Get Ray

Legal

Privacy Policy

How we collect, use, share, and protect your data

Effective date: October 28, 2026. Last updated: October 28, 2026.

Operated by Sunflower Studios. Contact us in the Ray app under You → Legal & support → Contact us.

This Privacy Policy explains what personal information Ray ("we", "us", or "Ray") collects, why we collect it, how we use and share it, how long we keep it, and the choices you have. Ray is operated by Sunflower Studios (sunflower.builders). It applies to the website and app at https://ray.sunflower.builders and related APIs (together, the "Platform").

Ray is a personal money buddy: Plan (budgets and what's left), Talk (questions about your money), and a clear picture of balances, spending, and bills. To use the core product you create an account and connect bank accounts so we can work from live balances and transactions. Undefined terms have the same meaning as in our Terms of Use.

1. Summary of data collection and usage

In short:

  • We collect account information (email, name, password or Google account identity), multi-factor authentication status, and settings you enter (income, budget preferences, and similar).
  • We collect financial account data you authorize through Plaid (balances, account metadata, and transaction history) so we can classify spend and power Plan and Talk.
  • We use that data only to operate Ray for you: authenticate you, sync banks, show Plan and activity, answer Talk questions, and support the product (including related math such as spending rate or how long your money lasts, where shown).
  • Talk uses a third-party AI provider. When you use Talk, we send that provider your message and the money context needed to answer it (for example relevant balances, spending, and bills). Money totals are computed on our servers first. Our AI provider does not use this data to train its models. Using Talk is optional, and using it means you agree to this sharing (see section 2.5).
  • We do not sell your personal information. We do not use your bank data for advertising. Staff do not browse your Talk or transactions in the ordinary course of support.
  • You can disconnect banks and update settings in the app, and delete your account any time in the app under You → Privacy & security → Delete account.

2. Personal information we collect

2.1 Information you provide

  • Account and profile: email address, display name, and related profile fields you choose to save.
  • Credentials: password when you use email sign-in (stored as a hash by our authentication provider; we do not store plaintext passwords). If you use Sign in with Apple or Google Sign-In, that provider authenticates you and we receive your email (with Apple, possibly a private relay address you choose) and basic name via Supabase Auth.
  • Security: authenticator (TOTP) enrollment status used for multi-factor sign-in.
  • Financial settings you enter: monthly income, income duration, lookback preferences, aim / goals, budget categories, optional spending-rate overrides, and similar inputs used in Plan and related money math.
  • Talk: messages you send to Ray and Ray's replies (including citation metadata used to show how a number was calculated).
  • Support messages: content you send when you contact us.

2.2 Connected bank and financial data (required for the product)

When you link institutions through our bank-connection provider (Plaid), we receive and store data you authorize, which may include:

  • Institution name and identifiers; Item / connection status (including re-authentication signals).
  • Account identifiers, names, types/roles you map (chequing, savings, credit, exclude), nicknames, currency, and sort order.
  • Current and available balances, and optional fields you set such as overdraft limits.
  • Transaction history: amounts, dates, descriptions, merchant names, pending status, and personal finance category fields from the provider.
  • Classifications we derive or you override (expense, income, transfer, credit payment, ignore) used for Plan, Talk, and income / spending averages.

Encrypted bank access tokens are stored on our servers only. They are not sent to your browser. Connecting chequing, savings, and credit accounts (as applicable) is required for live balances, Plan, and Talk.

2.3 Information collected automatically

  • Usage: pages and features you use within the app.
  • Device and logs: IP address, browser or device type, approximate location derived from IP, timestamps, and diagnostic or error logs needed to run and secure the Platform.
  • Cookies and local storage: session and security tokens required to keep you signed in. We do not use advertising cookies.

2.4 Information from service providers

  • Supabase Auth: account creation, sessions, and optional Google OAuth tokens needed to sign you in.
  • Apple (Sign in with Apple): when you choose Continue with Apple, Apple shares your name (first time only) and your email or a private relay address. Sign in with Apple is optional.
  • Google: when you choose Continue with Google, Google shares your email and basic profile with Supabase so we can create or open your Ray account. Google Sign-In is optional; email sign-in remains available.
  • Plaid: bank connection, balances, and transactions you authorize.
  • Apple App Store: in-app subscription purchases, renewals, and refunds. Apple handles payment; we receive signed transaction records (product, dates, and a transaction ID linked to your Ray account), not your card details.
  • Google Cloud / Cloudflare: API and website hosting and related operational logs. Processing may occur in the United States and other regions where these providers operate.
  • AI provider (Talk): see section 2.5.
  • Langfuse: Talk performance and usage monitoring.
  • Apple: push delivery when you enable notifications (device token; notification bodies avoid putting full bank detail in the lock-screen text when possible).

2.5 Talk and third-party AI

Talk, Ray's question-and-answer feature, uses a third-party AI provider to understand your question and write the reply. When you use Talk, we send that provider:

  • the message you type or say;
  • the money context needed for that answer, such as relevant balances, transactions, merchants, categories, budgets, bills, and figures we already computed;
  • notes and preferences you asked Ray to remember, so it can find the relevant ones;
  • voice recordings, if you speak to Talk, so they can be turned into text.

We do not send your password, bank login, or bank access tokens. Our AI provider processes this data only to provide the service to us and does not use it to train its models. It may change over time; any provider we use for Talk is bound by the same terms. It may keep request data for a limited time for abuse monitoring.

Your consent. Talk is optional. Home, Plan, and your accounts work without it. By using Talk (sending a message or a voice note), you agree that we share the data above with our AI provider for that purpose. You can stop at any time by not using Talk. Deleting your account removes your Talk history from it (see section 7.1).

3. How we use personal information

We use personal information to:

  • Create and secure your account, including multi-factor authentication.
  • Connect and refresh bank data; classify transactions; power Plan and activity; answer Talk questions; and compute related figures such as income averages, spending rate, or how long your money lasts where the product shows them.
  • Persist your settings, account roles, class overrides, and Talk history across devices.
  • Provide customer support and respond to your requests.
  • Process subscription billing and entitlement (trial, active, or paywall) via the Apple App Store.
  • Detect fraud, abuse, and security incidents; debug and improve reliability.
  • Comply with law and enforce our Terms.

We do not use your connected financial data to train third-party advertising models or to sell ads against your profile.

4. How we share information

We share personal information only as needed to operate the Platform:

  • Service providers / processors listed above (Supabase, Plaid, our AI provider, Langfuse, Apple, Google Cloud, Cloudflare), under contracts that limit use to providing services to us.
  • Legal and safety: if required by law, legal process, or to protect rights, safety, or the Platform.
  • Business transfer: if we merge, sell, or reorganize, information may transfer under continued privacy protections.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

5. Retention

  • Account and settings: kept while your account is active.
  • Bank connections and transactions: kept while linked and for a rolling history needed for Plan, Talk, and spending averages (on the order of several months of transactions; older rows may be pruned as the product evolves).
  • Logs: typically retained for a short operational period (days to a few months) unless needed longer for security or legal reasons.
  • After you delete your account: see section 7.1. Backups roll over within 30 days.

6. Security

We use administrative, technical, and physical safeguards appropriate to the sensitivity of financial data, including encrypted transport (HTTPS), server-side encryption of bank access tokens, field-level encryption at rest for Talk content and sensitive transaction / account labels (rolled out progressively), hashed passwords via our auth provider, and role-restricted API access. Employees and ordinary admin tools do not have a casual path to read another user's Talk bodies or transaction merchants. Decrypt happens on our servers only to serve your authenticated requests and required sync jobs. No method of transmission or storage is 100% secure.

If we become aware of a breach of security safeguards involving your personal information, we will record the incident and, where required (including under PIPEDA when there is a real risk of significant harm), notify you and the relevant authority.

7. Your choices and rights

  • Access and correction: update profile and settings in the app, or contact us in the Ray app under You → Legal & support → Contact us.
  • Bank disconnect: remove or exclude accounts in Ray; you may also revoke access via Plaid or your institution.
  • Deletion: delete your account in the app under You → Privacy & security → Delete account (see section 7.1). If you no longer have the app, reinstall it and sign in to delete your account.
  • Depending on where you live (for example Canada under PIPEDA, or other applicable privacy laws), you may have rights to access, correct, delete, or withdraw consent for certain processing. Contact us to exercise those rights. We may verify your identity first.

7.1 What account deletion does

When you delete your account, right away we:

  • delete your login (email, password, passkeys, and linked Apple or Google sign-in) and revoke Sign in with Apple;
  • erase your profile (name, email, aim), connected accounts, transactions, Plan, budgets, goals, income, saved notes and memories, personal pages, settings, support messages, usage data, and push tokens;
  • disconnect your banks at Plaid.

We keep your Talk conversations in unlinked form, not tied to you: they move to a new random identifier with no link to you, your login, or your contact details, and we use them only to improve Ray. We also keep the records we need for accounting, such as App Store billing records, with no link to your account.

An App Store subscription is billed by Apple. Deleting your account does not cancel it; cancel it in your iPhone Settings → Apple ID → Subscriptions.

8. Children

Ray is not directed to children under 18 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided data, contact us in the Ray app under You → Legal & support → Contact us and we will delete it.

9. International transfers

We and our processors may store and process information in Canada, the United States, and other countries where our providers operate. Those jurisdictions may have different data-protection laws. By using Ray, you understand your information may be transferred to those locations.

10. Third-party services

Plaid, Supabase, Google Cloud, Cloudflare, our AI provider, Langfuse, and Apple (sign-in, App Store billing, and push) have their own privacy policies that govern their processing. Review those policies when you connect banks, enable notifications, or create an account.

11. Changes

We may update this Privacy Policy by posting a new version on this page and updating the "Last updated" date. Continued use after changes means you accept the revised policy. If you disagree, stop using Ray and request deletion.

12. Contact

Privacy questions, access requests, or deletion requests: contact Sunflower Studios in the Ray app under You → Legal & support → Contact us.
Studio: https://sunflower.builders.
Product site: https://ray.sunflower.builders.