1. Who we are and what this policy covers
BigBooks ("BigBooks", "we", "us") operates the bigbooks.app website, the BigBooks account and sign-in service, the BigBooks API, and the AI features built on them (together, the "Service"). Independent applications that you authorize to use your BigBooks account ("Connected Apps") are built by third parties and are governed by their own privacy policies in addition to this one.
This policy describes how we handle information about you when you create a BigBooks account, connect financial institutions, upload files, use AI features, register an OAuth client as a developer, or otherwise interact with the Service. By using the Service you agree to the practices described here.
2. Information we collect
We collect the following categories of information, most of which you provide directly or by connecting a source.
Account information
Your name, email address, username, phone number, and password. Passwords are stored only as salted hashes. If you belong to an organization on BigBooks, we also record that membership and the role it grants you.
Financial data you connect
When you link a financial institution through a data aggregator (Plaid, MX, Finicity, Yodlee, or Akoya), we receive the institution name, account names and types, balances, transactions, holdings, and related metadata for the accounts you select. Your institution login credentials are handled by the aggregator and your institution; BigBooks never receives or stores them.
Files you upload
Statements and exports you import (for example CSV or PDF bank statements) and any document you attach to a conversation. We extract the transactions, balances, and text they contain and keep the original file in encrypted cloud storage.
Content you give to AI features
Questions, instructions, and conversations you have with the BigBooks assistant, along with the responses it produces and the records it reads on your behalf to answer.
Billing information
If you subscribe to a paid plan, payment is processed by Stripe. We receive your Stripe customer identifier, plan, invoice status, and the card brand and last four digits. We never see or store full card numbers.
Technical and usage data
IP address, browser and device type, the pages and API endpoints you request, timestamps, request identifiers, and the identifier of the account making the request. Our logs record identifiers, not names, descriptions, or account numbers.
3. How we use information
We use the information above to:
- Provide the Service: maintain your ledger, compute balances and statistics, categorize transactions, detect recurring activity, prepare budgets and reports, and keep your data current with your institutions.
- Sign you in and let Connected Apps you authorize act within the scope you granted them.
- Answer questions and carry out tasks you give the AI assistant.
- Protect the Service and its users: detect abuse, enforce rate limits, investigate security incidents, and prevent fraud.
- Bill you for paid features and send the receipts and notices that go with them.
- Send transactional email such as confirmation codes, password resets, and notices about your account. We do not send marketing email.
- Comply with law, respond to lawful requests, and enforce our Terms of Use.
4. How AI features handle your data
The BigBooks assistant is powered by third-party large language models. Depending on the plan and the model you or a Connected App selects, requests may be processed by Anthropic, OpenAI, Google, DeepSeek, MiniMax, or models hosted on Amazon Bedrock.
When the BigBooks assistant sends a request to a model provider, we first remove or mask identifying details such as names, so the provider receives amounts, dates and categories but not who they belong to. Embedding vectors used for search are computed on our own servers and are never sent to a provider.
We use model providers only through their business API terms, which restrict how they may use the content we send, and we do not use your data to train models. Conversation history is retained so that you can review it and so that the assistant can keep context; you can delete conversations from your account settings.
AI apps you connect yourself work differently. When you authorize a Connected App that brings its own AI model, such as an AI assistant you link to your BigBooks account, BigBooks gives that app your records as you see them, including the names of your accounts, merchants, and the people on them. The app shares that content with the model it uses under the app's own terms and privacy policy, and the masking described above does not apply. You are asked to confirm this before the app is connected, or, for an app you connected before this notice, the next time you sign in to it; until then it keeps the access you gave it. You can revoke its access from your account at any time; an app you registered yourself is disabled from its own client page instead.
5. When we share information
We share information only in the following circumstances.
Connected Apps you authorize
When you sign in to a Connected App with BigBooks, you approve the scope of access it requests. The app can then read and write data within that scope, including the names on your records, until you revoke it. You can review and revoke every authorization from your account at any time, except for an app you registered yourself, which you disable from its client page.
Data aggregators
Plaid, MX, Finicity, Yodlee, and Akoya receive the information they need to connect and refresh the institutions you link, and they process your institution credentials under their own privacy policies.
Service providers
We rely on Amazon Web Services for hosting, storage, secrets management, and email delivery; Stripe for billing; Google reCAPTCHA to protect sign-up from automated abuse; and the model providers listed above. Each processes data only to provide its service to us.
People you work with
If you are a member of an organization on BigBooks, or you give another person or firm access to your records, they can see the data within the scope of that relationship. Access follows the relationships recorded on your account, and removing a relationship removes the access.
Legal requirements and business transfers
We may disclose information when required by law, subpoena, or court order, to protect the rights and safety of BigBooks and its users, or as part of a merger, acquisition, or sale of assets, in which case this policy continues to apply to the transferred data.
We do not sell personal information, and we do not share it with third parties for advertising or cross-context behavioral advertising.
6. Cookies
The website uses a session cookie to keep you signed in and a CSRF token to protect forms. Both are essential to the Service and expire when your session ends. The sign-up page loads Google reCAPTCHA, which may set its own cookies subject to Google's privacy policy.
The API does not use cookies; it authenticates every request with a bearer token. We do not use advertising or cross-site tracking cookies.
7. How long we keep information
We keep your account and financial data for as long as your account is active. When you disconnect an institution, delete a file, or delete a conversation, the associated records are removed from active systems. When you delete your account, we delete your personal and financial data from active systems, and backup copies expire on a rolling schedule.
We may retain billing records for as long as tax and accounting rules require, and technical logs for a limited period to investigate security incidents and operational failures.
8. Security
Data is encrypted in transit with TLS and at rest in our databases and file storage. Institution access tokens and API keys are held in a managed secrets store, passwords are stored as salted hashes, and access tokens issued to Connected Apps are short-lived and can be revoked.
No system is perfectly secure. If we learn of a breach that affects your information, we will notify you and the relevant authorities as required by law.
9. Your choices and rights
You control your data on BigBooks. At any time you can:
- Review and update your profile, email address, phone number, and password.
- Disconnect a financial institution, which stops further data retrieval from it.
- Revoke any Connected App's access to your account.
- Export your records through the BigBooks API or a Connected App.
- Delete conversations, files, accounts, or your entire BigBooks account.
Depending on where you live, you may have additional rights to access, correct, delete, or restrict the processing of your personal information, or to object to it. To exercise these rights, or to appeal a decision we make about a request, contact us at the address below. We will verify your identity before acting and will not discriminate against you for exercising your rights.
10. Children
The Service is not directed at children. You must be at least 18 years old to create a BigBooks account, and we do not knowingly collect information from anyone under 18. If you believe a child has provided us with information, contact us and we will delete it.
11. Where data is processed
BigBooks is operated from the United States, and your information is stored and processed there. If you use the Service from another country, you consent to the transfer of your information to the United States, where privacy laws may differ from those of your home country.
12. Changes to this policy
We may update this policy from time to time. When we do, we will change the effective date at the top of this page, and if the changes are material we will notify you by email or through the Service before they take effect.
13. Contact
Questions about this policy or about your information can be sent to marc@bigbooks.app.