Wilco Simple Plan — Privacy Policy

Effective date: 2026-08-08 Version: 1.1 Operator: Wilco Financial, LLC ("Wilco", "we", "us", "our") Contact: jgillett@wilcofin.com

This policy describes how Wilco collects, uses, shares, and protects information when you use the Wilco Simple Plan application — accessible on the web at wilcosimpleplan.com and as the Wilco Simple Plan iOS application distributed through the Apple App Store.

We treat the privacy of your personal and financial information as a foundational responsibility, not a compliance afterthought.

1. Information we collect

1.1 Information you provide directly

When you create an account or use the application, you provide:

Account credentials: email address, name, and a password (which we store as a one-way bcrypt hash; the cleartext password is never persisted).
Optional two-factor authentication: if you enable it, an encrypted authenticator-app secret. Recovery codes are stored as one-way bcrypt hashes.
Plan data: financial assumptions, projections, goals, notes, and other content you create inside the application. Any plan-data we store is encrypted at rest with AES-256-GCM using a key derived per-tenant; we cannot read it without your tenant identifier.
Account, income, expense, asset, and liability records you enter manually.

1.2 Statements you upload, photograph, or email in

To save you retyping, you can hand a statement to the application in three ways: upload a file or photo in the assistant, or email it to our statements address. In each case:

We read the figures out of it — balances, account names, income and expense amounts — and present them to you (or to your advisor) as a proposed list of changes.
We do not keep the document. The file is held only for the moment it takes to read it, and is never written to our database or file storage. Emailed attachments stay with our email provider and are fetched over a short-lived link at the moment they are read.
Nothing is entered into your plan automatically. A person reviews the proposed changes and chooses whether to apply them.

See § 2.1 for how the reading is done and who is involved.

1.3 Information collected automatically

Application logs: timestamps, IP address, user-agent string, and the URL path of requests you make to our servers. Used for security monitoring and operational diagnostics.
Audit log entries: authentication events (login successes/failures, password changes, two-factor events, password resets) and data-export events. Retained per § 7.

1.4 We do not knowingly collect

Your bank login credentials. The application has no bank connection: every figure in it is one you, or your advisor, entered or approved.
Social Security numbers, government-issued ID numbers, or biometric identifiers.
Information from children under 13. The application is not directed to children, and we do not knowingly collect children's data. If you believe a child has registered, contact us at the email above and we will delete the account.

2. How we use your information

We use the information described in § 1 for the following purposes only:

To provide the service: authenticate you, render your plan, project your finances, and display data you choose to view.
To read statements you choose to send us, so the figures can be proposed for entry rather than typed by hand (§ 2.1).
To communicate with you: send transactional emails for password resets and security notifications. We do not send marketing emails.
For security and fraud prevention: rate-limit abusive activity, detect compromised accounts, audit access events.
To meet legal obligations: respond to lawful requests from authorities; comply with applicable regulations.

We do not:

Sell your information to third parties.
Share your information with advertisers.
Use your data to train machine-learning models.
Use your data for purposes other than those listed above.

2.1 How we use AI

Parts of the application are powered by Claude, an AI service operated by Anthropic. It is used for three things: helping you enter your information by conversation, reading figures out of statements you send in, and drafting the written reviews your advisor gives you.

What that means in practice:

Your information is sent to Anthropic to be processed, and nothing more. Under Anthropic's published commercial terms, data submitted through its business API is not used to train its models.
One household at a time. Each request contains only your own information. There is no request that spans more than one household, and the AI has no ability to look across our client base.
The AI cannot change your plan. Everything it produces is a proposal that a person has to review and apply. There is no path by which the AI writes to your records on its own.
Your documents are not retained — see § 1.2.
Nothing an advisor's AI drafts reaches you until they approve it. Draft reviews are visible only to your advisor until they have read, revised and published them.
If your advisor emails a statement in on your behalf, it is not read by anything until your advisor confirms which household it belongs to. A matching email address alone is not treated as proof.

If you would prefer not to use the AI features, simply enter your information directly in the application — every field the assistant can fill is editable by hand, and nothing is sent to Anthropic unless you use one of the three features above.

3. Who we share information with

We share your information only with the service providers we use to operate the application, and only the minimum necessary for them to perform their function. These providers are:

Provider	Purpose	Data shared
Vercel	Application hosting and serverless runtime	All application traffic (encrypted at rest at Vercel)
Neon	Managed PostgreSQL database	All persisted application data (encrypted at rest by Neon)
Upstash	Managed Redis (rate-limit counters)	Hashed identifiers used for rate limiting (no plan or financial data)
Resend	Transactional email delivery, and receipt of statements you email in	Email address and message body of transactional emails (e.g., password reset); any statement you send to our statements address, held per that provider's retention window
Anthropic	AI processing for conversational data entry, statement reading, and report drafting (§ 2.1)	The information for the single household being worked on, and the contents of any statement you choose to send. Not used to train models under Anthropic's commercial terms
Apple	iOS application distribution	Whatever Apple collects from App Store users (subject to Apple's published privacy practices)

Each of these providers is bound by an agreement that restricts their use of your data to performing the contracted service. They do not own, sell, or independently use your data.

We may also disclose information when legally compelled (subpoena, court order, regulatory request). We will, where lawful, give you advance notice if your data is the subject of such a request.

4. How we protect your information

Detailed technical practices are documented in our Information Security Policy (available on request). Highlights:

Encryption in transit: all traffic between your browser/app and our servers uses TLS 1.2 or better. HTTP requests are redirected to HTTPS.
Encryption at rest: all data is stored in databases and storage that are encrypted at rest by our hosting providers using AES-256. The most sensitive items (your plan data and your two-factor secret) are additionally encrypted at the application layer with per-tenant or per-user keys.
No document store: we deliberately do not keep copies of the statements you send us (§ 1.2). Documents we never hold cannot be lost, leaked, or subpoenaed from us.
Authentication: passwords are hashed with bcrypt at a high work factor; two-factor authentication is available; new account creation is gated by an admin approval step.
Access control: every database query is scoped to the tenant of the authenticated user; cross-tenant access is structurally prevented.
Audit logging: authentication and significant data events are logged and retained.
Rate limiting: automated abuse is throttled at multiple layers.

No system can guarantee absolute security. If we ever experience an incident affecting your data, we will notify affected users via email within 72 hours of confirmation, with a description of what occurred, what data was involved, and what you should do.

5. Your rights

You may at any time:

Access the personal information we hold about you. The application surfaces most of it directly. For a complete export in machine-readable form, email us.
Correct information that is inaccurate. Most fields are editable directly in the application; for those that are not, email us.
Delete your account and all data associated with it. Email us; we honor verified deletion requests within 30 days. Some records (e.g., audit log entries pertaining to authentication) may be retained for the period required by applicable law and security practice.
Export your data in a portable format. Email us; we will deliver a JSON archive of your records.
Decline the AI features at any time, by entering your information directly instead of using the assistant, uploads, or the statements address (§ 2.1).
Control what your advisor can see. If your account is managed by an advisor, Settings → Advisor sharing lets you switch off their access to your financial detail at any time. The change takes effect immediately and your advisor cannot switch it back on.
Withdraw consent at any time. Cancellation is processed by deleting your account.

To exercise any of these rights, email jgillett@wilcofin.com with a description of your request. We will verify your identity (typically by sending a confirmation email to the address on file) before acting on the request.

5.1 California residents (CCPA / CPRA)

If you are a California resident, the rights described above satisfy California's "Right to Know," "Right to Delete," "Right to Correct," "Right to Opt Out of Sale," and "Right to Limit Use of Sensitive Information." We do not sell your information to anyone, so the "opt out of sale" right is satisfied by default.

5.2 Residents of other jurisdictions

If you reside in a jurisdiction with comprehensive privacy law (e.g., GDPR for the EU/EEA/UK; PIPEDA for Canada; LGPD for Brazil), the rights described above are intended to satisfy applicable equivalents. If you require an article-by-article mapping for compliance purposes, contact us.

6. Geographic scope

The application is currently offered to users in the United States. Data is processed in the United States by our service providers. If you access the application from outside the United States, you consent to your information being transferred to and processed in the United States.

7. Retention

Category	Retention
Account record (user, email, password hash)	Retained while your account is active; deleted within 30 days of a verified deletion request.
Plan data, accounts, income and expense records	Retained while your account is active; deleted within 30 days of a verified deletion request.
Statements you upload, photograph, or email in	Not retained. Read once and discarded; only the figures extracted from them are kept, alongside the record of who sent what and when.
Proposed changes from the assistant, and reports your advisor has drafted or published	Retained while your account is active; deleted within 30 days of a verified deletion request.
Audit log entries pertaining to authentication	Retained indefinitely by default; subject to deletion on a verified user request.
Backup snapshots (database)	Retained for the rolling window provided by our database vendor (currently 7 days). After deletion, residual data in backups expires within that window.

8. Cookies and similar technologies

The web application uses a single first-party session cookie to maintain your signed-in state. This cookie is httpOnly, Secure, and SameSite=Lax — it cannot be read by JavaScript and is not transmitted on cross-site requests. We do not set advertising or tracking cookies, and we do not use third-party analytics that track you across sites.

The iOS application stores its session token in iOS Keychain (expo-secure-store) and re-prompts for biometric authentication on cold start.

9. Children's privacy

The application is not directed to, and we do not knowingly collect information from, children under 13. If you are a parent or guardian and believe your child has provided information to us, contact jgillett@wilcofin.com and we will delete the account and its data.

10. Changes to this policy

We may update this policy as the application or applicable law evolves. Material changes will be communicated to active users by email at least 30 days before the change takes effect, and the Effective date at the top of this policy will be updated. The previous version will remain accessible on request.

11. How to contact us

For any privacy-related question, request, or concern:

Wilco Financial, LLC Attn: Jon Gillett, Founder jgillett@wilcofin.com

We will acknowledge your message within one business day and substantively respond within 30 days for most requests, sooner where possible.