What we store, where, and why.

Plain summary

• Your money data lives on your device, in your browser's local storage. Not on our server.
• Your Exodus account (name, email) lives on our server so you can sign in from another device.
• If you connect Monzo, transactions live in your Google Sheet (in your Google Drive). We read it on demand. We don't copy it.
• We don't track you. No analytics, no advertising, no third-party scripts, no ML training on your data.

What we store on our server

The minimum needed to give you an account that works across devices:

• A Person record with: a unique ID, your name (whatever you typed at sign-up), your email (only if you verified one), and which sign-in methods you've used (Google / magic-link / local). Nothing else.
• Active session tokens so your browser stays signed in. Tokens expire on inactivity (default 30 days).

That's it. We don't store any of your transactions, vitals, allowance numbers, quest progress, settings, terrain tuning, or Drift's state. Those all live on your device.

What lives on your device

Stored in your browser's IndexedDB / localStorage on the device you're using:

• Settings (pay cycle, income, fixed outgoings, theme)
• All transactions you've logged manually or imported
• Vitals snapshots, phase history, quest progress, rewards, streaks
• Drift the jellyfish's evolution state
• Your Google OAuth token (cached so you don't re-auth every visit), if you connected Google

Resetting Ebb's data (Settings → Danger → Reset everything) clears all of this. Uninstalling Ebb / clearing your browser's site data does the same.

What we read from Google (if you connect)

If you choose to connect Monzo via Google Sheets export (it's optional — you can use Ebb fully in manual mode without ever connecting):

• Ebb requests read-only access to the specific Google Sheet you pick. Not your whole Drive — just that one sheet.
• The transactions are read on demand, parsed in your browser, and shown to you. They're not copied to our server.
• You can disconnect Google at any time from Settings → Connected Sources. Disconnecting revokes the token immediately.

Email

If you sign in with magic-link, the email containing the sign-in link goes through Resend (resend.com), our email delivery provider. Resend sees: your email address, the subject ("Sign in to Ebb"), and the sign-in link itself. Resend's privacy policy: resend.com/legal/privacy-policy.

We never email you anything else without asking first. No marketing. No "we miss you" emails. No newsletter.

What we never collect

• No analytics. No Google Analytics, no Plausible, no Fathom, no Mixpanel, nothing.
• No advertising. No ad networks, no remarketing pixels, no tracking cookies.
• No third-party JavaScript. The only external scripts are Google's official ones for sign-in + Sheets API (and only if you trigger them).
• No ML training. Your data is not used to train any model.
• No selling, no sharing. Ever. Even with partners. Even anonymised.

Cookies

One cookie: exodus_session. Signed, HTTP-only, set when you sign in, expires on inactivity. That's it.

Your rights

• Delete your account · email director@orchestros.app with your email address and we'll remove your Person record + revoke all sessions, typically within 7 days.
• Export your data · Settings → Backup → Export JSON gives you everything Ebb knows about you locally. The server-side Person record is name + email + sign-in methods (we can email you a copy on request).
• Stop receiving the magic-link emails · don't request them. We only send sign-in links, never anything unprompted.
• Disconnect Google · Settings → Connected Sources → Disconnect. Or revoke directly at myaccount.google.com/permissions.

Changes to this notice

If we change this notice in a way that affects you, we'll tell you in-app at the top of the home screen until you acknowledge it. Changes that don't affect you (rewording for clarity, adding plain-language summaries) ship without notice.