Skip to main content
Safe-to-spend
Back to home

How we look after your data

Privacy Policy

Last updated: June 15, 2026

1. Introduction

Next Aura Labs, Inc. (“Shelter,” “we,” “us,” or “our”) operates the Shelter mobile application and website at shelter.money (collectively, the “Service”). Shelter is a personal finance tool that connects to your bank accounts, analyzes your transactions, and helps you anticipate cash flow shortfalls before they happen.

Because we handle sensitive financial data, we take privacy seriously. This Privacy Policy explains what information we collect, why we collect it, how we protect it, and your rights regarding it. Please read it carefully.

By using Shelter, you agree to the collection and use of information as described in this policy.

2. Information We Collect

a. Account Information

When you create an account, we collect your email address and authentication credentials through Clerk, our identity provider. If you sign in with Google or Apple, we receive your name and email address from those providers. We do not store your passwords directly.

b. Financial Data (via Plaid)

To provide cash flow predictions and financial insights, Shelter connects to your bank accounts through Plaid Technologies, Inc. (“Plaid”). Through this connection we access:

  • Account balances and available balances
  • Transaction history, including up to 24 months from Plaid where available (amounts, dates, merchant names, categories)
  • Account type, institution name, and masked account numbers
  • Recurring payment and income patterns

We access your financial data in read-only mode. Shelter cannot initiate transfers, make payments, or take any action on your accounts. We never see or store your bank login credentials. Those are handled directly between you and Plaid. Plaid's privacy policy is available at plaid.com/legal.

c. Payment Information

Subscription payments are processed by Stripe, Inc. We do not collect or store your credit card number, CVV, or full billing address. Stripe handles all payment processing and provides us only with a subscription status and a masked payment method identifier (e.g., last four digits of your card). Stripe's privacy policy is available at stripe.com/privacy.

d. Usage and App Data

When you use the Service, we collect:

  • Features you use and how you interact with the app (buttons tapped, screens viewed)
  • Actions you take on AI recommendations (accepted, dismissed, completed)
  • Alert preferences and notification settings
  • Saved preferences, planning settings, and feedback you configure
  • In-app messages and support communications

e. Device and Technical Data

We automatically collect certain technical information when you use the Service:

  • Device type, operating system version, and app version
  • Push notification token (to send you alerts)
  • IP address and approximate location (country/region, derived from IP)
  • Crash logs and error reports to diagnose and fix issues

We do not collect precise GPS location. The “Location” step during onboarding asks for your state and income bracket for localization purposes only. It is optional and not tied to device location services.

3. How We Use Your Information

We use the information we collect to:

  • Generate 30-day cash flow predictions and “safe to spend” calculations
  • Detect recurring bills, zombie subscriptions, and spending anomalies
  • Send financial alerts and push notifications (bill due, low balance, shortfall ahead)
  • Power Shelter AI recommendations and the Shelter chat assistant
  • Process subscription payments and manage your account
  • Authenticate your identity and maintain account security
  • Improve the accuracy of our prediction models using aggregated, anonymized patterns
  • Respond to your support requests and communicate service updates
  • Comply with legal obligations

We do not use your financial data to train general-purpose AI models, sell targeted advertising, or make decisions about your creditworthiness.

4. How We Share Your Information

We do not sell your personal information. We do not share your financial data with advertisers, data brokers, or marketing companies. We share information only as described below:

Service Providers

We share data with the following third-party service providers who process it on our behalf under confidentiality agreements:

  • Plaid: bank account connectivity (read-only)
  • Stripe: subscription payment processing
  • Clerk: authentication and user identity management
  • Convex: backend database and serverless functions (US-based)
  • OpenAI: powers deal and merchant research and the Shelter chat assistant. Transaction summaries and merchant names are sent to OpenAI for processing. OpenAI does not use API data to train its models per its API usage policy.
  • Google (Gemini): powers automated transaction categorization. Merchant names and transaction descriptions are sent to Google's Gemini API for classification. Google does not use API data to train its models per its API data usage policy.
  • Anthropic (Claude): powers insight quality analysis. Financial insight summaries are sent to Anthropic's Claude API for quality evaluation. Anthropic does not use API data to train its models per its API usage policy.
  • Telegram: optional messaging integration. If you connect your Telegram account, financial alerts and Shelter AI messages are delivered via Telegram's Bot API. Your Telegram chat ID is stored to route messages. You can disconnect at any time.
  • RevenueCat: mobile subscription management for App Store and Google Play purchases. Processes subscription status and entitlement data.
  • Expo / EAS: mobile app build and push notification delivery
  • Internal analytics: we operate a first-party analytics service that receives aggregated usage events, feature adoption data, and anonymized transaction patterns to improve the Service. This data is not shared with third parties.

Legal Requirements

We may disclose your information if required by law, subpoena, court order, or other legal process, or if we believe disclosure is necessary to protect our rights, prevent fraud, or ensure the safety of our users.

Business Transfers

If Shelter is acquired, merges with another company, or substantially all of its assets are transferred, your information may be transferred as part of that transaction. We will notify you via email or prominent in-app notice before your data becomes subject to a different privacy policy.

Aggregated and Anonymized Data

We may share aggregated, anonymized statistics (e.g., “users in this income bracket spend X% on subscriptions”) that cannot be linked back to any individual user.

5. Data Security

We implement the following security measures to protect your data:

  • Encryption in transit: All communication between the app and our servers uses TLS 1.2 or higher.
  • Encryption at rest: Data stored in our database is encrypted using AES-256.
  • No credential storage: We never see or store your bank login credentials. Plaid handles that directly with your bank.
  • Access isolation: Your data is scoped to your account and is not accessible to other users or Shelter staff in the normal course of operations.
  • Secure token storage: Authentication tokens on your device are stored in the device's secure enclave (iOS Keychain / Android Keystore) via Expo SecureStore.

No system is perfectly secure. While we take these precautions, we cannot guarantee absolute security of your information.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Specifically:

  • Account and financial data: Retained while your account is active. Upon account deletion, your data is permanently deleted immediately across all systems, including transactions, bank connections, AI conversation history, insights, preferences, and connected integrations.
  • Billing records: Retained for 7 years to comply with tax and financial record-keeping laws.
  • Anonymized usage data: May be retained indefinitely in aggregated form that cannot be linked to you.
  • Legal holds: If data is subject to a legal hold or regulatory requirement, we retain it for as long as required by law.

When you disconnect a bank account from within the app, we stop syncing data from that account. Historical transactions already synced are retained in your account history until you delete your account.

7. Your Privacy Rights

Rights for All Users

Regardless of where you live, you have the right to:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Ask us to correct inaccurate personal data.
  • Deletion: Request deletion of your account and associated personal data.
  • Disconnect: Disconnect your bank accounts at any time from within the app.
  • Portability: Request an export of your data in a machine-readable format.
  • Opt out of non-essential communications: Unsubscribe from marketing emails at any time.

California Residents: CCPA / CPRA Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with the following additional rights:

  • Right to Know: The right to know what categories of personal information we collect, the purposes for which it is used, and with whom it is shared.
  • Right to Delete: The right to request deletion of personal information we have collected from you, subject to certain exceptions.
  • Right to Correct: The right to request correction of inaccurate personal information.
  • Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising. There is nothing to opt out of, but you may contact us to confirm.
  • Right to Limit Use of Sensitive Personal Information: Financial account data is sensitive personal information. We use it only to provide the Service and will not use it for inferring characteristics unrelated to the Service.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise your California rights, email us at privacy@shelter.money with the subject line “California Privacy Request.” We will respond within 45 days. You may designate an authorized agent to make a request on your behalf.

United Kingdom Residents: UK GDPR Rights

If you are in the United Kingdom, you may have rights under the UK GDPR and Data Protection Act 2018, including access, correction, deletion, restriction, objection, portability, and the right to withdraw consent where processing is based on consent. You may also lodge a complaint with the UK Information Commissioner's Office (ICO).

How to Exercise Your Rights

For all privacy requests, email privacy@shelter.money. We will verify your identity before processing the request and respond within 30 days where required by applicable law (45 days for California requests). Account deletion can also be initiated directly from Settings → Account → Delete Account within the app.

8. Cookies and Tracking

The Shelter mobile app does not use cookies. The shelter.money website may use:

  • Strictly necessary cookies: Required for authentication and session management (e.g., Clerk session cookies). These cannot be disabled.
  • Analytics and ad attribution: We may use privacy-first analytics (such as aggregated pageview counts) and limited advertising attribution tools, such as Microsoft Advertising UET, to understand website usage and measure campaign performance. These tools apply to the website, not your linked bank account data.

We do not track you across third-party websites or apps and do not participate in interest-based advertising networks.

9. AI and Automated Processing

Shelter uses AI and automated systems to analyze your financial data and generate predictions and recommendations. Specifically:

  • Our cash flow engine processes your transaction history to forecast your balance 30 days out.
  • Our anomaly detection system flags unusual spending patterns that may indicate fraud or errors.
  • The Shelter AI assistant uses OpenAI's API to answer your financial questions. Conversation context and anonymized financial summaries are sent to OpenAI for this purpose.
  • Transaction categorization uses Google's Gemini API. Merchant names and transaction descriptions are sent for automated classification.
  • Insight quality evaluation uses Anthropic's Claude API. Financial insight summaries (not raw transaction data) are sent for quality scoring.
  • Deal and merchant research uses OpenAI's API to find relevant offers based on your spending patterns. Merchant names (not account numbers or balances) are sent for this purpose.

All AI providers process data under their respective API terms, which prohibit using API inputs to train their models. We label all user-originated data as untrusted in AI prompts and sanitize inputs to minimize data exposure.

These systems generate informational outputs only. No automated decision produces a legal or similarly significant effect on you (such as a credit decision or denial of service). All predictions are estimates. See our Terms of Service for more detail.

You may opt out of the Shelter AI assistant at any time by not using it. Your transaction data will still be processed by our core prediction engine, which is necessary to provide the Service.

10. Children's Privacy

Shelter is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you are under 13, do not use the Service or provide any personal information to us.

If we learn that we have collected personal information from a child under 13 without parental consent, we will delete that information promptly. If you believe we may have collected information from a child under 13, please contact us at privacy@shelter.money.

11. Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users by email within 72 hours of becoming aware of the breach (or as soon as reasonably practicable), and will notify applicable regulatory authorities as required by law. The notification will describe the nature of the breach, the data affected, and the steps we are taking.

12. International Data Transfers

Shelter is operated from the United States. If you access the Service from outside the United States, including the United Kingdom, your information will be transferred to, stored, and processed in the United States and by service providers in other countries where data protection laws may differ from those in your country.

For UK users, this may include processing by US-based infrastructure, payment, analytics, support, and AI service providers listed in this policy. Where required, we rely on appropriate safeguards such as contracts, data processing terms, and standard contractual clauses or equivalent transfer mechanisms.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and/or by displaying a prominent notice in the app at least 30 days before the changes take effect. The “Last updated” date at the top of this page reflects the most recent revision.

Your continued use of the Service after any changes constitutes your acceptance of the updated policy. If you do not agree with changes, you may delete your account before they take effect.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: