Effective: October 18, 2026
Previous version: October 15, 2026
What changed in this version
Don is operated by vector.dev LLC ("Company," "we," "us," or "our"), a California limited liability company. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use Don, including our setup page at don.financial/start and our iOS app on the Apple App Store (collectively, the "Service").
If you are a Don customer, our Privacy Notice also summarizes, in the format set by federal law, what personal information we share and why. This Privacy Policy gives the full detail.
When you create an account, we collect your email address or phone number for authentication via one-time passcode (OTP) sent by email or SMS.
When you connect your bank accounts through Plaid, we receive access to your account balances, transaction history, and account metadata. This data is used to power your personal finance dashboard, spending insights, and transaction categorization.
When you use Don's AI features (the conversational assistant), your transaction data and chat messages are processed by Anthropic's AI models via their API. We send only the data necessary to fulfill your request. Anthropic does not use data submitted via their API to train their AI models.
We automatically collect information about how you interact with the Service, including pages visited, features used, and device information such as browser type, operating system, and device model. In the iOS app, this may include app version, OS version, and crash reports collected by Apple. We do not use session replay or screen recording technology.
If you visit our setup page from one of our ad campaigns, we record which campaign brought you, and Google's ad-measurement tag may record that you started setup. Both are described in Section 4 under “Ad Measurement on Our Setup Page” and “Campaign Attribution”, and both are off if you opt out or your browser sends a Global Privacy Control signal.
Our setup page uses a session cookie to keep you signed in, and a first-party cookie to remember if you opted out with Your Privacy Choices. We do not use analytics pixels or third-party tracking or advertising cookies, with one exception: for US visitors who have not opted out, Google's ad-measurement tag loads on the welcome screen of don.financial/start when you tap the button that starts setup, and it may set Google's own click cookies in your browser (see Section 4). No ad tag runs anywhere else in the Service. The iOS app uses secure on-device storage (Keychain) to store your authentication token.
We use your information to:
Don may use AI to categorize transactions, generate spending insights, or respond to your questions, but these functions supplement your own financial decisions. We do not make automated decisions that affect your legal rights or financial standing.
We use the following third-party services to operate Don:
If you choose to connect Don to an external assistant such as ChatGPT or Claude, Don shares financial information with that assistant provider to answer your requests. You approve the connection and choose the personal accounts to share in Don. The connection can read balances and spending summaries for those accounts. Transaction details, including merchant names, dates, categories and amounts, require a separate optional permission. Sharing budgets and recurring bills is also optional and covers your personal planning records across all accounts, including accounts you did not select for balance or transaction access.
Hidden accounts and household members' accounts are excluded from account and transaction access. New accounts are not automatically added. These connections are read-only: they cannot move money, trade, or change your transactions or budgets.
Information received by the assistant provider is governed by that provider's terms, privacy policy and your account settings, including its retention and model-training settings. The statements above about Don's use of Anthropic's API do not describe how an external assistant account handles information you choose to share with it.
You can disconnect an assistant in Don under Settings → AI connections. Disconnecting stops future access through that connection; it does not delete information already received by the provider or saved in your conversations.
We use Google ad measurement to see which of our ads bring people to Don. It runs in one place only: the welcome screen of our setup page, don.financial/start. It runs only for visitors we locate in the United States, using the approximate country our hosting provider derives from your IP address; if the country cannot be determined, we treat you as outside the US and nothing loads.
Nothing from Google loads when the page opens. Google's ad-measurement tag loads only when you tap the button that starts setup, and a notice next to that button tells you so. The tag then sends Google a single “signup started” event, with no value attached. With that event, Google's tag sends Google: the setup page address (don.financial/start) with only the ad click identifier Google itself added to the link, if you came from a Google ad (we remove our own campaign parameters from the address before the tag loads); the page's title; a random identifier for that one event; the information any browser sends, such as your IP address and browser type; device and browser details the tag reads from your browser, such as screen size, operating system and version, browser version and device model; and Google's own first-party click cookies, which the tag may also read or set. The tag also sends Google a technical diagnostics request about how the tag itself loaded. None of this includes your name, email address, phone number, account ID or any financial data.
Right after that event, and before we ask for your email address or phone number, setup continues on a separate page where no ad tag runs. Nothing you enter or do from that point on, and nothing after you create an account or connect a bank, is sent to Google or any other ad platform. We never send any advertiser your name, email address, phone number, account ID or any financial data.
The tag runs with Google's restricted data processing and ads data redaction turned on. We do not use Google's remarketing, audiences, ad personalization, “enhanced conversions” or Google Analytics.
The tag never loads if you have opted out with Your Privacy Choices or your browser sends a Global Privacy Control signal (see below), if you are outside the US, or if you are already signed in to Don in that browser.
Our ad links carry a campaign tag that names which of our campaigns the link belongs to. For every signup that starts on don.financial/start, Don stores that campaign tag with your new Don account, unless you have opted out with Your Privacy Choices or your browser sends a Global Privacy Control signal. Don also stores the ad click identifier from the link, but only when ad measurement was allowed for your visit: you were in the US, your browser sent no Global Privacy Control signal, and you had not opted out. We use these to count how many people from each campaign create an account and go on to use Don.
We keep the campaign tag and the ad click identifier for about 45 days, and then remove them from your account. After that we keep only aggregate daily counts, which do not identify you.
Neither the campaign tag nor the stored click identifier ever leaves Don. The one exception is the ad measurement described above: Google receives the ad click identifier it issued itself, together with the setup page address (don.financial/start). Before Google's tag loads, we remove our campaign parameters from the page address, so Google never receives the campaign tag.
You can opt out of ad measurement and campaign attribution at any time with Your Privacy Choices. The link appears next to the start button on our setup page, in this policy and in our site footer. When you opt out, we confirm it on screen and save your choice in a first-party cookie in your browser; once you sign in, we also record it on your Don account so it follows your account rather than only that browser. From then on Google's tag does not load and we do not record campaign attribution for you. Our servers check your choice too, not just the page.
We treat a Global Privacy Control (GPC) signal from your browser as the same opt-out, automatically and before anything loads. You do not need to do anything else. We honor both for visitors in every US state.
You can also opt out by emailing hello@don.financial. Opting out does not affect your setup, your reports or your subscription. If you clear your cookies while signed out, the opt-out saved in that browser is lost; signing in or using GPC keeps it in place.
We do not sell your personal or financial data. We do not share your financial data with third parties for their marketing purposes, and we do not share information about our customers with advertisers. Your data is shared with the third-party services listed above as necessary to operate the Service, and with connected assistant providers when you choose to authorize that sharing as described above. The only information that reaches an ad platform is the setup-page ad measurement described in Section 4, which happens before you give us any contact details and which you can opt out of.
We may create aggregated, de-identified data from your usage for product improvement and analytics. This data cannot be used to identify you and is not considered personal information.
We retain your data for as long as your account is active. If you delete your account, your financial data (transactions, bank connections, categories, budgets, and goals) is permanently deleted immediately. We retain your email address and subscription record to prevent trial abuse and to allow you to re-register in the future. Some data may be retained longer if required by law or for legitimate business purposes (e.g., fraud prevention, billing records). Non-financial data such as usage analytics and server logs are retained for up to 12 months after account deletion, after which they are permanently deleted.
Campaign attribution (the campaign tag and ad click identifier linked to your account) is kept for about 45 days and then removed, as described in Section 4; only aggregate daily counts that do not identify you are kept longer. Google keeps the ad-measurement data it receives under its own policies.
We implement industry-standard and above security measures to protect your data, including:
However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.
In the event of a data breach that compromises your personal or financial data, we will notify affected users via email within 72 hours of becoming aware of the breach. We will also notify any applicable regulatory authorities as required by law.
If you are a California resident, you have the right under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) to:
Our ad measurement on don.financial/start may count as “sharing” personal information for cross-context behavioral advertising under California law, even though we use it only to measure our own ads and Google receives it under restricted data processing. The categories of personal information involved are identifiers (your IP address, the ad click identifier and Google's cookie identifiers) and internet or other electronic network activity (that you tapped the button that starts setup after arriving from an ad). We share them with Google, for the purpose of measuring which of our ads bring people to Don. We do not share your name, email address, phone number, account information or financial data, and nothing after you begin entering your contact details is shared. We do not knowingly sell or share the personal information of anyone under 16.
To exercise these rights, contact us at hello@don.financial. We will respond to verifiable requests within 45 days.
We recognize and honor Global Privacy Control (GPC) opt-out preference signals sent by your browser, as described in Section 4.
If you are a resident of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), or another US state with an active consumer privacy law, you may have rights including:
To exercise these rights, contact us at hello@don.financial. We will respond within the timeframe required by your state's law.
If you are located in the European Economic Area (EEA) or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR):
We process your data based on the following legal grounds:
We do not run ad measurement or campaign attribution for visitors outside the United States.
Your data is stored and processed in the United States. If you are located outside the United States, your data is transferred to the US where our servers and third-party service providers are located. We rely on Standard Contractual Clauses (SCCs) and other approved transfer mechanisms to ensure your data is protected in accordance with applicable data protection laws.
To exercise your GDPR rights, contact us at hello@don.financial. You also have the right to lodge a complaint with your local data protection authority.
The Service is not intended for children under 18. We do not knowingly collect personal information from children under 18. If you believe we have collected information from a child under 18, please contact us at hello@don.financial and we will promptly delete it.
We may update this Privacy Policy from time to time. For material changes, we will notify you via email at least 30 days before the changes take effect. We will also post the updated policy on this page and update the effective date. If a change applies only prospectively, to visitors and information from its effective date and not to information we already hold, we may instead post the updated policy here with a summary of what changed, as we did for this version. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy, your data, or wish to exercise any of your privacy rights, contact us at:
vector.dev LLC
455 Market St Ste 1940 PMB 109992, San Francisco, CA 94105-2448
Email: hello@don.financial
See also our Privacy Notice and Your Privacy Choices.