Privacy Policy

Effective Date: July 28, 2026

Last Updated: July 28, 2026

Discresh, Inc. ("Discresh", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website (collectively, the "Service"). Please read this policy carefully. If you disagree with its terms, please discontinue use of the Service.

This policy is designed to comply with the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Colorado Privacy Act (CPA), the General Data Protection Regulation (GDPR) where applicable, and other applicable US privacy laws.

1. Information We Collect

We collect the following categories of information:

1.1 Information You Provide

• Email address (collected at signup and account creation)
• Account preferences and budget settings you configure within the Service
• Communications you send us directly

1.2 Financial Data via Plaid

With your explicit consent, we connect to your financial accounts through Plaid Technologies, Inc. ("Plaid"). Through this connection we receive: account balances, transaction history, and account metadata (institution name, account type). This connection is read-only: Discresh never initiates transactions, moves money, or stores your banking credentials. Plaid's own privacy policy governs Plaid's handling of your data and is available at plaid.com/legal.

1.3 Usage Data

We automatically collect certain information when you use the Service, including:

• Device type, operating system, and app version
• Feature interactions and in-app behavior (e.g., which screens you visit, how often you open the app)
• Crash reports and performance diagnostics
• IP address and general location (country/region level only)

1.4 Information We Do Not Collect

We do not collect Social Security numbers, government ID numbers, full payment card numbers, or biometric data.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Calculate and display your daily discretionary spending number
• Send transactional communications (e.g., account confirmations, security alerts)
• Respond to your inquiries and support requests
• Monitor and improve the performance and reliability of the Service
• Comply with legal obligations
• Detect, investigate, and prevent fraudulent or unauthorized activity

Aggregate Behavioral Data: We may analyze usage patterns across our user base in aggregate, anonymized form to understand how different groups of users interact with the Service. This analysis operates at the group level only and is designed so that no individual user can be identified from the resulting data. We may use these aggregate insights to improve the Service and inform product decisions.

Future Products: If we develop additional products or services and wish to use your personal data in connection with them, we will obtain your explicit opt-in consent before doing so. We will never use your personal data for new purposes without first asking you.

3. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases:

• Contract performance: Processing necessary to provide the Service you have requested
• Legitimate interests: Service improvement, security, and fraud prevention, where these interests are not overridden by your rights
• Consent: Where we rely on consent (e.g., connecting financial accounts via Plaid), you may withdraw consent at any time without affecting prior processing
• Legal obligation: Where processing is required by applicable law

4. Data Sharing and Disclosure

We do not sell your personal information. We share your information only in the following circumstances:

4.1 Service Providers

We share data with trusted third-party service providers who assist us in operating the Service. The following is not an exhaustive list:

• Plaid Technologies, Inc.: Financial account connectivity (read-only)
• Supabase, Inc.: Database infrastructure and authentication. We have executed a Data Processing Agreement with Supabase.
• Netlify, Inc.: Website hosting and delivery

All service providers are contractually bound to use your data only as directed by us and in accordance with this policy.

4.2 Legal Requirements

We may disclose your information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Discresh, our users, or the public.

4.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice within the Service prior to your information being transferred and becoming subject to a different privacy policy.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. You may request deletion of your account and associated data at any time by contacting us at hello@discresh.com. Upon verified request, we will delete your personal data within 30 days, except where retention is required by law or legitimate business necessity (e.g., fraud prevention records).

Financial transaction data retrieved via Plaid is retained for a maximum of 13 months of rolling transaction history to support monthly budgeting calculations.

6. Data Security

We implement industry-standard technical and organizational security measures including:

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of data at rest
• Access controls limiting employee access to personal data on a need-to-know basis
• Read-only access to financial data via Plaid (no ability to initiate transactions)

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security. In the event of a data breach affecting your rights and freedoms, we will notify you as required by applicable law.

7. Your Rights

7.1 All Users

Regardless of your location, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate personal information
• Delete your account and associated personal data
• Disconnect your financial account connection at any time through the Service
• Opt out of non-essential communications

7.2 California Residents (CCPA/CPRA)

California residents have the following additional rights:

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the purposes for collection, and the categories of third parties with whom we share it
• Right to Delete: You may request deletion of personal information we have collected, subject to certain exceptions
• Right to Correct: You may request correction of inaccurate personal information
• Right to Opt Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioral advertising
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information beyond what is necessary to provide the Service
• Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights

To exercise your California privacy rights, contact us at hello@discresh.com. We will respond within 45 days of receiving a verifiable consumer request.

7.3 Colorado Residents (CPA)

Colorado residents have the right to:

• Access personal data we process about you
• Correct inaccurate personal data
• Delete personal data provided by or obtained about you
• Obtain a portable copy of personal data you have provided to us
• Opt out of the processing of personal data for targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects

To exercise your Colorado privacy rights, contact us at hello@discresh.com. We will respond within 45 days, with a possible 45-day extension with notice.

Colorado residents who believe their rights have been violated may appeal our decision by contacting us. If your appeal is denied, you may contact the Colorado Attorney General at coag.gov.

7.4 EEA, UK, and Swiss Residents (GDPR)

In addition to the rights above, if you are located in the EEA, UK, or Switzerland you have the right to:

• Data portability: Receive your personal data in a structured, machine-readable format
• Restriction of processing: Request that we limit how we use your data in certain circumstances
• Object to processing: Object to processing based on legitimate interests
• Withdraw consent: Where processing is based on consent, withdraw it at any time
• Lodge a complaint with your local supervisory authority

Our representative for GDPR purposes is reachable at hello@discresh.com.

8. Cookies and Tracking

Our website uses essential cookies required for the Service to function. We do not currently use advertising cookies, third-party tracking pixels, or cross-site behavioral tracking. If this changes, we will update this policy and obtain appropriate consent.

9. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at hello@discresh.com and we will delete that information promptly.

10. International Data Transfers

Your information may be transferred to and processed in the United States and other countries. For transfers from the EEA, UK, or Switzerland to countries not deemed adequate by the relevant supervisory authority, we rely on Standard Contractual Clauses or other appropriate safeguards as required by applicable law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting the updated policy within the Service with a new effective date. Your continued use of the Service after such notice constitutes acceptance of the updated policy. For significant changes, we may seek your renewed consent where required by law.

12. Contact Us

For any questions, requests, or concerns regarding this Privacy Policy or our privacy practices, please contact:

Discresh, Inc.
Email: hello@discresh.com
Registered State: Delaware, United States

We aim to respond to all privacy-related inquiries within 10 business days.