SequaBack to home

Privacy Policy

Last updated: September 24, 2026

1. Our Privacy Promise

Sequa is built on a simple principle: your financial data is yours. We designed the product so that your data stays on your device by default, and we never require bank login credentials or direct account access.

2. Data Storage

On your device (every plan)

All financial data — transactions, account balances, goals, debts, and your Priority Stack — is stored in your browser's local storage (IndexedDB), whether or not you have an account. Without cloud sync, we cannot access, read, or recover this stored data, and clearing your browser data will permanently delete it. The only exception is when you use AI features: generating a Priority Stack or categorizing transactions sends a summary of your financial profile over an encrypted connection to our secure proxy for analysis (see §4 below). This data is processed in memory to generate your response and is not saved to our database. Standard server logs may retain limited error diagnostics for a short period.

Pro (cloud sync)

If you turn on cloud sync, your data stays in your browser and an encrypted backup copy is kept on our servers so it can sync across your devices. The backup is encrypted in your browser with AES-256-GCM before it is uploaded, sent over an encrypted connection (TLS), and stored encrypted at rest.

So that you can restore your data on a new device just by signing in, the encryption key is stored on our servers with your account. This means Sequa is technically able to decrypt your backup. Our systems never do: the backup is only decrypted in your browser when you sync or restore. Turning sync off stops new uploads; deleting your account deletes both the backup and the key.

3. What We Never Do

  • We never store bank login credentials or account access tokens
  • We never require direct bank login — import is via file upload (CSV, OFX, QFX)
  • We never store unencrypted financial data on our servers (cloud sync backups are encrypted; see §2)
  • We never sell, share, or monetize your financial data
  • We never use your financial data for advertising or profiling
  • We never log transaction descriptions, amounts, or account numbers

4. AI Processing

When you generate a Priority Stack or use AI coaching features, a summary of your financial profile (income, expenses, goals, debts) is sent to our server-side proxy, which forwards it to Anthropic's Claude API for analysis. This data is transmitted over encrypted connections (TLS) and is not stored by Anthropic for training purposes. We do not include personally identifiable information (name, address, account numbers) in AI requests.

5. Transaction Import

When you import bank transaction files (CSV or OFX), the file is parsed entirely in your browser. The raw file is never uploaded to our servers. Parsed transactions are stored locally in your browser (free plan) or encrypted and synced (Pro). If you use AI categorization, transaction descriptions are sent to our proxy for analysis (see §4).

6. Account Information

If you create an account, we store your email address and authentication credentials (managed by Supabase Auth). We use this solely for authentication and account recovery. We do not send marketing emails unless you explicitly opt in.

7. Payment Information

If you subscribe to Pro, payment is processed entirely by Stripe. Your card details are entered directly into Stripe's secure checkout — Sequa never sees, stores, or processes your full card number. We store only your Stripe customer ID and subscription status to manage your account. Stripe may collect billing address and payment method information as described in their privacy policy.

8. Analytics

We use Google Analytics to understand aggregate usage patterns (e.g., which features are used, page views, traffic sources). Google Analytics uses cookies to distinguish unique visitors. We never track individual financial data in analytics. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

To improve the Priority Stack engine, we also keep anonymous generation telemetry: for each stack generated we record only the shape of the result — for example, how many steps it had, what kinds of actions they were (debt payoff, retirement savings, and so on), and whether our quality checks corrected anything. We do not record dollar amounts, balances, interest rates, income figures, or anything that identifies you; each record carries only a random ID that cannot be linked back to your account. Telemetry records are deleted after 13 months.

9. Third-Party Service Providers

Sequa uses the following third-party services to operate:

  • Supabase — authentication, encrypted data storage (Pro), and server-side functions. Hosted in US East. Subject to Supabase Privacy Policy.
  • Anthropic (Claude API) — AI analysis for Priority Stack generation and coaching. Data sent via encrypted proxy; not retained for model training.
  • Google Analytics — anonymous, aggregate usage analytics. Uses cookies to distinguish visitors. No financial data is tracked.
  • Stripe — payment processing for Pro subscriptions. Stripe collects payment information (card details, billing address) directly — Sequa never sees or stores your full card number. Subject to Stripe Privacy Policy.
  • Resend — transactional email delivery (account confirmation, password reset). We share only your email address for delivery purposes. Subject to Resend Privacy Policy.
  • Vercel — web hosting and content delivery. Subject to Vercel Privacy Policy.

10. Data Deletion

You can delete your account and all associated data at any time from Settings → Danger Zone → Delete account. Free plan: this clears all browser-stored data instantly. Pro: this cancels your subscription, deletes all server-side data, and removes your authentication account.

10b. Data Retention

We retain your data only as long as necessary to provide the service. Specific retention periods depend on your plan and data type:

  • Free plan (local mode) — All data is stored in your browser and retained until you clear your browser data or delete your account. We have no server-side copy.
  • Pro (cloud sync) — Server-side data is retained while your account is active. Upon account deletion, all server-side data is permanently removed within 7 business days.
  • Backups — Database backups are retained for up to 7 days and then automatically purged. Backups are encrypted at rest.
  • Analytics — Anonymized, aggregate usage data (no financial information) may be retained for up to 24 months for product improvement.
  • Support correspondence — Emails and feedback submissions are retained for up to 12 months after your last interaction, then deleted.

To request immediate deletion of your data, use the account deletion feature in Settings or contact us at privacy@getsequa.com. We will process deletion requests within 7 business days.

11. Your Privacy Choices (CCPA / State Privacy Laws)

Sequa does not sell or share your personal information with third parties for advertising or marketing purposes. We do not participate in data broker networks or cross-context behavioral advertising.

Under the California Consumer Privacy Act (CCPA) and similar state laws, you have the right to:

  • Know what personal data we collect and how it is used
  • Request deletion of your personal data
  • Opt out of the sale or sharing of your personal information (we do not sell or share your data)
  • Not be discriminated against for exercising your privacy rights

To exercise any of these rights, use the account deletion feature in Settings, export your data from Settings, or contact us at support@getsequa.com.

12. Changes to This Policy

We will notify users of material changes to this policy via the app. Continued use after changes constitutes acceptance.

13. Contact

Questions about this policy? Email us at privacy@getsequa.com.