Proof, not promises.

• Every account gets its own isolated database. We don't pool your transactions with anyone else's.
• We never ask for bank logins. By default nothing connects to your bank — you upload statement PDFs or OFX exports yourself. The only exception is opt-in: Pare can sync through SimpleFIN, a read-only bridge you pay and control directly.
• Uploaded PDFs are deleted right after they're parsed.
• We don't sell your data or run ad tracking.
• You can delete your account — and everything in it — at any time, yourself, from your profile.
• Prefer to trust no one? Pare is open source and self-hostable; run it on your own machine and none of this applies.

Your financial data doesn't live in a shared table behind an account_id filter — the usual place multi-tenant apps spring a leak. Each account gets its own database (a Cloudflare Durable Object with a private SQLite store), addressed by your account ID. Different user, different database. There is no query in the app that can cross between them:

// getRepoForUser — one Durable Object (one SQLite DB) per user
const id = namespace.idFromName(userId);
return repoOverDoStub(namespace.get(id));
// distinct userId -> distinct DO -> distinct DB,
// with no query that can cross between them.

An uploaded PDF sits in object storage (Cloudflare R2) only long enough to be read into transactions, then it's dropped. We don't keep your original statements. The parse pipeline deletes the file as soon as it records a success — here's the exact line:

// after a successful parse, the PDF is dropped
await jobStore.markDone(userId, jobId, { inserted, skipped });
await deletePdfBestEffort(pdfStore, r2Key, jobId); // -> pdfStore.delete(r2Key)

// and on account deletion, every stored object under
// the user's prefix is purged — see purgeUserPdfs()
// in lib/storage/pdf-store.ts.

Deletion is the default, not an option you have to find. What stays is the parsed data — transactions, balances, the categories and goals you create — in your isolated database, until you remove it.

The hosted service has no link to your financial institution. There's no “connect your bank” step, no stored bank credentials, and no third-party aggregator (Plaid and the like) sitting between you and your accounts. You export a statement PDF and hand it over — that's the entire ingest path, which means there's no standing connection for anyone to abuse or resell.

The one exception is explicitly yours to choose: Pare can optionally sync through SimpleFIN Bridge — a read-only service you sign up for and pay directly, and can revoke at any time. Even then, your bank credentials live at the bridge, never in Pare; Pare only holds an access token that can read transactions, nothing more. It is off until you turn it on.

We do not sell your data, share it for advertising, or run analytics SDKs and ad trackers. There are none in the app; you can confirm that in the source.

Mint shut down and took its users' workflow with it. Pare can't do that to you: the whole app is public on GitHub and self-hostable. If the hosted service ever goes away, you run the same code on your own machine, where your data never leaves your computer. Open source is also why the claims on this page are checkable — you can read exactly what handles your data.

Account identity.Your email address and a display name, used to sign you in and to send account-related email (like password resets). Your password is stored only as a salted hash — we can't read it.

Financial data you give us. The statement PDFs and OFX/QFX exports you upload, and everything parsed from them: transactions (date, description, amount), account balances, and the categories, rules, goals, and notes you create. This is your data; we process it only to show you your own dashboards.

Operational logs. Basic request and error logs needed to keep the service running and to fix bugs — see What we log below for exactly how those are scrubbed.

We do not collect analytics or advertising identifiers, and there are no third-party trackers.

Pare runs entirely on Cloudflare. Within that:

• Your financial datalives in a per-account database (a Cloudflare Durable Object with its own SQLite store). One account, one database — there is no query that can reach another account's data.
• Account identity (email, name, password hash, sessions) lives in a separate authentication database (Cloudflare D1), kept apart from your financial data.
• Uploaded PDFsare held briefly in object storage (Cloudflare R2) only while they're being parsed, then deleted.
• Upload job status(a “parsing… done” record) sits in a short-lived key-value store (Cloudflare KV) and expires within a day.

In transit: every connection is TLS-encrypted, end to end.

At rest: your data is encrypted on disk by Cloudflare. To be precise — and this is where a lot of finance apps overstate things — those keys are managed by the platform, not derived from your password. That protects against a stolen disk or a storage dump; it is not zero-knowledge, and we don't claim “only you can read your data.” To parse statements and build your dashboards, the server works with your data in the clear, in memory, during that processing. The real isolation guarantee is the per-account database above, not a key only you hold. We spell this trade-off out on the security page rather than paper over it.

There are no analytics or advertising trackers. We keep basic operational and error logs to run the service and fix bugs, and error reports are scrubbed of personal data before anything is recorded — email addresses are masked, and auth tokens, cookies, request bodies, and query strings are stripped out:

sendDefaultPii: false, // no IPs, cookies, or user records attached
// beforeSend redacts before the event leaves the process:
const REDACT_HEADERS = ["authorization", "cookie", "set-cookie", "x-captcha-response"];
delete request.cookies;          // drop cookies + bodies + query strings whole
value.replace(EMAIL_RE, "[email]"); // mask any email that slips into a message

• Uploaded PDFs:deleted immediately after parsing — they aren't meant to outlive the upload.
• Parsed financial data & account: kept until you delete it or close your account.
• Upload job records: auto-expire within 24 hours.
• Error logs: retained briefly for debugging and already stripped of personal data.

You can permanently delete your account from your profile page (Danger zone → Delete account). It's a real, hard delete: we drop your entire per-account database, purge any stored PDFs, and delete your sign-in identity. There is no soft-delete and no recovery — once it's gone, it's gone.

Want to keep your data but clear it out? The same page lets you wipe your transactions while keeping your account and rules, or export everything (CSV/JSON) first.

If you'd rather we handle a deletion or have a question about your data, email privacy@pare.money.

Cloudflare is our infrastructure provider (a data processor): the app, databases, storage, and the bot-protection step all run on Cloudflare. We use Cloudflare Turnstileon the sign-up and sign-in forms to block bots; it may set a token in your browser solely to confirm you're human, and is not used to track you.

Resend sends transactional email (such as password resets) when that feature is enabled. SimpleFIN Bridgeis involved only if you opt in to bank sync — you contract and pay them directly, and can revoke Pare's access token at any time. We don't use any other third parties to process your data, and we never sell or share it for advertising.

Pare is offered to users in Canada and the United States. Cloudflare processes data across its global network; your account's database is a single logical store within that network.

Found something that looks like a data-exposure or security bug? Email security@pare.money with the details and how to reproduce it, and please don't test against other people's accounts — self-host an instance to probe instead. More on the security posture, and the limits we're honest about, on the security page.

If this policy changes in a meaningful way, we'll update the date at the top and, for material changes, let account holders know. Questions, requests, or concerns: privacy@pare.money.