Privacy Policy

1. Who is responsible for your data

Performant LLC, a limited liability company registered in Texas, with its mailing address at 5900 Balcones Drive, Suite 100, Austin, TX 78731, USA, is the data controller for the personal data described here. You can reach us about anything on this page at development-team@performant.pro.

2. What we collect

• Account data. Your email address and a securely hashed password. We never store your password in a readable form.
• Consent record. The date and document version at which you accepted these terms, so we can show what you agreed to.
• Billing data. Opening a billing page creates a customer record at Stripe holding your email address, even if you never subscribe. If you do subscribe, Stripe collects and stores your payment details. We do not see or store your card number. Your card is saved with the cardholder's name and billing address, which sales tax is worked out from. Receipts and invoices go to your sign-in email, or to another address you choose in Billing. Your invoices and subscription status stay with Stripe and we read them from Stripe each time you open a billing page; the only billing identifier we keep ourselves is the subscription reference.
• Purchases in our phone apps. When you buy a plan in our iPhone or Android app, Apple or Google tells us the purchase and transaction identifiers, the plan, its dates and whether it renews, and the random account identifier we gave the store for your account. They never send us your payment details.
• Content you create. Whatever you put into the applications you use. Your Venova financial records are encrypted on your device before they reach us. Section 4 explains what that does and does not cover.
• Support correspondence. Tickets and messages you send us, and our replies. A ticket also records which app version and platform you reported from and, only if you choose to attach it, a trail of the screens you visited and actions you took. Our staff can add private notes to a ticket.
• Games. If you play a game on the site, your scores, streaks and totals for that game, your Fauna rounds, and the display name and handle you choose for the games, if you choose them. If you use the games' friends features, your friends, the friend requests you send and receive, the challenges you make and accept, and the players you block.
• What other players see. Your friends in the games see your display name, your handle, your statistics for each game (such as your streaks, win rate and average guesses) and your results for the daily puzzles, and the games rank you and your friends against each other. Practice rounds are never shown. A player who has your handle sees your display name when they send you a friend request, and anyone who opens a challenge link you share sees your display name and your result for that day's puzzle. No one else sees them. Removing or blocking a friend stops sharing with them.
• Security log. Our authentication service records security events on your account, for example signing up, signing in and out, entering a two-step sign-in code, renewing your session while you use the Service, requesting a password reset, changing your password, email address or two-step sign-in, and closing your Performant account. Each entry holds your email address and the IP address the request came from.
• Technical data. Timestamps, error reports and request records, kept for security and debugging. Apart from the security log above, our own logs identify subscriptions and accounts rather than you personally; your IP address and browser user agent are recorded by Cloudflare as part of serving the request.

3. Why we use it, and our legal basis

• To provide the Service by creating your account, authenticating you, storing your content, and running the features you use. Basis: performance of our contract with you.
• To take payment by processing subscriptions and handling cancellations and refunds. Basis: performance of our contract, and our legal obligation to keep financial records.
• To keep the Service secure by detecting abuse, debugging faults, and preventing unauthorised access. Basis: our legitimate interest in a secure service. The security log in section 2 is used only for this, never for analytics or advertising.
• To communicate with you through confirmation emails, password resets, and service notices. Basis: performance of our contract.

We do not sell your personal data, we do not share it with advertisers, and we do not use your content to train machine-learning models.

4. How your Venova data is encrypted

Your Venova financial data is encrypted on your device before it is sent to us, and we hold it only as ciphertext. Your password never reaches our servers in a form they can use to open it. There are two protection levels, and they differ in one respect: whether we also hold a copy of the key.

Recoverable protection is where every household starts. Alongside your own copy of the key we keep a sealed copy that only our servers can open. It exists so we can restore your access if you forget your password, and that is the only thing we use it for. It does mean we are technically capable of decrypting your financial data, and that a valid legal order could compel us to. That is a capability, not a routine: nothing in the Service reads your financial data in normal operation.

Advanced protection is available to every household, free, from Venova's security settings. Turning it on destroys our copy of the key. From then on we cannot read your financial data, cannot disclose it if we are compelled to try, and cannot restore it. Recovery depends entirely on the one-time recovery code you are given when you switch.

Encryption covers the contents of your financial records. It does not cover the information we need in order to run the Service around them: your email address, which household you belong to, when you last saved a change, and how large the encrypted record is. Those stay visible to us at both protection levels.

5. Who processes data on our behalf

We use a small number of sub-processors. Each handles data only on our instructions and under a data processing agreement.

• Supabase provides authentication and our database.
• Resend delivers our account emails, such as sign-up confirmations and password resets. It receives your email address and the message, never your financial data.
• Stripe handles payment processing and subscription billing.
• Cloudflare gives us application hosting, file storage, and network protection.
• Google Cloud delivers Google Play's notices about purchases made in our Android app.

If you subscribe in our iPhone or Android app, Apple or Google takes the payment and handles it under their own terms and privacy policies. What they tell us is listed in section 2.

If you choose to link a bank or brokerage account to Venova, Plaid connects to it for you. Plaid is a separate company, not one of our sub-processors. It handles the data it collects under its own End User Privacy Policy, which applies to you directly. This policy covers what we do with the account data Plaid passes to us.

Bank-linked data is the one exception to the encryption described above. Balances, transactions and loan terms retrieved from your bank are stored in our database in readable form, not inside your encrypted record, because the app needs to match them against what you have entered. Advanced protection covers what you write yourself. It does not make bank-linked data unreadable to us. We keep it only as long as it is needed (section 7), and you can remove all of it at any time by disconnecting the bank, which deletes it along with the connection.

Some of our sub-processors operate outside your country. Where personal data is transferred internationally we rely on the safeguards those providers offer, including standard contractual clauses.

6. Cookies

We set only the cookies needed to run the Service. These hold your login session, are marked HttpOnly so scripts on the page cannot read them, and expire when the session ends or is refreshed. We do not use advertising or third-party tracking cookies, so there is no consent banner to dismiss.

7. How long we keep it

• Account and content data stays until you delete your account, and is then removed as described in section 8.
• Bank-linked data is kept only as long as it is needed:
  • Bank transactions, brokerage activity, prices and share counts that reach your Venova records are deleted from our servers once your device has confirmed they are in your encrypted records. We wait at least 35 days first, and until no earlier saved version of your records from before then could still be restored. Your device makes that check; we never read your records to do it.
  • A bank transaction you skip in review, or delete from your records after adding it, is kept for 3 days so you can bring it back, and is then deleted.
  • A bank transaction nobody reviews is deleted once its bank date is more than 25 months ago.
  • When we delete a transaction that was reviewed, we keep only its identifiers (the bank's IDs for it, its account and its connection) and when it was reviewed, never its amount, date, description or merchant, so the same transaction is not downloaded and offered again.
  • Account balances, credit card and loan details, and holdings are kept while the bank is connected.
  • If your household moves to a plan without bank and brokerage connections, every bank connection in it is disconnected within two days after the period already paid for ends.
  • Disconnecting the bank, deleting your household, or a lapsed household being purged deletes all of it, identifiers included. Anything you imported into your own records stays there, encrypted, until you delete it.
• Saved versions of your Venova data. Venova keeps a short history of your document so you can roll back a mistake. Everything from the last day is kept, thinning to one version a day for a month, and a small number of the most recent versions is always retained. They carry the same encryption as the document itself.
• Billing records are retained after account deletion for as long as tax and accounting law requires, typically several years. Invoices and receipts also keep the email address they were issued to, because tax records cannot be altered.
• Billing account at Stripe. Opening a billing page creates a customer record at Stripe holding your email address, even if you never subscribe. When you close your account we clear your email address, name and billing address from that record and from the card saved on it. The record itself remains, carrying an internal reference with no name or address attached, so that the closure stays auditable.
• Plans bought in our phone apps. The record of a subscription bought in our iPhone or Android app (the store's identifiers for it, the plan, its dates and its state) is kept while it is live and for 60 days after it ends for good, also after your account is closed, so a later report from the store about it can still be matched. The random account identifier we gave the store is deleted when your account is closed. A log of changes to the record, which holds no store identifiers, is kept two years.
• Support tickets. A ticket closes after two weeks without activity, and its contents are destroyed a month after it closes, leaving a record that a ticket was raised and closed. Anything untouched for six months is closed and cleared the same way. You can clear a ticket yourself at any time.
• Account closure records. When an account is deleted we keep a record of the closure itself, so we can show it completed and finish cancelling anything attached to it. Identifiable detail is stripped after thirty days; the record itself is erased after six months.
• Security log. Each entry is deleted 90 days after it was recorded, whether or not your account still exists.
• Backups. Disaster-recovery backups are taken daily and kept on a rolling seven-day cycle, then overwritten. Deleted data can persist in a backup until that cycle completes.

8. Deleting your account

You can delete your account yourself from your account settings. Doing so cancels every subscription attached to it before anything is destroyed, so you are not charged again, and then erases your data. A plan bought in the App Store is the exception: Apple lets only you cancel it, in your Apple settings, and billing continues until you do. Removing a single application's data works the same way for that application's subscription.

Deletion is permanent and we cannot undo it. Some records outlive it. Billing history is kept because tax law requires it. Your customer record at Stripe is emptied of your details but not deleted. A cleared shell of each support ticket remains, holding the reference and the dates but none of the words. The closure record described in section 7 is kept for six months. The security log described in section 2 is not cleared by deletion; each entry is deleted 90 days after it was recorded. Deleted data may also remain in a disaster-recovery backup until that backup ages out.

If you delete Venova's data from within Venova rather than closing your whole account, the saved version history described in section 7 is not cleared with it. Closing your account does clear it. If you want everything gone, close the account.

9. Your rights

Depending on where you live, you have the right to:

• Access the personal data we hold about you, and receive a copy of it.
• Correct data that is inaccurate or incomplete.
• Delete your data. You can do most of that yourself from account settings.
• Object to or restrict processing we carry out on the basis of legitimate interest.
• Withdraw consent where we relied on it, without affecting past processing.
• Complain to your local data protection authority.

To exercise any of these, email development-team@performant.pro. We respond within one month.

10. Children

The Service is not intended for children under 16. We do not knowingly collect their personal data, and we delete it if we learn we have.

11. Changes

If we change this policy materially we will notify you by email or in the application before the change takes effect, and the version identifier at the top of this page will change.