Privacy Policy

Last updated: July 12, 2026

Forward Change ("we," "us," or "our") is committed to protecting your privacy. This policy explains what information we collect, how we use it, and your rights regarding your data.

1. Information We Collect

When you create an account and use Forward Change, we collect:

• Account information: your email address and a securely hashed version of your password (we never store your password in plain text)
• Bank connection data: access tokens provided by Plaid when you link your bank account. We do not store your bank account numbers or login credentials.
• Transaction data: purchase amounts and calculated round-up totals from your linked accounts, used to track your spare change contributions
• Payment information: a Stripe customer ID and payment method token when you add a payment method. We do not store your full card number.
• Startup split preferences: which mission-driven startups you've chosen to support and your allocation percentages

2. How We Use Your Information

• To calculate and collect your monthly round-up contributions
• To distribute your contributions to your chosen startups
• To send you monthly email receipts summarizing your contributions
• To operate, maintain, and improve the Forward Change service
• To communicate important updates about your account

3. How We Share Your Information

We do not sell your personal information. We share data only with the following trusted service providers who help us operate the platform:

• Plaid Technologies: connects your bank account and retrieves transaction data. Plaid's privacy policy is available at plaid.com/legal/privacy-policy.
• Stripe: processes your payments securely. Stripe's privacy policy is available at stripe.com/privacy.
• Railway: hosts our application and database on encrypted infrastructure.

We may also disclose information if required by law or to protect the rights and safety of our users.

4. Data Security

We take security seriously. Your data is protected by:

• HTTPS/TLS encryption for all data in transit
• bcrypt hashing for passwords
• Encrypted storage on Railway's infrastructure
• Rate limiting and JWT-based authentication
• No storage of raw financial credentials — bank and card data stays with Plaid and Stripe

5. Your Rights

You have the right to:

• Access your data: request a copy of the personal information we hold about you
• Delete your account: request deletion of your account and all associated data at any time
• Disconnect your bank: unlink your bank account through the app at any time
• Opt out of emails: contact us to stop receiving monthly receipts

To exercise any of these rights, contact us at the address below.

6. Data Retention

We retain your account data for as long as your account is active. If you request account deletion, we will remove your personal information within 30 days, except where retention is required by law.

7. Children's Privacy

Forward Change is not directed at children under the age of 18. We do not knowingly collect personal information from minors.

8. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by email or by posting a notice in the app. The date at the top of this page reflects the most recent update.