Privacy Policy

Overview

Good Soil Tracker is a read-only financial cockpit. We help you see banking, brokerage, and crypto in one harvest so you can plan for long-term growth. We do not hold funds, transfer money, place trades, or act as a bank, broker, or advisor.

Good Soil never holds your funds or moves money. We never see or store your bank or brokerage passwords. Read-only access tokens from Plaid and SnapTrade are encrypted at rest and used only to read balances.

What we collect

We collect only what we need to run the product for you.

• Account: email address, hashed password, and a verified user id.
• Billing: Stripe customer and subscription identifiers. Card numbers stay with Stripe.
• Harvest you enter: manual holdings, debts, notes, cost basis, and display preferences.
• Connected accounts: institution name, account name and mask, balances, holdings, posted transactions, and supported liabilities that Plaid or SnapTrade return.
• Provider tokens: Plaid and SnapTrade access secrets, encrypted at rest with AES-256-GCM. We never receive or store the password you type at your bank or brokerage.
• Connection alerts: an in-app notice and a reconnect email if a linked bank or brokerage stops letting us read it. We email the address on your account. We do not send marketing mail.
• Technical: standard server logs (IP, user agent) for security and abuse prevention.

How connections work

Banks connect through Plaid. Brokerages and crypto exchanges connect through SnapTrade. Both sessions are read-only. Good Soil stores encrypted access tokens so we can refresh balances — not your login password, and never a token that can transfer, trade, or pay.

You authorize each link in Plaid Link or the SnapTrade Connection Portal. You can unlink an institution at any time. Unlinking deletes that connection’s tokens and the balances we stored from it.

Plaid is used for depository accounts, cards, transactions, and supported liabilities. SnapTrade is used for brokerages and crypto exchanges, including positions and residual cash. We do not request Plaid products that move money (transfer, auth, payment initiation) or SnapTrade trading scopes.

How we use data

We use this data to mark your harvest to market, compute net worth (assets minus debt), show cash flow from posted activity, export a personal record you download, and tell you when a linked bank or brokerage needs reconnect. We do not sell your data. We do not use connected balances to underwrite credit, advertise against you, or train public models.

Processors

A short list of processors help us run the cockpit. Each is limited to its job.

• Plaid — bank Link and read-only balances / transactions / liabilities.
• SnapTrade — brokerage and crypto-exchange Connection Portal and read-only positions.
• Stripe — subscription checkout and the customer billing portal.
• Supabase — authentication and the paid-subscription row for your user id. Supabase also sends sign-in mail (verify the address, reset a password).
• Neon / Postgres — encrypted tokens and harvest rows, scoped by user id.
• Resend — reconnect emails when a linked bank or brokerage needs a hand.
• Vercel — hosting the app.

Retention and deletion

We keep your harvest and connection data while your account is open. You can delete your account from the harvest: that removes your login, harvest, connection tokens, and stored balances. Stripe billing is canceled. Some processors may retain records they are legally required to keep (for example Stripe payment history).

You can also unlink a single institution without deleting the account.

Your rights

Depending on where you live, you may have rights to access, correct, or delete personal information, and to appeal a denial. Email us at the address below. California residents may also request a copy of categories collected and the purpose of collection. We will not discriminate for exercising these rights.

Security

Provider tokens are encrypted at rest. Queries that read your harvest are scoped to the verified user id on the session — never a client-supplied id. No system is perfect. If we learn of a breach that affects you, we will notify you as required by law.

Children

Good Soil Tracker is not directed at children under 13, and we do not knowingly collect their data.

Contact

Questions about privacy: [email protected]. This policy may change; the date at the top is the latest revision.