How your data is handled
Plain language, no lawyer required.
Receipt photos are never stored
When you photograph a receipt, the image is uploaded over TLS, held in server memory for the length of that one request, and sent to the Anthropic API so Claude can read the total. It is not written to disk, not inserted into the database, and not placed in any object storage. When the request ends the bytes are gone. Only the fields you confirm — amount, date, merchant, category, your notes — are saved. If you want to keep the original image, keep it yourself.
What is stored
Your income entries, account balances, bills, budgets, expenses and goals, all tied to your account. That is the ledger you came here to build. Nothing about your spending is sold or shared, and there is no advertising in this product.
When your budget is sent to Claude
Three features send data to the Anthropic API, and only when you start them: reading a receipt you photographed, answering a question in Second Look, and building the plan for a goal. In the last two, the parts of your ledger needed to answer — figures, category names, recent expenses, the goal you asked about — go to Anthropic over TLS. Nothing is sent in the background, on a schedule, or while you are just looking at a page. Anthropic does not train models on this data. Claude can only read; it has no ability to change anything in your ledger, and every number it suggests is a button you press yourself.
Goal plans are saved, and encrypted like everything else
A goal plan is the one thing Claude writes that PAY/ATTN keeps. It is stored on the goal so it is still there when you come back, and it is encrypted at rest with the same key material as your notes and merchant names — because a plan describes your categories and amounts and is no less revealing than they are. Rebuilding a plan replaces the old one. Editing a goal's target or date deletes the plan outright, since it was written about numbers that no longer apply. Deleting the goal, or your account, deletes it with them.
There are no bank connections
PAY/ATTN never asks for bank credentials and has no integration that could read your accounts. There is no token to steal because there is no connection to make. Everything in your ledger is there because you typed it.
Who can see your data
Every query is scoped to your own account on the server, using the identity from your signed session — never an identifier sent by the browser. Underneath that, the database enforces the same boundary itself through row-level security policies, using a connection that has no power to bypass them. Two independent layers have to fail before anyone could see your ledger, and there is no shared or team view.
Taking your data with you, or deleting it
Setup → Your data has two buttons. One downloads everything we hold as a JSON file, yours to keep or move elsewhere. The other deletes your account: your entire ledger and your sign-in record, immediately and permanently. There is no soft delete, no hidden copy and no recovery window — if you want your data afterwards, export it first.
How long we keep things
Your ledger stays for as long as your account is open. Receipt images are never retained at all. A goal plan stays until you rebuild it, edit the goal, or delete either. The counters that limit how often the scanner, the assistant and goal planning can run are discarded after 90 days. Nothing is kept for advertising, because there is none.
About tax flags
When an expense belongs to a business bucket, PAY/ATTN records whether it looks like a deductible business cost and reminds you to keep the receipt. That is bookkeeping assistance, not tax advice. Your accountant decides what is actually deductible.
Product analytics
We track which pages get visited and which specific buttons get used, plus the device, browser and general (country-level) location that come attached to that automatically. We do not record what you click on generally, what you type, or the content of any page — only the small set of buttons we've explicitly chosen to measure, by name. No cookie or other identifier is stored on your device for this: each visit is anonymous and not linked to your account or to any other visit, before or after.