Privacy Policy

1. Introduction

This Privacy Policy explains what information TwoVector ("we," "us," or "our"), operated by TwoVector LLC, LLC formation pending, collects through the TwoVector application at app.twovector.com (the "Service"), how we use it, who we share it with, and the choices you have. It applies to the Service and to our marketing site at twovector.com; where a practice is specific to one of the two, we say so.

By using the Service, you agree to the collection and use of information as described in this Policy. If you have questions, contact us at support@twovector.com.

2. Privacy at a Glance

The short version:

• We do not sell your personal information, and we never have.
• We do not share your personal information for cross-context behavioral advertising, and we do not show ads.
• Your data is encrypted in transit and at rest.
• You can export your data or delete your account at any time.

3. Information We Collect

Account information. Your name, email address, password (stored as a salted hash, never in plain text), and authentication tokens.

Financial data. If you connect a bank account, we use Plaid to establish that connection. TwoVector never receives or stores your bank login credentials — Plaid handles authentication with your bank directly and passes us only the account balances, transactions, and identifiers needed to display and categorize your finances. If you add accounts manually, we store whatever balances and transactions you enter. We also store the budgets, categories, and net worth history you create from this data.

Work and personal data. Calendar events, contacts, meeting records and notes (including any transcripts you generate), files you upload to your drive, and scheduling links and event types you configure.

Health data. Nutrition entries, weight logs, and related health information you choose to enter. This data is also covered by our separate Consumer Health Data Privacy Policy.

Property and market research queries. If you use real estate or market research features, we collect the addresses, locations, tickers, and screening criteria you search or save, and the analyses you run on them.

AI chat content. Messages you send to Vec, and the account context Vec reads to answer them (for example, your transactions or calendar, when relevant to your question), are sent to our AI subprocessor to generate a response. See Section 6 (AI Processing).

Voice and transcription data. If you use the desktop notetaker, audio you choose to record is sent to our transcription subprocessor, Deepgram, to generate a transcript, which is then stored in your account.

Usage and device data. Standard technical data such as IP address, browser type, device identifiers, log data, product usage events, error reports, and — if you enable notifications — a push notification subscription for your browser or device, collected automatically when you use the Service.

Support communications. Messages you send us (for example, support tickets and emails) and our responses.

We collect this information directly from you, automatically as you use the Service, and — only where you connect them — from third parties such as your bank (via Plaid).

4. How We Use Your Information

We use your information to:

• provide and operate the Service (for example, calculating your net worth or scheduling a meeting);
• power Vec's ability to answer questions about your data and, where you direct it, take actions on your behalf;
• process payments and manage your subscription;
• secure the Service and detect fraud or abuse;
• send you service-related communications (for example, billing receipts or security alerts);
• respond to your support requests; and
• understand how the Service is used and improve its reliability and features.

We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not use your financial or health data to serve you third-party advertising. Where the laws of the EEA or UK apply, we process your data to perform our contract with you, for our legitimate interests in securing and improving the Service, to comply with legal obligations, and — for optional features — with your consent.

5. How We Share Information

We share data with a small number of specialist providers ("subprocessors"), each scoped to a specific purpose:

• AWS (Amazon Web Services) — hosts our application, database, and file storage, and delivers our email, in the us-east-1 (Northern Virginia) region.
• Plaid — connects to your bank to retrieve balances and transactions; TwoVector never receives your bank credentials.
• Anthropic — processes the content of your conversations with Vec, and any account context included in those conversations, to generate AI responses. See Section 6.
• Deepgram — transcribes audio you record in the desktop notetaker.
• Stripe — processes payments and manages billing for paid subscriptions. Your card details go directly to Stripe; we never receive full card numbers.
• PostHog — product analytics for the Service and marketing site (see Section 10).
• Sentry — error monitoring; receives technical error reports, which include device information and IP address.
• Cloudflare — provides the Turnstile bot-protection check on our sign-up page; receives the interaction data needed to distinguish humans from bots.

Each provider is contractually restricted to using your data to provide services to us, and not for their own independent purposes. If we add or replace a subprocessor that handles personal information, we will update this Policy.

Third-party data lookups. When you use property or market research features, the specific query needed to answer your request — for example, an address you search (RentCast property data, FEMA flood data via Esri, Photon address autocomplete) or a ticker or series you look up (SEC EDGAR, FRED, Yahoo Finance) — is sent to the relevant data provider from our servers. These providers receive the query itself, not your name or account identity.

Other disclosures. We may disclose information if required by law, subpoena, or court order; to protect the rights, safety, or property of TwoVector, our users, or the public; or as part of a merger, acquisition, or sale of assets, in which case we will notify you before your personal information becomes subject to a different privacy policy. We also share information when you direct us to — for example, with members of your household when you mark data as shared.

6. AI Processing

AI features are powered by Anthropic's Claude models via API. When you message Vec or use an AI feature, your message and the relevant account context are sent to Anthropic to generate the response. Under Anthropic's commercial API terms, Anthropic does not use this data to train its models. Audio you record with the notetaker is processed by Deepgram solely to produce your transcript.

We do not use your content to train our own AI models. AI-generated content can be inaccurate; the Terms of Service (Section 7) describe the limits of AI features.

7. Data Retention

We retain your account data for as long as your account is active, so the Service can function (for example, showing your full transaction history). If you delete your account, we delete your personal data from active systems, other than data we are required to retain for legal, tax, or accounting purposes (for example, billing records), and residual copies that persist in encrypted backups for a limited period before they are overwritten in the normal backup cycle.

8. Your Rights & Choices

We extend these rights to all users, wherever you live:

Access and export. You can request a copy of your data, in a portable format, by contacting support@twovector.com.

Correction. You can correct most of your information directly in the Service (for example, editing a transaction or profile field), or by asking us to do so.

Deletion. You can request deletion of your account and its data by contacting support@twovector.com.

We verify requests by confirming control of the email address on your account, and we respond within 45 days. You may use an authorized agent to submit a request on your behalf if the agent provides proof of your written permission. We will never discriminate against you — in price, service quality, or otherwise — for exercising a privacy right.

US State Privacy Rights

If you live in California or another US state with a comprehensive privacy law, those laws may give you the rights above plus the right to know the categories of personal information a business collects and shares, and the right to opt out of the sale or sharing of personal information and of targeted advertising. The categories we collect are listed in Sections 2 and 3; we disclose them only to the service providers listed in Section 5, for the business purposes described in Section 4. We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising, and have not done so in at least the preceding 12 months — so there is no sale or sharing to opt out of. If we decline a rights request, we will explain why, and you may appeal by replying to our response with the word "Appeal"; if the appeal is unsuccessful, you may contact your state Attorney General.

EEA & UK

If the GDPR or UK GDPR applies to you, you also have the rights to restrict or object to certain processing and to lodge a complaint with your local supervisory authority. The legal bases we rely on are described in Section 4.

9. Do Not Track & Global Privacy Control

We do not track users over time across third-party websites, so there is no cross-site tracking for a browser "Do Not Track" signal to switch off, and we do not respond to DNT signals. Because we do not sell personal information or share it for cross-context behavioral advertising, a Global Privacy Control (GPC) signal has nothing to opt out of; where the law treats GPC as a valid opt-out request, we honor it — our default practices already comply.

10. Cookies and Analytics

The TwoVector application (app.twovector.com) uses only cookies that are essential to signing in and operating the Service — it does not use advertising or cross-site tracking cookies.

Our marketing site (twovector.com) and the TwoVector application use PostHog, a product analytics tool, to understand how the Service is used. Our configuration does not use advertising or cross-site tracking cookies; it stores a random identifier in your browser's local storage, and in the application, usage events are associated with your account. Analytics data is not sold or shared with advertisers.

11. Security

We use industry-standard measures to protect your data, including encryption in transit (TLS) and at rest, and access controls limiting who can view your data internally. No method of transmission or storage is 100% secure; see our Security page for more detail. If a breach affecting your personal information occurs, we will notify you and the relevant authorities as required by law.

12. Children's Privacy

The Service is not directed to children under 18, and we do not knowingly collect information from children under 18. If you believe a child has provided us with personal information, contact us at support@twovector.com and we will delete it.

13. Consumer Health Data

Health and nutrition information you enter into the Service is "consumer health data" under some state laws, including Washington's My Health My Data Act and Nevada's consumer health data law. Our separate Consumer Health Data Privacy Policy describes what health data we collect, why, who touches it, and the additional rights those laws give you.

14. International Data Transfers

We host the Service in the United States (AWS us-east-1). If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country. The protections described in this Policy apply to your data regardless of where you live.

15. Changes to This Policy

We may update this Privacy Policy from time to time. If we make a material change, we will notify you by email or an in-app notice before it takes effect. The "Last updated" date at the top of this page reflects the most recent version.

16. Contact Us

Questions about this Privacy Policy, or a request to access, export, or delete your data? Email support@twovector.com.