Privacy Policy

Effective date: June 24, 2026 · Last updated: October 12, 2026

Sprig ("we," "us," or "our") is a personal finance application operated by CoreForge LLC. This Privacy Policy explains what information exists when you use Sprig, and the deliberate design choice behind it: your financial data lives on your own device and in your own iCloud account. Some information, listed in Section 2, passes through or is kept on our server. It applies to the Sprig iOS app and our website at heysprig.com.

1. Our core privacy principle: your data stays with you

Your transaction history, account balances, and investment holdings are retrieved from your financial institution through Plaid and delivered to your device through our server.

Your data is kept in two places, and both of them are yours:

• On your device. The app saves your data on your iPhone or iPad so it is there when you open it.
• In your own iCloud account. Sprig keeps a copy in the iCloud storage that belongs to your Apple Account, so your data can move between your own devices. It is not in an account we control.

We do not control your iCloud account. The connection credential that lets your device retrieve your data is kept in Apple's Keychain. It syncs between your own devices through iCloud Keychain, so a second iPhone or iPad signed in to your Apple Account can use the same bank connection. If you turn off iCloud Keychain, the credential stays on the device where you linked the bank.

2. Information We Collect

The Sprig app collects no name, no email address, and no password, and has no sign-in. What exists is limited to:

• Contact form on heysprig.com: if you write to us through the website, we receive the email address and message you type. They are delivered to our support inbox through the form provider Web3Forms and used only to answer you. The website does not use advertising or analytics cookies.
• Bank connection credential: when you link a bank, Plaid gives your device a credential that lets it retrieve your data. It is kept in your Keychain and syncs through your iCloud Keychain, as described in Section 1.
• Notification token per bank connection: if you allow notifications, our server keeps the notification address Apple gives your device, filed under the bank connection it belongs to. It is used only to send a content-free "check for updates" signal, and it cannot be used to read anything. It is deleted when you disconnect the bank.
• Random device identifier: a random value made on your device and stored in its Keychain. It is sent with requests so we can apply basic rate limits. It is not tied to your name, your bank, or any of your data.
• Subscription identifier (subscribers only): to know whether a subscription is active, our server checks Apple's records and keeps a scrambled, one-way hash of your Apple subscription number, plus whether the subscription is active. We do not keep the Apple number itself, and the hash cannot be turned back into it.
• Plaid user ID: Plaid assigns your subscription an opaque user ID. Our server keeps it so your bank connections can be grouped and released by Plaid if your subscription ends. It does not contain your name or any personal detail.
• Transaction, balance, and holdings data: retrieved from your institution through Plaid and delivered to your device. This data passes through our server on its way to your device.
• Data you enter on your device: manual transactions, memos, renamed merchants, categories, and other customizations are stored on your device and copied to your own iCloud account, as described in Section 1. None of it is stored on any server we operate.
• Device name in your iCloud: the name of your device is saved in your own iCloud storage so the app can show which of your devices made a change. We cannot read your iCloud storage.
• Face ID or passcode lock: if you turn on the app lock, the check is done by iOS on your device. Sprig does not receive your biometric data.
• Data you choose to move yourself: if you export a backup or your data (for example, via AirDrop or a file), the export file is created on your device and you decide where it goes. Backup files are encrypted by the app, that is your own action on your own device. Sprig does not receive or store that transfer.

3. How We Use Your Information

• Relay your transactions, balances, and holdings from your financial institution to your device when you open the app
• Apply basic abuse/rate limiting so our systems aren't overwhelmed by any single device
• Send a content-free "check for updates" notification when a bank has new activity or needs your attention
• Confirm whether your subscription is active, and release your bank connections with Plaid if it ends
• Manage your subscription through Apple's own billing system

We do not sell, rent, or share your personal or financial data with any third party for advertising or marketing purposes.

Sprig contains no advertising, no analytics, and no crash-reporting tools, and it does not track you across other companies' apps or websites. The privacy details we give Apple for the App Store listing are Other Financial Info, User ID, Device ID and Purchase History, all used only for app functionality and never for tracking.

4. Plaid and Financial Data

Sprig uses Plaid Technologies, Inc. to connect to your financial institutions. When you link an account, your bank credentials are entered directly with your bank through Plaid's interface. Sprig never sees or stores your banking username or password.

We use Plaid to gather data from your financial accounts. By connecting a bank account in Sprig, you also agree to Plaid's End User Privacy Policy, available at plaid.com/legal/end-user-privacy-policy. Plaid's collection and use of your data is governed by Plaid's privacy policies at plaid.com/legal.

5. Data Storage and Security

Our server retrieves your data from Plaid at your device's request and passes it back to you. The information our server keeps to operate the service includes: short-lived records of when your bank last responded and when Plaid last contacted us, which expire on their own within 30 days; a briefly cached note of whether a bank is having a known outage, which describes the bank and not you; if you turn on notifications, a notification address for each bank connection, used only to send a content-free "check for updates" signal to your device; and, for subscribers, the hashed subscription identifier and Plaid user ID described in Section 2.

For any security concern, contact us at the mailing address below.

6. Data Retention and Deletion

Disconnecting a bank deletes its notification address from our server. When you disconnect a linked institution or delete your data from within the app, we also tell Plaid to release that connection, which stops any further access to that account.

Deleting the app does not delete everything. It removes the copy on your device. It does not remove the copy in your own iCloud account, since that copy is under your Apple Account, not ours, and only you can remove it. To remove all of your Sprig data, delete the app from your device, then open Settings, tap your name, tap iCloud, then Manage Account Storage, find Sprig in the list, and delete its data there. Full detail is available in our Data Retention and Disposal Policy.

7. Third-Party Services

Sprig relies on the following service providers to operate:

• Plaid Technologies, Inc.: connection to your financial institutions
• Cloudflare, Inc.: hosts the server described in Section 5, which retrieves your data from Plaid on request
• Apple Inc.: subscription billing, iCloud Keychain syncing of your bank connection credential between your devices, delivery of a content-free notification signal, and storage of the copy held in your own iCloud account as described in Section 1

Each provider is bound by its own privacy policy and data processing terms. We do not sell your data to any of them.

8. Children's Privacy

Sprig is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes with an in-app notice. Since Sprig does not collect an email address, we are not able to notify you by email. Your continued use of Sprig after changes are posted constitutes acceptance of the updated policy.

10. Contact Us

If you have questions about this Privacy Policy or your personal data, contact us through our contact page, or by mail:

CoreForge LLC
30 N Gould St #N
Sheridan, WY 82801