Privacy Policy
Cratchit holds some of the most personal information a family has: its businesses' books, its taxes, its investments and its plans. This policy explains what we collect, why, who helps us run Cratchit, how it's protected, and how to have it deleted.
The short version. We use your information only to run Cratchit for you. We never sell it, rent it or use it for advertising. Bank connections are read-only, so Cratchit can't move your money. You can ask us to delete your information at any time.
Who we are
Cratchit is operated by Cratchit Financial Services LLC ("Cratchit," "we," "us"), based in North Carolina. This policy covers the website at cratchit.io, the Cratchit application at app.cratchit.io, and the demo at demo.cratchit.io.
What we collect
Information you give us
- Account details: your name and email address, and the names and email addresses of anyone you invite to your account.
- Demo requests: your name, email address and mobile number when you ask to try the demo or request pilot access.
- What you enter or upload: companies, accounts, goals, notes, receipts, statements, estate documents and anything else you add.
Information from accounts you connect
- Bank, card, investment and loan accounts you connect through Plaid: account names, the last four digits of account numbers, balances, transactions and holdings. You sign in to your own institution on Plaid's screen and choose what to share. Plaid's handling of that information is described in the Plaid End User Privacy Policy.
- Books you bring over from QuickBooks or Xero, if you choose to import them.
Information collected as you use Cratchit
- An activity log of changes made in your account and who made them, so your books have a reliable history.
- Basic technical information our hosting providers record to deliver and secure the service, such as IP address, browser type and the time of each request.
How we use it
- To run Cratchit for you: keep your books, reconcile accounts, prepare reports, estimate taxes, show tax strategies against your numbers, and track your family's goals.
- To sign you in, keep your account secure and prevent misuse.
- To send messages you need, such as sign-in codes and notices that your monthly report is ready. These notices don't include your financial figures.
- To follow up on a demo or pilot request you made.
- To fix problems and improve Cratchit. When we study how the product is used, we do it in ways that don't expose any one family's finances.
- To meet legal obligations.
AI features
Some features use AI from Anthropic, for example suggesting a category for a transaction or reading the details from a document you upload. Only the information needed for that task is sent, and Anthropic processes it under commercial terms that don't allow it to train its models on your data. AI suggestions are just that: you confirm them, and nothing is applied to your books on its own.
Who else handles it
We rely on a small number of service providers, each only to run Cratchit:
- Supabase: hosts the database, file storage, sign-in and servers.
- Cloudflare: hosts the website and application.
- Plaid: connects your financial accounts and delivers their data.
- Anthropic: powers the AI features described above.
- Email and messaging providers: deliver sign-in codes and notices.
- Our customer-relationship tool: holds demo and pilot requests so we can follow up.
- Google Fonts: supplies the website's typefaces.
We also share information when you direct us to, such as inviting your CPA, a family member or an advisor to your account. We may disclose information if the law requires it, to protect the rights and safety of our users or others, or as part of a merger or sale of the business, in which case this policy continues to apply to it.
What we never do
- We never sell or rent your information.
- We never use your financial information for advertising, and we don't share it with advertisers.
- We never move money. Bank connections are read-only.
How it's protected
- Information is encrypted in transit (TLS) and in storage (AES-256). Bank connection keys are encrypted a second time by Cratchit.
- Cratchit runs on providers that are SOC 2 Type 2 audited.
- There are no passwords to steal: you sign in with a one-time code. Two-step sign-in with an authenticator app is available, and account owners can require it.
- Sign-ins end after 30 minutes without activity and last no more than 7 days.
- Each family's account is kept separate from every other, and every change to the books is recorded with who made it.
No system is perfectly secure. If we learn of a breach that affects your information, we'll tell you as the law requires.
How long we keep it
- While your account is open, we keep your information so Cratchit works.
- Bookkeeping records are kept for at least seven years when a business needs them for tax purposes, unless you ask us to delete them sooner and the law allows it.
- Backups are kept for 35 days and then deleted automatically, so deleted information leaves our backups within 35 days.
- Demo and pilot requests are kept until you ask us to remove them or we no longer need them.
Your choices
- Disconnect an account at any time in Cratchit. We end the connection with Plaid and erase its access key, and no new data arrives. You can also manage connections at my.plaid.com.
- See, correct or export your information from within Cratchit, or ask us for a copy.
- Delete your account and information by emailing info@cratchit.io. We handle requests within 30 days, except for records the law requires us to keep.
- Remove a person from your account at any time; their access ends immediately.
Depending on where you live, you may have additional rights under state privacy laws. We honor these requests wherever you live, and we won't treat you differently for making one.
Cookies and browser storage
The website doesn't use advertising or tracking cookies. The application stores a few items in your browser to keep you signed in and remember choices like which account or view you had open.
Children
Cratchit is for adults. We don't knowingly collect information from children under 13. Parents may record family details, such as a child's name for a goal or an estate plan, as part of their own account.
Changes and contact
We review this policy at least once a year and whenever Cratchit starts handling a new kind of information. If we make a material change, we'll update the date above and tell account owners before it takes effect.
Questions or requests: info@cratchit.io.