Mari is a personal finance app built for individuals, couples, and households. It is operated by Mari Technologies LLC, a limited liability company registered in the State of Texas, United States.
When this policy says “Mari,” “we,” “us,” or “our,” it means Mari Technologies LLC.
Our website is themari.app. Our product is at app.themari.app. This policy covers both.
Where Mari operates. Mari is currently available to residents of the United States only, and the bank connections we support are US institutions. If we expand to other countries we will update this policy first — including the local privacy law that applies, where data is stored, and how currency is handled — and tell existing users before anything changes. The GDPR and CCPA sections below apply to anyone those laws cover, regardless.
If you have questions about this policy or how we handle your data, contact us at hello@themari.app.
If you join the waitlist at themari.app and do not create an account, the only information we hold is your email address. Nothing else — no name, no phone number, no payment information.
Creating a Mari account requires:
During onboarding we also ask for your first name, which we use to address you in the app and in the emails you have asked for. We do not ask for your surname, your date of birth, your address, or your phone number.
To provide the core service, Mari connects to the bank accounts you choose to connect through Plaid, a regulated third-party financial data provider. Through this connection, we access:
Important: Mari’s bank connection is read-only. We cannot initiate transfers, move money, or take any action on your accounts. We can only read transaction and balance data.
We do not collect or store your bank login credentials. Plaid handles authentication directly with your bank.
When you visit themari.app, our hosting provider (Vercel) may collect standard web server logs including your IP address, browser type, and pages visited. We do not use advertising tracking pixels or third-party analytics beyond what Vercel provides by default.
Inside the app we also store your time zone, detected from your browser, so that dates, months and scheduled emails line up with your day rather than with a server clock. You can see and change it at any time in your profile settings.
| Data | Purpose | Legal basis |
|---|---|---|
| Email address (waitlist) | To notify you when Mari launches and send you product updates you signed up for | Consent (you submitted the form) |
| Email address (account) | Account management, security alerts, transactional notifications | Contract performance |
| Financial transaction data | To provide the budgeting, tracking, and planning features of the Mari app | Contract performance |
| Account balances | To calculate net worth and show accurate financial summaries | Contract performance |
| Server logs | Security monitoring, debugging, abuse prevention | Legitimate interest |
We do not use your data for advertising. We do not sell your data. We do not use your financial data to train AI models outside the Mari application.
We only share your data with the following service providers, and only to the extent necessary to operate Mari:
| Provider | Purpose | Data shared |
|---|---|---|
| Plaid | Bank account connection and data retrieval | Bank credentials (handled directly by Plaid; we never see them), transactions, balances |
| Supabase | Database and authentication | Account data, financial transaction data |
| Vercel | Website and app hosting | Server access logs |
| Anthropic, PBC | AI-assisted transaction categorisation (optional; you can turn it off) | Transaction description text only — never your name, balances, account numbers or any identifier. Anthropic does not train its models on it, and deletes API inputs and outputs within 30 days. |
| Resend | Transactional email delivery | Email address, email content |
| Stripe | Subscription billing | Payment card data (handled directly by Stripe; we never store card numbers) |
| Upstash | Rate limiting (abuse prevention) | IP address only |
| Cloudflare | Content delivery and DDoS protection | Standard CDN request logs |
| Sentry | Error monitoring | Anonymised error logs |
| Formspree | Email sign-up form on themari.app | Email address |
We do not share your financial data with any third party for their own commercial purposes. We may disclose your data if required by law or court order.
Inside Mari, one person can see your data. Mari is operated by a single person, who administers the database and therefore can read the transactions, amounts, merchant names and balances in your account. There are no other employees or contractors with access. That access is used to operate the service and to check that your figures are correct — not for any other purpose, and never shared onward.
What that person cannot see: your bank username or password (Plaid holds those and never passes them to Mari), your full account or card numbers, or your date of birth, address or Social Security number — Mari never asks for them. Bank access is read-only: Mari cannot move money.
We use Plaid to connect to your bank. When you connect your bank, you authenticate directly with Plaid — Mari never sees your banking username or password.
We request access to: transaction history, account balances, account names, and institution information. We do not request the ability to move money, your personal identification documents, or your credit score.
Transaction and account data is stored in our secure database (Supabase), scoped to your household. All data is encrypted at rest and in transit. Only members of your household can access your financial data.
You can disconnect your bank account at any time from within the Mari app or directly through your bank’s online portal via Plaid’s access management.
Disconnecting is not deleting. Disconnecting a bank stops Mari receiving new transactions; the history already imported stays in your account so your past months still add up. To remove it, delete the account data from within Mari, or delete your account entirely.
| Data type | Retention period |
|---|---|
| Email address (marketing list) | Until you unsubscribe or ask us to delete it |
| Financial transaction data — bank transactions, balances, accounts, budgets, goals, bills | 30 days after your subscription ends, then permanently deleted. Deleted immediately if you delete your account. |
| Bank connections and access tokens | Revoked with Plaid and deleted on the same 30-day schedule, or immediately when you disconnect a bank |
| Account data (login, name, settings) | Until you delete your account |
| Records of what happened to your data (deletion logs) | Retained after deletion — this is how we can show your data was deleted, and when. It contains no transaction detail. |
| Server logs | 90 days |
| Backup data | Up to 30 days after deletion |
Mari does not keep your bank history indefinitely once you stop paying for it. When your subscription ends:
We keep your login and a record that the deletion happened, so you can still sign in and so we can show what was deleted and when. That record contains no transaction detail.
This is deletion, not archiving — we cannot restore it afterwards, which is why we tell you twice and make the export one click.
For any right you cannot exercise in-product (or before you have an account), email hello@themari.app. We respond within 30 days.
Data controller: Mari Technologies LLC. Legal bases: consent (waitlist emails), contract performance (app functionality), legitimate interests (security). International transfers: Your data is stored in the United States. Right to complain: You may lodge a complaint with your local data protection authority. Contact: hello@themari.app.
To make a CCPA request, email hello@themari.app with subject “CCPA Request”. We respond within 45 days.
Mari is not directed at children under 16. We do not knowingly collect data from children under 16. Contact hello@themari.app if you believe a child under 16 has submitted data to us.
We will update this policy as Mari develops. We will notify account holders and waitlist members of material changes by email and update the “Last updated” date above.
Email: hello@themari.app
State of incorporation: Texas, United States
We aim to respond to all privacy enquiries within 5 business days and formal data subject requests within 30 days.