Privacy Policy

Your account. Your email address and password. Sign-in is handled by Supabase, which stores your password as a one-way hash, so nobody (us included) can read it. If you sign in with Google instead, Google tells us your name, email address, and profile picture; we never see your Google password or anything else in your Google account.

What you put in your plan. Bills, paychecks, amounts, dates, notes, rules, what-if scenarios, account nicknames, and starting balances.

A home, if you add one. The address you type, an estimated value (one you enter, or one we look up), and which mortgage account and plan lines you connect to it. Utility lines are only connected so you can see them with the home. They aren’t treated as debt.

Your bank data, if you connect a bank. Accounts connect through Plaid. We receive:

• account names, types, the last four digits of account numbers, and balances;
• up to a year of transactions (date, amount, description, merchant name, and category), plus new ones as they post;
• charges Plaid spots as recurring;
• for credit cards and loans: statement balances, minimum or regular payments, and due dates.

We never receive your bank username or password. You type those into Plaid, not into Ahead.

Billing. If you subscribe, you pay on Stripe’s checkout, and Stripe collects your card details. We get a customer ID, which plan you’re on, and whether your subscription is active. We never see your full card number.

Bill photos. If you have Ahead read a bill from a photo, the photo is sent to an AI model to read the amount and due date. It isn’t saved, by us or by the AI provider.

Abuse prevention. To limit repeated sign-in attempts and heavy use, we count requests by IP address and email. We store those as one-way hashes, not the addresses themselves, and clear them out within about two days.

How Ahead gets used. We count which pages people open, what they click, and moments like signing up, connecting a bank, adding a bill, or subscribing, to learn what works and what to fix. That goes to PostHog, tied to your account’s ID, never your email. It never includes amounts, names, or anything you type: clicks are counted without the words or numbers on the screen. PostHog also sees your IP address and browser, which it uses to estimate a rough location and to tell visitors apart without cookies.

How people find Ahead. Our public pages (imahead.io and its guides) and the sign-in and sign-up pages use Google Analytics to count visits: which pages people open, where they came from (a search, a link), and roughly where they are and what device they’re on. Google Analytics sets cookies (named _ga) to recognize a browser that comes back, and they’re shared between imahead.io and app.imahead.io. It never runs inside the app, so it never sees your plan, your bank data, or anything you type. Google’s advertising features are turned off. You can block it in your browser’s settings or with Google’s opt-out add-on.

Cookies. Inside the app, only the ones Ahead needs to work: your sign-in session, and a few settings like light or dark mode and whether past months are hidden. Our usage counts there work without storing anything in your browser. The public pages and the sign-in pages also carry Google Analytics’ cookies (see “How people find Ahead” above). No advertising cookies anywhere.

Server logs. Like any website, our hosting provider (Vercel) keeps short-lived logs of requests, such as IP address, browser, and the page asked for, for security and fixing problems.

• To run your plan: forecast your balances, find your bills, and check them off as they’re paid.
• To show a home’s value minus its mortgage, when you add one.
• To keep your connected accounts up to date.
• To send the emails your account needs: confirming your address, resetting your password, and telling you when your password changes.
• To bill you, if you subscribe.
• To keep Ahead secure, stop abuse, and fix what breaks.
• To see which parts of Ahead get used and where people get stuck, so we know what to fix and build next.
• To answer you when you write to us.

We don’t sell your data or share it with anyone for their own marketing. We don’t use your financial data for advertising, and we don’t send marketing email.

Some features use AI models: Ask Ahead, what-if scenarios, writing rules from a sentence, reading bills from photos, and sorting charges and payments after your bank syncs. These run only while “Let AI help” is on in Plan settings, and only on plans that include AI or during your free trial. Switch it off and none of your data goes to an AI model.

When they run, we send only what the feature needs, for example:

• a question you ask, and the plan figures needed to answer it (line names, amounts, balances, and dates);
• merchant names, amounts, and dates of charges, to tell bills from one-off spending and match payments to lines;
• a sentence you write for a new rule;
• a bill photo you choose to upload.

These go through Vercel’s AI Gateway, which doesn’t keep them, to AI model providers that have agreed with Vercel not to train on what they’re sent and not to keep it once they’ve answered (known as zero data retention). Ahead only uses providers with that agreement: if none is available, the request fails rather than go anywhere else.

The AI suggests; Ahead’s own code does the math, and the AI can’t move money or reach your bank.

We use a few companies to run Ahead. Each one gets only what its job needs:

• Plaid connects your bank accounts. By connecting, you acknowledge that Plaid’s handling of your data is governed by the Plaid End User Privacy Policy.
• RentCast, when you ask Ahead to look up a home’s value. We send that address and get back an estimate. We ask RentCast not to keep the address in its request logs. We don’t send an address if you type the value yourself, or if that lookup isn’t turned on. See RentCast’s Privacy Policy.
• Stripe handles payments. See Stripe’s Privacy Policy.
• Supabase runs sign-in and hosts our database, in the United States.
• Vercel hosts Ahead and runs the AI Gateway, which doesn’t keep what passes through it.
• PostHog counts how Ahead gets used (see “How Ahead gets used” above), in the United States. See PostHog’s Privacy Policy.
• Google counts visits to our public pages with Google Analytics (see “How people find Ahead” above), with its advertising features off, and signs you in if you choose “Continue with Google”. See Google’s Privacy Policy and how Google uses information from sites that use its services.
• AI model providers, reached through Vercel’s AI Gateway, for the features above. Only ones that have agreed not to train on your data or keep it after answering.

Beyond that, we’ll only share your data if the law requires it, to protect someone’s safety or our legal rights, or as part of a merger or sale of Ahead, in which case this policy keeps applying to your data and we’ll tell you first. No ad networks, no data brokers.

• Every connection, from your browser to our servers and from our servers to the database, Plaid, Stripe, and RentCast, is encrypted in transit.
• The access token that lets Ahead read your bank is encrypted again with AES‑256 before it’s saved.
• Bank access is read-only. Ahead can’t make payments or transfers.
• Your data is only ever shown to your own account.

No system is perfectly secure, so we can’t promise nothing will ever go wrong. If a breach affects your data, we’ll tell you as the law requires.

We keep your data while you have an account. You can delete it yourself, anytime, even if your trial or subscription has ended:

• Disconnect a bank on the Accounts page, and we tell Plaid to cut off our access.
• Erase everything in Plan settings (under Start over), or on the Plan & billing page once your trial is over, disconnects every bank and deletes every account, transaction, rule, and line, right away.
• Delete your account by emailing info@rjmediastudios.com. We’ll delete it within 30 days.

We may keep billing records as long as tax and accounting laws require, and deleted data can linger in backups for a short time until they roll over.

You can see and change almost everything we have about you right in the app. Depending on where you live (for example California, Virginia, Colorado, or Connecticut), you may also have the right to:

• know what personal data we have about you, and get a copy;
• correct it or delete it;
• opt out of the sale or “sharing” of your data for advertising (we don’t do either);
• not be treated differently for using these rights.

To use any of them, email info@rjmediastudios.com from the address on your account. We’ll confirm it’s you and answer within 45 days.

Ahead is for adults 18 and older. We don’t knowingly collect data from anyone younger. If you think a child has made an account, let us know and we’ll delete it.

Ahead is built for people in the United States, and your data is stored in the United States. When AI features are on, the AI model providers that answer may process what they’re sent in other countries.

If we change this policy, we’ll update the date at the top. If a change matters, like collecting something new or using your data in a new way, we’ll email you or tell you in the app before it takes effect.

Questions, requests, or worries: info@rjmediastudios.com. RJ Media Studios Inc. makes Ahead.