Privacy policy

Consent

Before a bank connection, a local account, or a contact note, you record a consent stamp on the record. The stamp says you agree to collection, processing, and storage for that record. You can withdraw it there. A withdrawn stamp stops a new bank connection and a new note. The stamp itself stays so the withdrawal is visible.

Bank connection

If you choose Connect a bank, Plaid Link lets you sign in at your bank. RoundAid does not receive your bank username or password. Plaid’s own policy applies to that sign-in: Plaid end user privacy policy.

RoundAid uses Plaid Transactions. After you connect, we receive the institution name and recent posted purchases: the name, date, and amount. We use those to show the purchases on your record and the spare change to the next dollar. We do not sell that information, and we do not use it for advertising.

The connection token stays on RoundAid’s server, tied to a cookie in your browser, for up to 30 days. Disconnect removes the connection at Plaid and deletes that token. The purchases you add to the record stay in the browser until you clear them or lock a local account.

Local account

Create account stores your name and the record on this device. The passkey is required to open it. When the passkey can produce an encryption secret, that secret is the key and is not stored. Otherwise the key stays in this browser and is used only after the passkey is confirmed. RoundAid’s server does not keep that account. Lock clears it from the page. The encrypted copy remains on the device until you remove the site’s data in the browser.

Contact form

If you send a note, we receive your name, email, the role you choose, the note, and any donation lines then on the record. We use that to read your request and reply. The note is emailed to RoundAid’s operator. It is not added to a marketing list.

Other data on the page

A nonprofit search sends the words you type to RoundAid, which asks ProPublica for matching 501(c)(3) names. We do not store the search.

A donation link opens Every.org. Every.org collects the gift. RoundAid does not hold the money.

The site chat answers from RoundAid’s own pages. The question is not saved as an account.

Cookies

The bank connection uses one cookie, roundaid_bank, so the server can find your connection. It is limited to this site, not readable by page scripts, and lasts up to 30 days. Disconnect clears it. We do not use advertising cookies.

Access, correction, and deletion

You can ask for the data RoundAid holds, ask for a correction, or ask for deletion. Use the form on this policy.

Access returns the consent stamp that matches the email, and the bank purchases stored for the connection in this browser. Deletion removes those consent stamps, disconnects that bank connection, and clears the local account on this device. A contact note is not kept as an account; RoundAid deletes or corrects the emailed copy and replies to you. If this browser has no matching stamp and no bank connection, RoundAid still completes the request and replies to the email you give.