1. Our Core Principle
Numeris is designed around a single, uncompromising guarantee: your financial data belongs exclusively to you. We do not sell your personal data, track you across the web, profile your spending for advertising, or have access to your raw financial ledgers.
2. Multi-Device Synchronization & Encrypted Relays
When you use multi-device synchronization, client data envelopes are encrypted on your device using AES-256-GCM. Our synchronization relay stores encrypted envelopes keyed to your account and devices for authenticated multi-device delivery.
3. Bank Connectivity & Aggregation
With device-direct bank connections, you provide credentials for your own provider account on your native device. The device contacts SimpleFIN, GoCardless or, when enabled, the experimental Meu Pluggy BYOK route directly. Provider credentials and readable bank responses are not sent to Numeris servers. The provider and your bank still process data under their own terms and privacy policies.
For the direct route, credentials are held in device-only secure storage. Background refresh, which starts on when you first connect a bank on a device and can be turned off there, stores a separate credential copy and staging key accessible after the device’s first unlock, without unlocking your ledger. Numeris receives encrypted snapshots and coordination metadata, including timestamps, quotas and opaque connection identifiers. Sign-out and disconnect clear this device’s bank credentials and background grants while preserving encrypted history. Other devices may retain their own credentials; revoke provider authorization separately to stop their access. Numeris cannot remotely erase credentials on a lost device.
Server-mediated Pluggy paths have a different boundary: Numeris processes readable account and transaction data on its backend, with account-scoped access controls and temporary staging. Non-manual staging expires after 48 hours or is acknowledged after a durable device import. These paths are not covered by the direct-route promise that readable bank data stays off Numeris servers.
4. Pre-Launch Waitlist & Communications
If you sign up for our pre-launch waitlist, we collect your email address solely to notify you about launch cohorts, beta invites, and product updates. You may unsubscribe at any time via the link in our emails. We never share your email with advertisers or third-party marketers.
5. Local-Only Device Mode
The Numeris app offers an offline, local device mode that functions without an account, email address, or network connection. The no-account web demo only shows fictional sample data. In the app’s local device mode, zero financial data leaves your phone storage unless you choose to export or share it.
Files you choose to export are plaintext financial data. Complete backups may include provider identifiers used to restore account and transaction reconciliation, but exclude provider authentication secrets and background staging keys. Keep shared files under your control; encrypted relay protection does not apply to those exported copies.
6. App Diagnostics
Production builds of the mobile app, the website and our servers send error reports to Sentry, in its EU region, to help us find crashes and failed operations. A report from the app or website holds a fixed error code, the location in our own code where it happened, the app or browser version, and the operating system and device model. A report from our servers holds the failing service or page route, its status or a fixed error code, and where relevant the location in our own code, with no device or browser details. When the mobile app crashes, the operating system and Sentry's native components also include the crash stack and technical device details such as the OS version and available memory. These reports may be sent even when you use local device mode.
Our code never adds your account identity, email, bank balances, transactions, provider credentials, request or response bodies, cookies, page addresses or navigation parameters to a report, and error messages are discarded before a report is made because they can contain your data. Sentry is configured not to store IP addresses and to remove user, request, device name and locale fields from every report, including native crash reports. We do not record sessions, screens or performance traces, and we use diagnostics to improve reliability, not for advertising.
7. Contact Us
If you have questions or concerns about this privacy policy or our cryptographic architecture, contact our security team at security@numerisapp.com.