How we look after your household
A household’s money, its chores and the people in it are private. Here is what keeps them that way, without the jargon.
Every household is walled off by the database itself
Your household’s rows can only be read by someone in your household. That rule lives in the database, not only in our code, so even a mistake in a page can’t show one family another’s numbers.
Inside the house, money is need-to-know
Whoever runs the household decides what each person sees: everything, only the accounts shared with them, or no money at all. A teenager or a babysitter can tick off chores without seeing a balance. The database enforces that too.
We can't see inside your household
As the people running Pitch In, we can see that a household exists, who owns it and when it was last used. We can’t read its balances, transactions, bills or chores, and there is no back door for support to do so.
Signing in
Sign in with a password or with Google, and turn on two-step verification with an authenticator app for a second lock. We keep a record of sign-ins for 90 days, so a sign-in you didn’t make can be spotted, and we never record your IP address, device or location with it.
Encrypted on the way and at rest
Everything travels over an encrypted connection, and the database that holds it is encrypted where it is stored.
Nothing sold, nothing shared
No ads, no analytics trackers, no selling or sharing your data, and nothing sent to an AI. The few companies that help us run Pitch In are all named in the privacy policy, with what each one does.
Connecting a bank
Optional, and only for an owner or admin with two-step sign-in on. You sign in to your bank on Plaid’s screen, so your bank password never reaches us. What we get is a key that can only read, never move money, and we store it encrypted. Disconnect any time from Accounts, and we tell Plaid to stop sharing.
Found something that looks wrong? Tell us at hello@pitchin.house. We’ll take it seriously and tell you what we did about it.