Privacy Policy

Effective date: June 24, 2026  ·  Last updated: July 20, 2026

Sprig Finance ("Sprig," "we," "us," or "our") is a personal finance application operated by CoreForge LLC. This Privacy Policy explains what information exists when you use Sprig, and the deliberate design choice behind it: your financial data lives only on your own device, on purpose, and is never stored on any server we operate. It applies to the Sprig Finance iOS app and our website at heysprig.com.

1. Our core privacy principle: your data stays on your device

Sprig does not use accounts, sign-in, or a central database. There is nothing tying your identity to your financial data anywhere but your own device. Your transaction history, account balances, and investment holdings are retrieved from your financial institution through Plaid, delivered to your device, and never written to any server or database we operate, not encrypted, not temporarily, not in any form. The connection credential that lets your device retrieve your data is stored only on your device, in Apple's Keychain, the same secure storage iOS uses for passwords.

2. Information We Collect

Sprig collects no personal profile of any kind: no name, no email address, no sign-in. What exists is limited to:

• An anonymous device identifier: a random value generated on your device and stored in its Keychain, used only so our systems can apply basic rate-limiting and are not tied to your identity, your bank, or any data.
• Bank connection credentials: when you link a financial institution, Plaid provides a connection credential that lets your device retrieve your data. This is stored only on your device and is never written to any server we operate.
• Transaction, balance, and holdings data: retrieved from your institution through Plaid and delivered to your device. This data passes through our backend relay for the length of a single request so it can reach your device, and is never written down or retained anywhere along the way.
• Data you enter on your device: manual transactions, memos, renamed merchants, categories, and other customizations are stored only on your device.
• Data you choose to move yourself: if you export your customizations to share between your own devices (for example, via AirDrop), that is your own action on your own device. Sprig does not operate, receive, or store that transfer in any way.

3. How We Use Your Information

• Relay your transactions, balances, and holdings from your financial institution to your device when you open the app
• Apply basic abuse/rate limiting so our systems aren't overwhelmed by any single device
• Manage your subscription (if applicable), through Apple's own billing system

We do not sell, rent, or share your personal or financial data with any third party for advertising or marketing purposes. We could not sell what we do not have.

4. Plaid and Financial Data

Sprig uses Plaid Technologies, Inc. to connect to your financial institutions. When you link an account, your bank credentials are entered directly with your bank through Plaid's secure interface. Sprig never sees or stores your banking username or password.

We use Plaid to gather data from your financial accounts. By connecting a bank account in Sprig, you also agree to Plaid's End User Privacy Policy, available at plaid.com/legal/end-user-privacy-policy. Plaid's collection and use of your data is governed by Plaid's privacy policies at plaid.com/legal.

5. Data Storage and Security

We do not operate a database of user financial data. The only server-side component is a lightweight relay that, at your device's request, retrieves your data from Plaid and passes it straight back to you. It does not write your financial data to disk or memory beyond the single request that delivers it to you. The only information our relay retains at all is limited, non-financial technical data needed to operate the service (for example, a temporary flag used to avoid unnecessary repeat requests to Plaid, and, if you enable notifications in a future version, an address used only to send a content-free "check for updates" signal to your device, which cannot be used to read or access anything).

We maintain a written information security program in accordance with the FTC Safeguards Rule, with a Qualified Individual internally designated to oversee it. For any security concern, contact us at the mailing address below.

6. Data Retention and Deletion

Because we do not store your financial data on any server, there is nothing to retain or delete on our end when you disconnect a bank or delete the app. Deleting the app from your device removes everything, immediately and completely, since your device was the only place any of it ever lived. When you disconnect a linked institution or delete your data from within the app, we also tell Plaid to release that connection, which stops any further access to that account. Full detail is available in our Data Retention and Disposal Policy.

7. Third-Party Services

Sprig relies on the following service providers to operate:

• Plaid Technologies, Inc.: secure connection to your financial institutions
• Cloudflare, Inc.: hosts the lightweight relay described in Section 5, which retrieves your data from Plaid on request and does not store it
• Apple Inc.: subscription billing (if applicable) and, in a future version, delivery of a content-free notification signal, as described in Section 5

Each provider is bound by its own privacy policy and data processing terms. We do not sell your data to any of them.

8. Children's Privacy

Sprig is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes with an in-app notice. Since Sprig does not collect an email address, we are not able to notify you by email. Your continued use of Sprig after changes are posted constitutes acceptance of the updated policy.

10. Contact Us

If you have questions about this Privacy Policy or your personal data, contact us by mail:

CoreForge LLC
30 N Gould St #N
Sheridan, WY 82801