Privacy policy

Meridian is run by the operator of Meridian (“we” or “us”). This policy says what Meridian keeps about you, what it sends to other companies and why, and what you can do about it.

We never sell your data, and never use it for advertising.

Your account: your email address and a password, held by our sign-in provider, which stores the password only in a hashed form. For each sign-in, it also keeps the IP address and browser the sign-in came from, to secure your account. If you sign in with Google, Google shares your name, email address and profile picture with it.

What you add: accounts and transactions you enter by hand, categories, budgets, notes, the recurring charges you mark cancelled, and your advisor preferences and permissions.

From the banks you link, through Plaid: each bank’s name, your accounts (their names, types and the last digits of each account number), balances, transactions, recurring payments and deposits, investment holdings and their transactions, and the details Plaid reports for your cards and loans, such as rates, payments due and a loan’s account number.

What Meridian works out from these: daily balances, your net-worth history and the advisor reviews you ask for, which are saved as insights.

What keeps the service running: the jobs that keep your banks up to date, counts of how much you’ve used features with limits, and server logs of events and errors.

Meridian connects to banks through Plaid. You sign in to your bank in Plaid’s window, so Meridian never sees your bank username or password.

For each bank you link, Plaid gives Meridian an access token. Meridian encrypts it (AES-256-GCM) before storing it and never sends it to your browser.

Plaid handles the data it collects under its own privacy policy, which it shows you when you link a bank.

Unlinking a bank, or deleting your account, ends that bank’s access at Plaid. A bank your plan has paused for 30 days is disconnected at Plaid too; its history stays in your account, read-only.

The advisor runs on an AI provider we choose, xAI or Anthropic; Settings names the one in use. Nothing is sent to it until you allow it, and you can withdraw that permission in Settings at any time.

When you ask the advisor a question, the provider receives your question and the conversation so far, your advisor preferences, a snapshot of your accounts, balances, net worth, this month’s spending and income and your banks’ connection status, and whatever the advisor looks up to answer: transactions, budgets, recurring charges and deposits, investments, cards and loans, your latest recorded credit score and your net-worth history.

Meridian doesn’t save your conversations. A conversation stays in your browser tab until you start a new chat, sign out or reload the page.

When you request a review, the provider receives what that review needs: for spending, the month’s income and spending, totals and budgets by category, your subscriptions and up to eight of the month’s largest purchases; for investments, your holdings (names, ticker symbols, quantities, values and cost), an estimate of your spare cash and your advisor preferences. The investment review’s web research step sends the provider your ticker symbols only. Reviews are saved in your account as insights.

Account numbers, bank access tokens and your email address are never sent to the AI provider. How long the provider keeps what it receives depends on our agreement with that provider.

Supabase stores Meridian’s database and runs sign-in, including the emails that confirm your address and reset your password. Your data is stored in the United States.

Vercel hosts the website and the server code, and keeps the server logs.

Vercel Speed Insights measures how quickly Meridian’s pages load and respond. Each measurement is anonymous: it records the page’s address, its timings and the part of the page they concern, the kind of device, browser and connection, and the country it came from, but nothing that identifies you or your account. It sets no cookies, and it doesn’t follow you from page to page or across other sites.

Upstash keeps the counters behind Meridian’s rate limits and plan allowances, such as how many advisor questions you’ve asked today, under your account’s id.

Plaid connects your banks, and the AI provider runs the advisor, as described above. Each of these companies handles data for Meridian under its own terms.

Meridian sets one kind of cookie: the sign-in cookie that keeps you signed in. There are no advertising or tracking cookies.

Meridian also keeps a few things in your browser: your sky choice, whether you’re exploring the demo, small display settings, a copy of the screens you opened recently so the app opens quickly (for up to a week), and, in the tab where you create an account or ask for a new confirmation link, the email address it went to, until setup opens in that tab or the tab is closed. Signing out clears the copy of your screens and that address.

Your records stay while your account exists. Saved reviews stay until you delete your account.

Usage counters expire on their own within 35 days. Server logs are kept only as long as our hosting plan keeps them.

When you delete your account, your records are removed once your banks’ access has been ended. Copies may remain in our database host’s backups until those backups expire.

Download my data, in Settings, gives you your records as a file, without bank credentials.

Permanently delete account, in Settings, ends Meridian’s access to your linked banks, then deletes your account and records. If a bank can’t be reached, deletion stays pending and retries until it’s done.

You can unlink any bank on Accounts, and withdraw the advisor’s permission to send data in Settings.

Every person’s data is walled off by the database itself (row-level security), not just by the app. Bank access tokens are encrypted at rest, and data travels over encrypted connections (HTTPS).

No system is perfectly secure. If a breach affects your data, we’ll tell you as the law requires.

Meridian isn’t for anyone under 18, and we don’t knowingly keep data about children.

We may update this policy. The date at the top of this page shows when it last changed.

You can download your data or delete your account in Settings.