Privacy Policy
This Privacy Policy explains what data Cilantro collects, how we use it, and what choices you have. Cilantro is a personal-finance iOS app operated by Highloop ("we", "us"). If you have any question about this policy, email support@highloop.co.
1. What we collect
Information you provide
- Account credentials: your email address and password (the password is stored only as a salted bcrypt hash).
- Settings you choose inside the app: base currency, privacy preferences, pinned questions, manual category overrides, and notes.
Financial data we read on your behalf, with your consent
- Connected institution and account metadata (institution name, account name, type, account-number mask, balance).
- Transaction history (date, amount, merchant, category, pending status, location when provided by your bank).
- For accounts you connect, the access token issued to Cilantro by Plaid. Access tokens are stored encrypted at rest using AES-256-GCM with a server-held key.
Information generated by your use of Cilantro
- Questions you ask the AI assistant inside the Ask tab.
- App diagnostics (errors, response times) we collect to improve the product. We do not collect device-identifying advertising IDs.
2. How we use your data
We use your data only to:
- Authenticate you and operate your Cilantro account.
- Power the features inside the Cilantro app: dashboard, search, anomaly detection, subscriptions, forecast, money flow, year-in-review, and natural-language Q&A.
- Generate AI answers to your questions through Anthropic's API. Only the data necessary to answer your question is sent (your accounts, recent transactions, and detected subscriptions). See Anthropic's Privacy Policy.
- Communicate with you about your account or critical service issues.
- Comply with legal obligations and respond to valid legal process.
We do not sell, rent, or share your data with advertisers, data brokers, or marketers. We do not use your transaction data to build advertising audiences, and we do not train external machine-learning models on your transaction history.
3. Third-party services
- Plaid — connects your bank accounts and provides transaction data. Plaid's collection and use of data is governed by the Plaid End User Privacy Policy.
- Anthropic — powers the natural-language Q&A feature. Inputs and outputs are subject to Anthropic's Privacy Policy.
- Cloud infrastructure (Google Cloud) — hosts Cilantro's backend and database in the United States.
4. Data security
- All connections to Cilantro use TLS in transit.
- Plaid access tokens are encrypted at rest with AES-256-GCM.
- User passwords are stored as bcrypt hashes; we never see your plaintext password.
- Access to production data is limited to authorized engineering staff and is logged.
- Cilantro requires Face ID / passcode confirmation before initiating a new bank connection from the iOS app.
5. Data retention
We retain your data while your account is active. You can disconnect any linked institution at any time from Settings → Linked Banks; doing so deletes the corresponding access token, accounts, and transaction history from Cilantro and revokes the token at Plaid. To delete your entire account and all associated data, see Delete your account for the full process; we fulfill the request within 30 days.
5a. Cookies and tracking
This website does not set tracking cookies, run analytics pixels, or embed third-party advertising tags. The Cilantro iOS app does not include third-party SDKs that send data to advertisers or data brokers. The only cookie set anywhere is a session cookie for staying signed in, served on a same-origin first-party basis.
6. Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Delete your data ("right to erasure" / GDPR Article 17 / CCPA "right to delete").
- Port your data to another service.
- Object to or restrict certain processing.
To exercise any of these rights, email support@highloop.co. We may request information to verify your identity before fulfilling the request.
7. Children
Cilantro is not directed to children under 13 and we do not knowingly collect data from them.
8. International users
Cilantro is operated from the United States. By using the app you understand that your data will be processed in the U.S.
9. Changes to this policy
We will post any changes to this policy at this URL and update the "Last updated" date above. Material changes will also be notified in-app or by email.
10. Contact
Highloop · support@highloop.co