or training general-purpose AI models. Human access is limited to circumstances permitted by that policy, such as explicit support consent, security investigations or legal obligations.

AI processing

AI summaries, recommendations and goal guidance may send selected financial context to Google Gemini, including relevant amounts, merchant information, goals, progress or the limited document excerpts described above. Processing is not confined to your device. AI output can be inaccurate; review it before making financial decisions. BackUp does not use Google user data to train general-purpose AI models.

Providers and sharing

If you create or join a shared household plan, your partner can see your display name and the bills, proposed splits and agreements you add to that plan. Private bank accounts, balances, transactions and income are not shared by joining. Each person uses their own login and can end sharing in the app. Shared-plan membership does not grant bank ownership or authority to move another person's money.

We use Cloudflare for hosting and security, Supabase for authentication and PostgreSQL storage, and Google Gemini for supported AI processing. When you connect a financial provider, services such as Plaid or an authorized banking integration process information needed for that connection under their own agreements. Describing an integration does not mean it is enabled for every account.

We share information as needed to provide requested features, handle support and security, comply with applicable law or protect rights. We do not sell personal information or use connected financial or Google data for targeted advertising. Any transfer following a change of ownership remains subject to applicable law and this policy.

Cookies, security and retention

The app uses necessary authentication and security cookies, plus one session cookie that remembers you have already seen the opening animation. The public homepage's examples run locally in your browser; we have not added advertising trackers or analytics scripts. Hosting request processing still occurs.

We use HTTPS, access controls and encrypted provider connection tokens. No service can guarantee complete security. We retain information while needed for your account and requested features, issue resolution and legitimate security, audit or legal requirements. Backup copies may remain until they expire under the applicable provider's retention process.

Accounts without verified activity for 12 months are reviewed for retirement. Before deleting an abandoned account, we require a delivered warning and at least 30 full days to return. Returning cancels that warning. Unused accounts can be retired automatically after these checks; accounts with stored plans, provider connections or financial records require separate review. Active financial activity and legal or security retention requirements are reviewed separately. You can request account deletion in the app or contact support; requests are reviewed before erasure.

For eligible planning accounts, reviewed deletion removes imported financial activity, saved bills, plans, goals and derived email/AI records after provider access is revoked and the login identity is removed. Unresolved transfers, provider failures or retention holds stop deletion. We retain minimal retirement and revocation references to prevent deleted accounts from returning during recovery. Encrypted recovery snapshots normally expire after seven days; failures or incidents require separate review. Deleting BackUp does not close your bank account.

Your choices

Ending sharing revokes access to the shared plan for both members. Shared-record deletion requests need individual review to protect both members' rights; the personal-account deletion tool does not automatically erase the household. Contact support to request removal or correction of shared records. Holds and their scope must be reviewed rather than treated as permanent retention.

You can correct supported account and plan details and disconnect supported connections in the app. Disconnecting stops future access but does not automatically remove saved bills or all derived records. Where available, use the email-data deletion option to remove derived email records; bills adopted into your plan may remain.

You can revoke Google access in your Google account permissions. Contact support@getbackupnow.com to request access, correction, export or account deletion, or exercise rights available where you live. We may verify ownership before acting. Records needed for legal or security purposes may be retained with restricted use.

We aim to acknowledge privacy requests within seven calendar days and provide a substantive response within 30 calendar days. If a lawful extension is necessary, we will explain the reason and revised deadline before the original deadline. If we cannot fulfill a request, we will explain the basis. To appeal a decision, email support with the subject "Privacy appeal"; we aim to respond within 30 calendar days. Any shorter applicable legal deadline takes priority.

We review retention at least quarterly and after material changes. Unnecessary customer information is subject to a two-year disposal baseline measured from its last use to serve you, with specific legal or legitimate business exceptions reviewed separately. Our abandoned-account process starts earlier, after 12 months without verified activity. A retention hold or failed provider operation requires review rather than indefinite retention by default.

Location, age and changes

BackUp and its providers may process information in the United States and other locations. The service is intended for adults, not children under 18. Contact us if a child has provided personal information.

We will update this page and its effective date, communicate material changes as appropriate, and request additional consent where required before using Google data for a new purpose.