← Back to Skill Acquired
Privacy Policy
Last updated: March 22, 2026
The Short Version
- Your financial data is yours. We never sell it or share it with advertisers.
- AI features use Anthropic's API. Your data is deleted within 7 days and never used to train AI models.
- All data is encrypted in transit (HTTPS) and at rest (Cloudflare infrastructure).
- You can delete your account and all associated data at any time.
- We don't track you across the web. No analytics cookies, no ad networks.
Who We Are
Skill Acquired is a personal finance platform operated at skillacquired.io. We help you track spending, manage budgets, monitor debts, and understand your finances with minimal effort.
What Data We Collect
| Data Type | Why We Collect It |
|---|
| Email and password | Account authentication |
| Bank transaction data (from CSV uploads) | Categorization, budgeting, and spending insights |
| Amazon order data (from browser extension) | Matching purchases to bank transactions |
| Budget categories and amounts | Budget tracking and alerts |
| Debt information (balances, rates, types) | Debt tracking and payoff planning |
| Subscription details | Recurring charge monitoring |
| AI chat messages | Providing financial assistance via AI |
We do not collect: social security numbers, bank account numbers, credit card numbers, government IDs, or location data.
How AI Processes Your Data
Skill Acquired uses Anthropic's API to power smart categorization and the AI chat assistant. Here's exactly what happens:
When you import transactions, your transaction descriptions (not full bank statements) are sent to Anthropic's API through our secure server for categorization. When you use the AI chat, your message and relevant financial context are sent to generate a response.
Important facts about this process:
- All AI requests go through our server. Your browser never contacts Anthropic directly.
- Anthropic automatically deletes all API inputs and outputs within 7 days (reduced from 30 days as of September 2025).
- Your data is never used to train AI models. This is Anthropic's default commercial API policy — it is not an opt-out we selected, it is a flat restriction with no override. This protection applies regardless of any changes to Anthropic's consumer product policies.
- We do not send Anthropic your name, bank account numbers, Social Security numbers, or raw bank statements. Only transaction descriptions (e.g., merchant names) and amounts are included in categorization requests.
- You control exactly how much AI you use. In Settings, choose from three levels: no AI (fully manual), smart categorization only (transaction descriptions sent for sorting), or full AI (categorization plus chat assistant). You can change your level anytime, and the app remains fully functional at every level.
Where Your Data Lives
- Database: Cloudflare D1 (SQLite-compatible, encrypted at rest)
- File storage: Cloudflare R2 (encrypted at rest)
- API: Cloudflare Workers (serverless, no persistent servers)
- Region: Data is processed in Cloudflare's global network.
All connections use HTTPS (TLS 1.2+). HTTP requests are automatically upgraded.
Who Can See Your Data
Only you. Your financial data is isolated to your account. Other users cannot see your data.
Admin access to individual user data requires a Support PIN that you generate and share voluntarily. All admin data access is logged in an audit trail.
Third-Party Services
| Service | Purpose | Data Shared |
|---|
| Anthropic (API) | AI categorization and chat | Transaction descriptions, chat messages |
| Resend | Transactional email | Email address only |
| Cloudflare | Hosting and infrastructure | All app data (encrypted) |
We do not use analytics services, advertising networks, or tracking pixels.
What We Don't Do
- We never sell your data to anyone.
- We never share your data with advertisers.
- We never use your data to train AI models. Anthropic's commercial API terms prohibit this by default, and we do not opt in to any data-sharing programs.
- We never access your bank accounts directly. You upload CSV files manually.
- We never store passwords in plain text. All passwords are hashed with PBKDF2 (100,000 iterations).
Your Rights
- Export all your data at any time (JSON backup from Settings)
- Delete your account and all associated data
- Disable AI features while keeping full manual functionality
- Request information about what data we hold about you
When you delete your account, all data is permanently removed from our database.
Data Retention
- Your account data: Retained while your account is active. Deleted on account deletion.
- AI processing: Inputs and outputs deleted by Anthropic within 7 days.
- Audit logs: Retained for the life of your account.
- Login attempts: IP addresses retained for 90 days for security.
Security Measures
- HTTPS encryption on all connections
- Encrypted data at rest (Cloudflare D1 and R2)
- PBKDF2 password hashing (100,000 iterations)
- Session-based auth with httpOnly, Secure cookies
- Optional two-factor authentication (TOTP/MFA)
- Progressive account lockout on failed logins
- IP-based rate limiting on authentication endpoints
- Server-side AI API key management (never exposed to browsers)
Children's Privacy
Skill Acquired is not intended for users under 18. We do not knowingly collect data from minors.
Changes to This Policy
If we make material changes, we will notify you via the app or email before the changes take effect. We will never retroactively weaken your privacy protections without your consent.
Contact
Questions about your privacy? Email us at privacy@skillacquired.io