Filoah — Privacy Policy

Last Updated: September 24, 2026 (America/New_York)

Working draft for product launch. This Privacy Policy explains how Filoah collects, uses, and shares information. It is not legal advice. Filoah recommends review by a licensed attorney (including CCPA/CPRA counsel) before treating this policy as binding.

Operator: Filoah / [Filoah operating entity] (“Filoah,” “we,” “us,” or “our”).

Privacy / legal contact: hello@filoah.com or hellofiloah@gmail.com

Services covered: Filoah websites and applications, including https://filoah.com/, https://www.filoah.com/, and https://app.filoah.com/ (the “Service”).

Related: Terms of Service (/terms).

1. Who we are

Filoah is a DIY personal-finance planning product for cashflow, net worth, and retirement-style scenarios. We are an educational / planning software provider—not a bank, brokerage, or investment adviser. See our Terms of Service for product disclaimers.

2. Information we collect

We collect information in the following categories. We only collect what we need to operate and improve the Service.

2.1 Account and identity data

When you create or use an account (via Amazon Cognito), we may process:

• Email address, name or display name (if provided), and authentication identifiers;
• Password hashes or federated sign-in tokens managed by Cognito (we do not store your raw password);
• Account status and security settings.

2.2 Planning inputs you provide (“Financial Planning Data”)

Information you enter to build plans and scenarios, such as income, expenses, assets, liabilities, savings rates, goals, ages, and similar assumptions. We do not claim bank or brokerage account linking for core planning unless we later introduce it and update this Policy. You decide what to enter; avoid submitting government ID numbers or account passwords into planning fields or chat.

2.3 Plan chat / AI content

If you use plan chat, we process messages you send, related plan context needed to respond, and model outputs. Processing may occur through Amazon Bedrock (for example Amazon Nova Lite and, when enabled, Anthropic models hosted via Bedrock).

2.4 Billing data (when paid features launch)

If you purchase a subscription, our payment processor (to be named when live) will collect payment details. We typically receive limited billing metadata (plan, status, invoices)—not full card numbers—once a processor is designated. [Flag: name processor in this Policy on the day paid checkout ships.]

2.5 Usage and technical data

• Device/browser type, approximate region derived from network metadata, timestamps, and diagnostic logs;
• Product events needed to operate and debug the app (API errors, feature availability).

2.6 First-party edge analytics (no advertising cookies)

We use Cloudflare Workers Analytics Engine for lightweight first-party telemetry (dataset example: acs_demo_events, event example: signup_completed). As configured for launch, these counters are not tied to advertising cookies or persistent user identifiers for tracking, and we do not use Google Analytics, marketing pixels, session-replay SDKs, or third-party product analytics platforms (such as PostHog) for the Service.

2.7 Communications

Emails and messages you send to us (including via Cloudflare Email Routing for *@filoah.com addresses and Amazon SES for Cognito transactional mail).

2.8 Information we do not intentionally collect

We do not intentionally collect Social Security numbers, full bank account numbers, or government ID images for core planning. Do not upload those into free-text or chat fields.

3. How we use information

We use personal information to:

• Provide, maintain, secure, and improve the Service;
• Authenticate users and prevent fraud or abuse;
• Generate projections and respond to plan-chat requests you initiate;
• Send transactional messages (account verification, security, service notices);
• Analyze aggregate usage via first-party Analytics Engine and operational logs;
• Comply with law and enforce our Terms;
• With your consent where required, send product updates or marketing (you may unsubscribe).

We do not sell your personal information for money. We do not share Financial Planning Data with advertisers. We do not use plan-chat content to train public foundation models for unrelated third parties; Bedrock processing is to provide the feature you request, subject to AWS’s applicable terms and our configuration.

4. How we share information (processors and others)

We share information only as described below.

4.1 Service providers / processors

Processors may access personal information only to perform services for us and under contractual obligations appropriate to their role.

4.2 Legal and safety

We may disclose information if we believe in good faith it is required by law, legal process, or to protect the rights, safety, or security of Filoah, our users, or the public.

4.3 Business transfers

If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy’s commitments unless you agree otherwise.

4.4 With your direction

We may share information when you ask us to (for example, exporting your data to yourself).

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. If that ever changes, we will update this Policy and provide required opt-out mechanisms before doing so.

5. Cookies and similar technologies

Current posture: The Service’s first-party Analytics Engine counters do not rely on advertising cookies or third-party tracking pixels. Essential technologies required to run the site and authenticate you (for example session/auth tokens managed via Cognito and normal browser storage needed for login) may still be used.

Because we are not using third-party advertising cookies or a marketing analytics SDK at this time, we do not require a cookie consent banner for the current telemetry configuration. If we later add non-essential cookies, pixels, or third-party analytics, we will update this Policy and add appropriate notices/controls.

You can control cookies through your browser settings; disabling essential cookies may break sign-in.

6. Retention

We retain personal information for as long as your account is active or as needed to provide the Service, and thereafter as required for legitimate business purposes (security, dispute resolution, legal compliance, backups) or as required by law.

When you delete your account or we permanently close it, we will delete or de-identify Financial Planning Data and plan-chat content from active systems within a reasonable period (target: within 60 days), except where retention is required by law or needed for security, fraud prevention, or dispute resolution. Backup copies expire on a rolling schedule.

7. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including:

• Encryption in transit (HTTPS/TLS) to our Workers and APIs;
• Cloud-provider encryption at rest for data stores we use;
• Access controls and least-privilege practices for operational access;
• Separation of environments where practical.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will investigate and notify you and regulators as required by law.

We do not claim SOC 2 certification for Filoah itself at this stage.

8. Your choices and rights

8.1 Account controls

You may update certain account information through the Service or by contacting us. You may request deletion of your account by emailing hello@filoah.com or hellofiloah@gmail.com (include the email on the account).

8.2 Marketing

Transactional and security emails are necessary for the Service. For optional marketing emails, use the unsubscribe link or contact us.

8.3 California residents (CCPA/CPRA-style rights)

If you are a California resident, you may have the right to:

• Know / access categories and specific pieces of personal information we collected;
• Delete personal information, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of sale or sharing of personal information (we do not sell or share as defined for advertising; we still honor opt-out requests);
• Limit use of sensitive personal information to what is necessary to provide the Service, to the extent applicable;
• Non-discrimination for exercising privacy rights.

To submit a request, email hello@filoah.com or hellofiloah@gmail.com with the subject “Privacy Request.” We will verify your identity (for example via the email on your account) and respond within the time required by law (generally 45 days, with a permitted extension when needed). You may use an authorized agent as permitted by law.

Sensitive personal information. Financial Planning Data you enter may be considered sensitive under some state laws. We use it to provide the Service you request, for security, and to comply with law—not for advertising.

8.4 Other U.S. state privacy laws

Residents of other states with consumer privacy laws may have similar rights to access, delete, correct, or opt out of certain processing. Contact us using the same email addresses; we will process requests consistent with applicable law.

8.5 International users

The Service is U.S.-hosted (AWS regions such as us-east-2 and Cloudflare’s global edge). If you access the Service from outside the United States, you understand your information will be processed in the United States, which may have different data-protection rules than your country. We do not currently market the Service as GDPR-ready for EU/UK residents; if that changes, we will update this Policy.

9. Children’s privacy

The Service is for adults (18+). We do not knowingly collect personal information from children under 18 (or under 13 where that is the applicable COPPA threshold for any incidental website interaction). If we learn we have collected such information, we will delete it. Contact us to report a concern.

10. AI-specific disclosures

• Plan chat may send prompts and necessary plan context to Amazon Bedrock to generate a response.
• Outputs can be wrong. They are not advice (see Terms).
• We configure and use Bedrock to provide the feature; we do not claim your chats train unrelated public models.
• Do not submit secrets (passwords, full account numbers, SSNs) into chat.

11. Third-party links

The Service may link to third-party sites. Their privacy practices are their own. Review their policies before providing information to them.

12. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated Policy and change the “Last Updated” date. For material changes, we will provide additional notice when required (email or in-product). Continued use after the effective date means you acknowledge the updated Policy, except where consent is required by law.

13. Contact

Privacy and data-rights requests:

• hello@filoah.com
• hellofiloah@gmail.com

Please include enough detail for us to locate your account and fulfill the request.

© 2026 Filoah / [Filoah operating entity]. All rights reserved. Working draft — attorney review recommended.