Privacy Policy

Effective date: June 24, 2026  ·  Last updated: August 23, 2026

Sprig Finance ("Sprig," "we," "us," or "our") is a personal finance application operated by CoreForge LLC. This Privacy Policy explains what information exists when you use Sprig, and the deliberate design choice behind it: your financial data lives on your own device and in your own iCloud account, on purpose, and is never stored on any server we operate. It applies to the Sprig Finance iOS app and our website at heysprig.com.

1. Our core privacy principle: your data stays with you

Sprig does not use accounts, sign-in, or a central database. Your transaction history, account balances, and investment holdings are retrieved from your financial institution through Plaid, delivered to your device, and never written to any server or database we operate, not encrypted, not temporarily, not in any form.

Your data is kept in two places, and both of them are yours:

• On your device. The app saves your data on your iPhone or iPad so it is there when you open it.
• In your own iCloud account. Sprig keeps a copy in the iCloud storage that belongs to your Apple Account, so your data can move between your own devices. It is not in an account we control.

We do not receive either one. Sprig runs no server that holds your financial data, so there is no copy of it on our side to lose. The connection credential that lets your device retrieve your data is stored only on your device, in Apple's Keychain, the same secure storage iOS uses for passwords. It is not stored on our backend in any form.

2. Information We Collect

Sprig collects no personal profile of any kind: no name, no email address, no sign-in. What exists is limited to:

• An anonymous device identifier: a random value generated on your device and stored in its Keychain, used only so our systems can apply basic rate-limiting and are not tied to your identity, your bank, or any data.
• Bank connection credentials: when you link a financial institution, Plaid provides a connection credential that lets your device retrieve your data. This is stored only on your device and is never written to any server we operate.
• Transaction, balance, and holdings data: retrieved from your institution through Plaid and delivered to your device. This data passes through our backend relay for the length of a single request so it can reach your device, and is never written down or retained anywhere along the way.
• Data you enter on your device: manual transactions, memos, renamed merchants, categories, and other customizations are stored on your device and copied to your own iCloud account, as described in Section 1. None of it is stored on any server we operate.
• Data you choose to move yourself: if you export your customizations to share between your own devices (for example, via AirDrop), that is your own action on your own device. Sprig does not operate, receive, or store that transfer in any way.

3. How We Use Your Information

• Relay your transactions, balances, and holdings from your financial institution to your device when you open the app
• Apply basic abuse/rate limiting so our systems aren't overwhelmed by any single device
• Manage your subscription (if applicable), through Apple's own billing system

We do not sell, rent, or share your personal or financial data with any third party for advertising or marketing purposes. We could not sell what we do not have.

4. Plaid and Financial Data

Sprig uses Plaid Technologies, Inc. to connect to your financial institutions. When you link an account, your bank credentials are entered directly with your bank through Plaid's secure interface. Sprig never sees or stores your banking username or password.

We use Plaid to gather data from your financial accounts. By connecting a bank account in Sprig, you also agree to Plaid's End User Privacy Policy, available at plaid.com/legal/end-user-privacy-policy. Plaid's collection and use of your data is governed by Plaid's privacy policies at plaid.com/legal.

5. Data Storage and Security

We do not operate a database of user financial data. The only server-side component is a lightweight relay that, at your device's request, retrieves your data from Plaid and passes it straight back to you. It does not write your financial data to disk or memory beyond the single request that delivers it to you. The only information our relay retains at all is limited, non-financial technical data needed to operate the service. That is: short-lived records of when your bank last responded and when Plaid last contacted us, which expire on their own within 30 days; a briefly cached note of whether a bank is having a known outage, which describes the bank and not you; and, if you turn on notifications, an address used only to send a content-free "check for updates" signal to your device, which cannot be used to read or access anything. Your bank connection credential is not among them. It stays on your device.

We maintain a written information security program in accordance with the FTC Safeguards Rule, with a Qualified Individual internally designated to oversee it. For any security concern, contact us at the mailing address below.

6. Data Retention and Deletion

Because we do not store your financial data on any server, there is nothing to retain or delete on our end when you disconnect a bank or delete the app. When you disconnect a linked institution or delete your data from within the app, we also tell Plaid to release that connection, which stops any further access to that account.

Deleting the app does not delete everything. It removes the copy on your device. It does not remove the copy in your own iCloud account, since that copy is under your Apple Account, not ours, and only you can remove it. To remove all of your Sprig data, delete the app from your device, then open Settings, tap your name, tap iCloud, then Manage Account Storage, find Sprig in the list, and delete its data there. Full detail is available in our Data Retention and Disposal Policy.

7. Third-Party Services

Sprig relies on the following service providers to operate:

• Plaid Technologies, Inc.: secure connection to your financial institutions
• Cloudflare, Inc.: hosts the lightweight relay described in Section 5, which retrieves your data from Plaid on request and does not store it
• Apple Inc.: subscription billing (if applicable), delivery of a content-free notification signal as described in Section 5, and storage of the copy held in your own iCloud account as described in Section 1

Each provider is bound by its own privacy policy and data processing terms. We do not sell your data to any of them.

8. Children's Privacy

Sprig is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes with an in-app notice. Since Sprig does not collect an email address, we are not able to notify you by email. Your continued use of Sprig after changes are posted constitutes acceptance of the updated policy.

10. Contact Us

If you have questions about this Privacy Policy or your personal data, reach us through our Contact page, or by mail:

CoreForge LLC
30 N Gould St #N
Sheridan, WY 82801