Sign inGet started

Legal

Privacy Policy

What Nora collects, how we use it, who processes it and the choices you have.

Last updated 2 October 2026

1. Scope and operator

Benjamin Ollomo operates Nora. This Policy covers Nora’s website and personal-finance service, including connected accounts, transactions, Nora Chat, Boards and related features. Nora is currently intended for users in the United States and Canada.

2. Information we collect

Account information

Nora supports Google sign-in and verified email-and-password accounts. We may receive your name, email address, a one-way password hash when you choose password sign-in, Google account and authentication-provider information, account and session identifiers, and settings and preferences. Nora does not receive your Google password or store a readable Nora password.

Connected financial information

When you connect through Plaid, Nora may receive institution and account details, partial account numbers, currencies, balances, credit limits, transaction dates and amounts, descriptions, merchants, categories, and pending or posted status. Nora may normalize, categorize, or derive additional information so features work consistently.

Information you create

We store transaction edits, category and merchant choices, Nora Chat messages and conversations, Board descriptions and content, Board conversation history, and product preferences you choose to create or change.

Technical and operational information

Nora and its infrastructure may process session data, IP address, browser and device information, timestamps, request metadata, authentication lifecycle and audit events, sync status, errors, feature usage, AI model and token usage, and application or AI timing. Better Auth Infrastructure can receive server-generated authentication events containing identifiers, name, email, session ID, login method, user agent, IP address, and approximate location. Nora does not enable its Sentinel browser fingerprinting or request-enforcement plugins. The public site and authenticated product offer separate opt-ins for privacy-minimized PostHog analytics and session replay; replay cannot operate without analytics consent. Nora uses a random browser identifier that rotates every 30 days and is not linked to a Nora account. When a consenting public-site visitor changes language, an event records only the previous and selected supported locales. Events exclude financial values, prompts, content, names, emails, and Nora, database, and provider identifiers. Replay masks all inputs and rendered text by default and blocks financial pages, Chat, Boards, settings, sign-in, Plaid, search, and exports. It excludes network bodies and headers, console logs, clipboard contents, canvas, cross-origin provider frames, and performance capture. URLs omit query strings and fragments and redact sensitive path segments. Provider access, retention, deletion and export permissions, processing regions, and disable controls depend on Nora's provider configurations. Resend receives the recipient address and authentication-message content required to deliver verification, recovery, and password-change email. Nora retains hashed-recipient delivery and webhook metadata for 90 days.

Nora also stores your current guide progress and achieved milestone timestamps across devices for the lifetime of your account unless you clear them. These records are included in your data export and contain no detailed click history or financial or Chat content. Replay/reset preserves achieved milestones; Clear learning progress deletes guide progress and milestone timestamps without deleting financial data. A minimal reset marker remains to reject delayed updates. Cleared historical milestones are not reconstructed from existing records. Previously generated or downloaded exports may retain earlier progress under the existing export retention rules. Account-wide deletion is not yet implemented. Administrators see aggregate current learning counts with coverage limitations; learning state is separate from optional browser analytics. The Explore first preference is also saved across devices, included in exports and removed when you clear learning progress. Home setup is available to every account regardless of signup date; no detailed setup impression history is retained. Welcome-start and first-connection timestamps remain after learning progress is cleared, to prevent reopening the welcome. They are included in exports and retained for the account lifetime; administrators see aggregate counts only. The selected guide ID and minimized preference are also kept in account-scoped browser session storage to continue across views in the same tab. They contain no financial references or message content and are removed when you dismiss or complete the guide. Help is public product documentation. Help search runs in browser memory; Nora does not transmit or retain search text or help-reading history. Help surfaces are excluded from session replay. Learning and import monitoring uses aggregate counts without financial content or links to anonymous analytics identities. Setup-confirmation seen/dismissed timestamps are included in learning state and exports, preserved by guide reset, and removed by Clear learning progress. A temporary account-scoped session flag keeps that confirmation visible during the claiming tab session. A connection-start milestone records successful Plaid Link-token issuance, not proof that Plaid was viewed. Personalized setup examples use your existing financial data without copying it into learning state or analytics. Admin activation reporting uses aggregate current availability and observed outcomes; no new account-linked return tracking is collected.

3. Bank login credentials

You enter your bank username and password through Plaid or your institution. Nora does not receive them. It receives a Plaid access token for the information you authorize and encrypts it before storage. Plaid processes data under its own privacy notices and terms.

4. How we use information

We use information to authenticate you; connect and synchronize institutions; display and search accounts and transactions; support transaction edits; calculate spending, income, cash flow, and other metrics; identify recurring activity; provide analytics; answer Nora Chat questions; generate requested explanations; create and validate Boards; enrich merchant data; support and secure Nora; diagnose errors; measure reliability; comply with law; and enforce the Terms.

We do not use connected financial information for third-party advertising.

5. Artificial intelligence

Nora currently uses Google Gemini for Nora Chat, contextual explanations, Board creation and editing, and merchant enrichment. Depending on the feature, Gemini may process messages, authenticated finance-tool results, verified explanation inputs, Board descriptions and content, or merchant names and transaction descriptions.

Nora uses these features as a financial coach and decision-support tool. Facts, interpretations, estimates, and coach suggestions are presented as distinct types of information. AI output is not professional financial, tax, legal, insurance, investment, or debt advice and does not guarantee an outcome.

Gemini does not receive unrestricted database access, bank passwords, Plaid tokens, or encryption keys as financial context. AI output can still be inaccurate. Nora does not promise that Google retains no AI inputs or outputs or that provider settings will never change.

Connected AI applications (MCP)

If you connect Nora to an external AI application through MCP, such as ChatGPT operated by OpenAI or Claude operated by Anthropic, Nora shares the read-only financial results you authorize with that application so it can answer your requests. Aggregate access provides financial summaries. Separately approved permissions can provide account names, masked account numbers, balances and balance history, or individual transactions and related merchant and category details. Existing aggregate connections do not receive expanded permissions automatically.

Nora does not share bank passwords, Plaid access tokens, transaction notes, original provider values, edit history, raw provider payloads, or saved category budget targets through MCP. Connected applications cannot modify your financial records, move money, or start a bank synchronization. MCP financial results are supplied to the application you connect; these requests do not invoke Nora’s Gemini features.

The external application and its operator process information they receive under their own terms, privacy policies and your settings with them. Review those policies before connecting. You can review connected applications and revoke their Nora access in Settings > Privacy & Data. Revocation prevents further authorized requests but cannot retract information already received or retained by the external application.

Nora records content-free MCP operational metadata for security, reliability and abuse prevention: your Nora account identifier, the external application’s OAuth client identifier, tool, protocol and scope names, operation identifier, status, duration, reserved extraction-unit count and a coarse result-size bucket. These audit events do not contain tool requests, financial results, amounts, financial account or transaction identifiers, merchant names, prompts, responses, tokens or raw errors. They expire after 90 days and are included in your self-service data export while retained. Current AI-application consent metadata is also included in exports without OAuth credentials.

Nora also provides static methodology, privacy and taxonomy resources to help connected applications interpret results. These resources contain no user-specific financial information and do not expand the permissions you granted.

6. Service providers and disclosure

Nora currently relies on:

  • Plaid for financial-account connectivity;
  • Google for authentication, Gemini AI, and cloud infrastructure;
  • MongoDB technology for application data storage;
  • Vercel for web hosting and delivery;
  • PostHog for optional public-site and product analytics and privacy-masked session replay;
  • Brandfetch for merchant websites, branding, and logos;
  • Better Auth Infrastructure for authentication event logging and provider-hosted account and session administration;
  • Resend for transactional authentication email.

We may also disclose information when required by law, to protect people or the service, in a business transfer, or at your direction. Nora does not sell personal or connected financial information or share connected financial information for cross-context behavioural advertising.

7. Internal access

Nora is currently operated by Benjamin Ollomo. Stored information may be accessed when reasonably necessary for support, troubleshooting, maintenance, security, reliability, or legal compliance. Access is limited to authorized administrative and provider tools. Better Auth Infrastructure also provides provider-hosted authentication audit and user or session administration capabilities.

Nora administrators are also notified by email when a new account is created, when a user connects a bank account, and when that connection's first import finishes. These operational alerts identify the account holder by email address and internal ID, and where applicable name the bank and how many accounts and transactions were imported. They contain no balances, transaction details, merchant names, or statement contents, and they do not widen what administrators can already access.

8. Retention, disconnection, and deletion

Disconnecting stops normal synchronization and asks Plaid to remove the connection. If removal is pending, the encrypted token may be held temporarily for a retry. Once removal completes, a separate action can soft-delete imported connection data from normal product use.

Chat threads and Boards also use separate soft-delete behavior. Nora does not yet have one account-wide deletion route or a finalized schedule for permanent erasure, Better Auth Infrastructure authentication events, telemetry, or backup retention. Authentication-email delivery and webhook metadata expires after 90 days; bounce and complaint suppressions remain so Nora does not repeatedly send to an unusable address. We will update this Policy when the broader procedures are finalized.

Production replay is limited to a stable 5% sample of consenting anonymous browsers by default. Nora targets seven days for replay and 90 days for analytics events, subject to production-provider verification. Withdrawing analytics consent stops capture and removes the anonymous identifier from that browser. Existing anonymous provider data expires under retention or may require a separate privacy request because it is not mapped to your Nora account.

9. Security and international processing

Nora uses authenticated ownership checks, encrypted provider tokens, and server-side secrets, but no system is completely secure. Providers may process information outside your location, and information processed elsewhere may be subject to local laws and lawful access.

10. Your choices and rights

You can choose not to connect an institution, disconnect one, delete eligible connection data after provider removal, remove individual Chat threads or Boards, or stop using Nora. Depending on where you live, law may also provide rights to access, correct, delete, or receive a copy of personal information, or object to or restrict certain processing.

A self-service application-data export is available under Settings, Privacy & Data. Anonymous PostHog analytics and replay are not included because they are not mapped to your Nora account. Account-wide deletion is not yet implemented. To make a privacy request, email support@nora-fi.com.

11. Children and policy changes

Nora is not intended for children under 18. We may update this Policy when the product, providers or law changes. We will notify you of material changes where required.

Monthly spending plans

Nora stores the currency, planning timezone, monthly category targets, optional overall spending limits, revisions, and dates you choose in Budgets. You can exclude a transaction from budgets without removing it from financial history. Calculations use available stored records; when you ask budget questions in Chat, relevant saved targets, calculated results and limited category transaction evidence are sent to the existing Chat AI provider. Responses and evidence follow existing Chat history, export and retention rules. Budgets also reads existing confirmed recurring schedules and accepted allocations to estimate outstanding commitments, without adding a provider, stored forecast or retention period.

Disconnecting a bank stops updates. Deleting its connection data removes associated spending and exclusions from active calculations under the existing soft-deletion rules, while independent budget targets remain. Targets, exclusions, budget alert snapshots, deduplication markers and preferences are included in self-service exports. Budget alert history is retained independently when bank-connection data is deleted, under existing retention rules; alerts introduce no AI, email or push provider. Budget screens are excluded from session replay; operational monitoring returns aggregate counts and integrity status. Existing retention and account-deletion limitations apply.

Usual budgets are versioned from an effective month, with explicit month-only exceptions. Earlier months retain their previous configuration. Editable suggestions use average eligible spending across the previous three calendar months; incomplete imports may lower them. They are not affordability recommendations, do not use AI, and are saved only when you choose. Ongoing versions and exceptions are included in your export.