Privacy Policy

Because you have an account:

• Your email address and name.
• A password, stored only as a hash we cannot reverse — or, if you sign in with Google, a link to your Google account instead of a password.
• If you add a passkey: its public half, which can check your device's answer but can't sign in on its own, when you added it, and whether it syncs between your devices. The private half never leaves your device, and Face ID, Touch ID or your PIN never reach us.
• Whether your email address has been confirmed.
• Each time you sign in: when, and whether it was with a password, Google, a passkey or a two-step code. The same for a sign-in to your account that was refused. We keep these for 90 days, to protect your account, and then delete them. We do not record your IP address, device, browser or location with them.
• When your password, two-step sign-in, passkeys or sign-in methods change, so that a change you didn't make can be spotted.
• If you asked for an invitation: the address, name and note you sent, so we can answer you, and how you heard about Pitch In if you chose to say, so we know which ways of finding us work. It's counted, never shared.

How you found us:

When you create a household, we ask how you heard about Pitch In. Answering is optional. If you came from one of our own links that carries a short tag, like an ad or a post marked ?from=fb-ad-1, we note that tag too. Both are counted anonymously: they are stored on their own, with the day but not the time, and never with your name, email, account or household. It’s how we tell which ways of finding us work, without tracking pixels, analytics or any other tracker.

How Pitch In is used:

To see what’s worth improving, we count how often a few things are done across all of Pitch In each day: chores added, ticked off or claimed; grocery lines added and shopping trips finished; events, bills, Horizon items and vehicles added; bills marked paid; transactions typed in; and people invited. Each count is one number for the day. It is not stored with your name, email, account or household, or the time, and it never includes anything anyone typed.

For each household, we can also see which days it was used, how many of its people came in during the last week, and which parts of Pitch In it has started using, as a yes or no for each: chores, groceries, the calendar, bills, accounts, transactions, the budget, savings plans, the Horizon and vehicles. We can’t see what’s in any of them: not a chore’s name, a bill’s amount, or anything else anyone types. None of this uses cookies or scripts, and none of it goes to another company.

Because your household uses it:

• Everything anyone in the household types in — accounts and their balances, transactions, budgets, recurring bills, debts and credit lines, chores, who completed them and any time logged on them, events and their lists, and the grocery list.
• What each person likes and doesn't, and who a purchase, a paycheck or a bill was for, if someone in the household records it. It is shown only inside your household, and Pitch In never uses it for anything else.
• Who is in the household, their roles, and invitations sent.
• The household's name, currency and language, when something in it last changed, and the dates (not the times) on which something changed.

Only if your household connects a bank:

• You sign in to your bank on Plaid's screen, not ours. Your bank username and password go to Plaid and never reach us.
• What the bank then sends us, for the accounts you choose: each account's name, type, last four digits and balance, and its transactions from the day you connect — date, amount, description, and whether it's still pending. Not your full account or routing numbers.
• A key from Plaid that lets us fetch updates to those accounts. We store it encrypted, and it can only read — it can't move money.
• Who connected the bank and when, because the connection belongs to them: it's removed if they leave the household.

Only an owner or admin can connect a bank, signed in with a passkey at the time. Disconnect it at any time, from Accounts: we tell Plaid to stop sharing, and the transactions already brought in stay as your household’s record, like anything you typed. We end a bank connection ourselves when your household stops paying for it, or when nobody in it has used Pitch In for 60 days — then only after emailing its owners and admins and waiting 14 days for someone to sign in. Ending it never deletes what it brought in.

Only if your household pays for Connected:

• You pay on Stripe's checkout page, not ours. Your card number and security code go to Stripe and never reach us.
• Stripe keeps the name, email and billing address given at checkout, the address because sales tax depends on it. We can look these up in Stripe to answer a billing question.
• We keep: that your household subscribes, to which plan, monthly or yearly, whether it's paid up, when it renews or ends, and which member pays. In Stripe's records we can also see the card's brand and last four digits, and your invoices.

What we do not collect:

• Your bank login, or anything from a bank your household hasn't chosen to connect.
• Your full card number or its security code. Stripe holds those, and only if your household pays.
• Advertising identifiers, or tracking by any other company. There are no third-party scripts or analytics services on these pages, and we don't record which pages you look at or what you click.
• Your household's financial data is never sent to an AI service. No feature does this.

Run the product for you, and email you about it — invitations, password resets, address confirmation, and occasional notices about the service itself, which can include one reminder if a household you set up hasn’t been started yet. You can turn reminders off from the link in that email or from your account; the emails you need to use your account still come — and, if your household pays, billing: we email the renewal terms when you first subscribe, and Stripe emails receipts, failed-payment notices and, for yearly plans, a reminder before renewal.

If you join the tester group (it’s optional, from the Help shape Pitch In page), we keep that you joined, when, and the note you add about your household, and use your email to ask about features we’re trying and, now and then, whether you’d like a short call. Leave from the same page and we stop.

We do not sell personal information, share it for advertising, or use it to build a profile of you. We do not use your household’s data to train anything.

Operator access: running the platform means seeing accounts, email addresses, which households exist, the sign-in record above, and how each household is used as described under “How Pitch In is used”, and it means being able to delete them. It does not mean reading what is inside a household. The database enforces that separation, rather than us promising to be careful — a household’s financial data is only readable by a session belonging to one of its members.

These companies process data on our behalf, under their own terms, and this list is exhaustive:

• Vercel — Hosting and content delivery

  Runs the application and serves every page. Sees requests, IP addresses and anything in them.

• Neon — Database

  Stores everything in your household — accounts, transactions, budgets, bills, chores — plus your name and email address. Hosted in the United States.

• Resend — Email delivery

  Sends invitations, password resets and address confirmations. Sees the recipient address and the contents of those messages, which never include your household's financial data.

• Plaid — Bank connections, only if your household connects a bank

  You sign in to your bank through Plaid, which sends us the account and transaction details described above. What you give Plaid is covered by Plaid's End User Privacy Policy (plaid.com/legal). If nobody in your household connects a bank, Plaid is not involved.

• Stripe — Payments, only if your household pays for Connected

  Takes the payment on its own checkout page and keeps the card details, name, email and billing address, and calculates sales tax. What you give Stripe is also covered by Stripe's Privacy Policy (stripe.com/privacy). If your household doesn't pay for anything, Stripe is not involved.

• Cloudflare — The domain, and support email

  Answers for the pitchin.house domain, and passes on mail sent to our support address. It sees those messages as they go through, and keeps nothing from the product.

• Google — Sign-in if you choose it, and our support inbox

  If you sign in with Google, Google tells us your email address, name and profile picture, and knows you use this product. If you sign in with a password instead, Google is not involved in that. Mail you send to our support address is kept in our Google mailbox.

We will also disclose information where the law requires it. If that ever happens and we are permitted to tell you, we will.

Data is stored in the United States. We keep it while your account exists, because the product is a record of your household’s money — deleting last year’s transactions after a set period would break the thing you are using it for.

Server logs, which include IP addresses, are kept by our hosting provider for a short period and are not used for anything else. We do not store IP addresses in our own database.

Our database keeps a rolling backup of the last 7 days, so it can be restored after a fault. Something deleted is gone from the live database at once, and from the backups within 7 days.

If your household has paid for anything, records of those payments (the invoices, and which household and member they were for) are kept for as long as tax and accounting law requires, even after the rest is deleted.

Delete your account yourself from Your account, where it says which households go with it before you confirm. Or email hello@pitchin.house from the address on your account and we will delete it for you.

What deletion removes:

• Your account, your password or Google link, and your sessions.
• Your membership of every household.
• Any household where you were the only member, and everything in it — accounts, transactions, budgets, bills and chores.
• If your household pays for Connected, deleting it cancels the subscription immediately, and disconnects its bank first. Payment records are kept as described above.
• In a household others share, any bank you connected is disconnected.

A household with other people in it is kept: it is not only yours to delete. Ask the same address for a copy of your data and we will send it; an export feature is not built yet either.

Only an adult can create a household. A parent or guardian may invite someone aged 13 to 17 into theirs, and in doing so accepts these terms for them — we collect the same things for that account as for any other, and the adult who invited them can see it and can remove the account.

Pitch In is not for anyone under 13, and we do not knowingly create an account for one. If we learn that someone under 13 has an account, we will delete it and what it holds. If that changes, this section changes first.

Connections use HTTPS. Passwords are hashed. Each household’s data is separated at the database level rather than by application code remembering to filter it, and the application connects with a restricted database role that cannot bypass that separation. Two-step sign-in and passkeys are available to everyone, and connecting a bank needs a passkey, which a fake site can’t collect the way it can a password or a code. The keys that let us read a connected bank are encrypted before they are stored.

What we do not have yet, said plainly because its absence is the honest state of a product this new: independent security certification. If there is a breach affecting your data, we will tell you by email and comply with the notification laws of Michigan, United States and your own state.

Two that last, and both are there to sign you in. One keeps you signed in. The other is set only if you turn on two-step verification and tick “don’t ask again on this device”, and it is what remembers that for 60 days. While you sign in or add a passkey, a third lasts five minutes, to match your device’s answer to the question we asked it.

None is used to track you. There are no advertising cookies and no analytics cookies — nothing on this site measures what you look at — which is why there is no cookie banner. Your choice of light or dark mode, and whether amounts are blurred, are kept by your browser rather than by us and never reach our servers. So is a link’s tag, if you arrived from one of ours: your browser keeps it for up to 30 days and sends it only if you create a household, where it is counted as above.

When this policy changes in substance, the version number above changes, and the next time you open Pitch In it tells you so and links you here. We tell you in the product rather than by email on purpose: a message can land in a spam folder and never be seen, whereas a notice on the page is one you actually get. David Elliott is the controller of this data. Write to hello@pitchin.house with any question about it, including a request to see, correct or remove what we hold. See also the terms of service.