What we store, what we never see.

What we never see

• Bank credentials. Headroom doesn’t ask for bank logins and doesn’t use bank-sync services. There is nothing to connect.
• Your screenshots. On iPhone, statement screenshots are read on your device. Only the rows you review and keep are uploaded.
• Full account numbers. We keep the last four digits at most.

What we store

• The balances, income details and plans you enter.
• Transactions from statements you import, only after you review and confirm them.
• Raw statement files, briefly: they sit in private storage while you review an import and are deleted automatically after 7 days, or immediately when you ask.

How it’s protected

• Every table that holds your data enforces row-level security: your account can read only your rows.
• Data is encrypted in transit (TLS) and at rest by our database provider.
• Analytics events and error logs never contain amounts, transaction descriptions or account identifiers.
• If an AI model helps recognize an unfamiliar file layout, it receives column headers and up to five sample rows, never a whole file and never amounts.

How to delete everything

In the app, Settings → Data & privacy → Delete account removes your account and every row tied to it in one step. You can download an export first.

On the waitlist? Email hello@example.com and we’ll remove your entry.

Report a vulnerability

Email hello@example.com with the details. Please give us a chance to fix it before disclosing it publicly.