Finance Crystal Ball · Last updated October 28, 2026
We never receive your store or bank login. You authorize each connection directly with the provider (and with Plaid for bank data).
Your data is stored on our server, which only accepts encrypted (HTTPS) connections. Bank access tokens and API secrets are encrypted at rest with a key kept separate from the database, and are never sent back to your browser. Each account can only reach its own data, after signing in. Backups of the database are encrypted before they leave the server.
If you subscribe to bank linking, Stripe handles the payment. Your card number goes to Stripe, never to us. We keep only your Stripe customer number and whether your subscription is active, so we know whether to switch bank linking on. See Stripe's privacy policy.
Only to power the dashboard for the business it belongs to: forecasts, inventory, and reporting. We do not sell, rent, or share your data, and we do not use it for advertising.
Finance Crystal Ball can host multiple businesses. Each business’s data is isolated and only accessible with its own key.
Connections and data are kept until you disconnect them or delete your account. When a cancelled bank linking subscription runs out, we disconnect the bank at Plaid and delete the stored token for you. Disconnect bank revokes our access at Plaid and deletes the stored token. Deleting your account (Account, then Delete) removes your data, disconnects your bank at Plaid, and cancels any subscription.