Forward — Privacy Policy

Effective date: September 4, 2026

Forward ("Forward," "we," "us") is a personal/household budgeting application operated by Stephen Mayer. This policy explains what information Forward collects, how it's used, and the choices you have. It applies to the Forward web app (PWA), iOS app, and Android app.

If you have questions about this policy, contact support@forwardbudget.app.

When you create a Forward account, we collect the email address and authentication identifier associated with your account (via Firebase Identity Platform). We do not receive or store your password — Firebase handles authentication directly.

Information you enter directly: household name, timezone, budget categories, spending plans, payees, and the manual transactions and account balances you add or edit.

If you connect a bank or financial account, Forward uses Plaid Inc. (https://plaid.com/legal/) to retrieve, with your authorization: account and routing details needed to identify the linked account, account balances, and transaction history (dates, amounts, merchant/description, and Plaid's category guesses). Forward does not receive or store your bank login credentials — those are entered directly into Plaid's interface and never pass through Forward's servers. The access token Plaid issues to Forward for each linked account is encrypted (Google Cloud KMS envelope encryption) and is never stored or logged in plain text.

Plaid's own handling of your data is governed by Plaid's End User Privacy Policy (https://plaid.com/legal/#end-user-privacy-policy), which we encourage you to review.

If you import transactions via CSV instead of (or alongside) connecting a bank account, we store the transaction data contained in the file you upload (dates, amounts, descriptions, and any category/payee information included).

If you upload a receipt, invoice or order document, we store the original file encrypted and keep it for up to 7 years from the day you upload it, then delete it automatically. Everyone in your household who can see the transaction it belongs to can see the receipt and the items we read from it. Anyone in your household who can add receipts (owners and members) can delete the original file, the details we read from it, or both, at any time. Deleting a receipt never changes the transaction or your budget.

To read a receipt, we send photos and scanned pages to Google Cloud Vision, in the United States, which returns the printed text; a PDF that already contains its text is read without it. If our usual reader still cannot read a receipt, we send its image and text to Google's Gemini AI service (Vertex AI, processed on Google's global infrastructure like the AI categorization requests described below, not only in the region where we store your data) to read the main details, which you confirm before anything is linked. We use receipt contents only to explain and categorize your household's transactions. We do not use them for advertising or to train models, and we keep them out of our logs. If your household is deleted, its receipts are deleted with it.

If you set up Email receipts, you get a private forwarding address and choose which emails to forward to it. Those emails arrive through Cloudflare Email Routing, which passes each one to us. We read only receipt, order, shipping and refund emails signed by the business that sent them; anything else is discarded as soon as it is checked. We never keep the email itself: we keep only the details we read from a receipt (the store, its items and prices, its shipments and refunds). When we have no reader for a store, Google's Gemini AI reads the receipt, as described above for uploaded receipts, and you confirm it before anything is linked. Until a receipt is linked to a transaction only you can see it; once linked, everyone in your household who can see that transaction can see it. If you turn forwarding off, receipt details that aren't linked to a transaction are deleted within 30 days.

We collect standard operational logs (timestamps, request metadata, error reports) needed to run and secure the service. These logs are used only to operate, secure, and debug the service and are not used for advertising.

We use the information above to:

What is sent: the payee description, the amount, the date, and the names of your own budget's active spending categories. What is not sent: your name, account numbers, bank login details, or any other household's data. The AI's suggestion is never applied automatically — every suggestion appears in Notifications for you to approve, edit, or dismiss before it affects your budget. Most transactions are categorized without any AI involvement at all, from your own prior approvals.

Google's handling of data sent to Vertex AI is governed by the Google Cloud Platform terms referenced in the Service providers section below; Google does not use Vertex AI input to train its general-purpose models.

You can connect an AI assistant, such as Claude, to your Forward account. When you connect it, you choose which of your budgets it can see. It can only read them: it can't change anything or move money, and it never sees your bank sign-in or your account numbers.

Forward sends an assistant data only when it asks, and only from the budgets you chose, with one exception: your household's payee names are shared by all its budgets, so the payee names it sees can include one used only in a budget you didn't choose. You can disconnect it at any time in Connected apps, in the account menu, and its next request is refused. Each person in a household connects and disconnects only their own assistants.

Forward runs on infrastructure operated by:

Each of these providers processes data only as necessary to provide their service to Forward and is bound by their own data-protection terms with us.

We retain your account and financial data for as long as your account is active.

To delete your data, your household's owner can request it in the app: open the account menu, choose Household, then Delete household…. Deleting a household deletes all of its data, for everyone in it. You can also email support@forwardbudget.app and we will help you make the request.

We delete the household's data from production systems 30 days after a verified request, except where retention is required by law; until then, its owner can cancel the request. Residual copies may persist in encrypted database backups for up to 35 additional days before those backups age out.

Forward's budget ledger is append-only by design: day to day, corrections are recorded as new entries rather than edits. Deleting a household is the exception — it removes its underlying records themselves, on the timeline above, not merely from view.

Forward is not directed to children under 13 (or the relevant age of consent in your jurisdiction), and we do not knowingly collect information from them.

We may update this policy as Forward's features change. We'll update the "Last updated" date above and, for material changes (such as adding AI processing of your data), provide additional notice — such as an in-app banner — before the change takes effect.

Questions about this policy or your data: support@forwardbudget.app.