How Castworth keeps your money information safe.

How your bank connects

Castworth connects to banks through Plaid, a company that many money apps use to link accounts. When you connect a bank, a Plaid window opens and you sign in to your bank there. Your bank username and password go to Plaid and your bank. Castworth never receives or stores them.

Once you sign in, Plaid gives Castworth a connection key for that bank. We use that key to ask Plaid for information only:

• your accounts, balances and transactions;
• for credit cards and loans, details like statement dates, due dates and minimum payments;
• in some cases, a past balance, to set the starting point of your forecast.

You don't have to connect a bank at all. You can also use Castworth by entering your accounts and balances yourself.

Castworth can't move money

Plaid also offers services that move money, like transfers and payments. Castworth does not use any of them. Our connection only asks for the information listed above, so Castworth has no way to pay a bill, make a transfer or take money out of your account.

When you set money aside in Castworth, that is a label on your forecast. The money stays exactly where it is at your bank.

How your information is protected

Encrypted on the way

The Castworth app and our servers only talk over secure HTTPS connections, and they tell your browser to keep using HTTPS on every visit.

Encrypted where it's stored

Your information is encrypted where it is stored. Bank connection keys get an extra lock of their own: each one is encrypted with AES-256-GCM, a strong, widely used encryption standard, before it is saved. The key that unlocks them is kept on our servers, separate from the database.

Private to you

Each person's information is walled off inside the database itself, not only in the app. Every request is tied to your sign-in, and the database only hands back what belongs to you. We keep an automated test that signs in as one person, tries to read, change and delete another person's information, and checks that every attempt is blocked.

Your Castworth password

Passwords are handled by our login provider and stored only in a scrambled (hashed) form, so we never see your actual password. Signing in, creating an account and resetting a password include a quick "I'm human" check from Cloudflare, which keeps automated bots out.

No look-alike tricks

The Castworth app refuses to load inside another website. That blocks a trick where a fake page hides Castworth's buttons under its own.

Who at Castworth can see your information

To help fix a problem, Castworth has a support view that lets an approved team member see an account the way its owner sees it. It has firm limits:

• It can't change anything. The server blocks every change while the support view is open, and the database connection it uses is set to read-only.
• Only people on an approved list can use it. That list can only be changed directly in the database, never from inside the app.
• Every use is recorded. Opening the support view requires a written reason, and we record who opened it, whose account, when and why. The app can add to that record but cannot edit or erase it.
• It shuts itself off. Each support session ends on its own after 30 minutes.
• No passwords. It never shows us your Castworth password or your bank password.

Chat and AI

Some Castworth features, including Chat, use Claude, an AI made by Anthropic. When you use one, we send Anthropic only what that feature needs to answer you. For Chat, that is what you type, any picture you attach, and the parts of your Castworth information Chat looks up to answer, like transactions waiting for review, your categories or your forecast lines.

• Not used for training. Under Anthropic's terms for business customers, Anthropic does not use this information to train its models.
• Uploads aren't kept. A screenshot, receipt or statement you share for Castworth to read is used for that one request and is not stored. Only the result you choose to save, like a split you confirm, is kept.
• You stay in charge. Changes Chat makes are shown to you and can be undone. AI can make mistakes, so please check what it suggests.
• Optional. You can use Castworth without the AI features. Connecting Castworth to ChatGPT is also optional, happens only if you set it up yourself, and can be turned off any time.

You're in control

• Download your data. In the app, go to Account, then Privacy & data, then Request download. You get a copy of your Castworth data right away. Bank connection keys are never included.
• Disconnect your banks. Go to Account, then Connected accounts, then Disconnect all accounts. This removes your bank information from Castworth and asks Plaid to close those connections. Your Castworth account and plans stay, and you can reconnect any time.
• Delete your account. Go to Account, then Privacy & data, then Delete account. This permanently deletes your profile, balances, transactions, plans, chats and login right away. We also ask Plaid to remove your bank connections and cancel any subscription. If Plaid or our payment provider can't be reached at that moment, Castworth keeps retrying automatically. This cannot be undone.
• Or just ask. Email privacy@castworth.com for a copy of your data, a fix, or to delete your account, and we will take care of it within 30 days.

Copies in our providers' routine backups are removed as those backups expire.

Questions

If you have a question about security, or think you've found a security problem, email support@castworth.com with what you saw. For questions about your data, email privacy@castworth.com.

For the full details of what we collect and who helps us handle it, read our Privacy Policy.