Privacy Policy

Last updated: September 22, 2026

Introduction

Pane is a hosted MCP (Model Context Protocol) server operated by Real Design, Inc. ("Company," "we," "us," or "our") that connects your financial data to AI tools. Operated at pane.money, Pane lets you link your bank accounts once and access them through Claude, ChatGPT, Cursor, or any AI service that supports MCP.

This privacy policy describes what data we collect, how we use it, and how we protect it. Optional analytics and AI data sharing have separate consent controls in Settings.

Information We Collect

Account Information

Email address (required, unique identifier)
Display name (from OAuth provider or user-provided)
Profile image URL (from OAuth provider)
Email verification status and timestamp

Authentication Data

Google OAuth tokens (access token, refresh token, ID token, scopes) stored in our accounts table
Magic link verification tokens (email, token, expiration) that expire after use
WebAuthn/passkey credentials (credential ID, public key, signature counter, device type, transport methods)
Session tokens stored as JWE-encrypted cookies (__Secure-authjs.session-token) with HTTP-only and Secure flags enabled

Financial Data (via Plaid)

New Plaid connections request only the transactions product. Depending on the institution, we collect:

Financial institution names and identifiers
Account names, types (depository, credit, loan, investment), subtypes, and last 4 digits
Account balances (current, available, credit limit)
Transaction history: date, amount, currency, merchant name, transaction name, category, pending status
Previously stored recurring transactions may remain in your account; recurring views and tools are deferred.
Plaid access tokens encrypted at rest using AES-256-GCM with unique initialization vectors
We do not request optional investment, liability, or recurring products for new links, or auth (account numbers) or identity (personal identification).

Pane stores transactions, balances, account metadata, and institution information. Net Worth uses stored balances rather than requesting a live balance refresh. Advanced investment, liability, spending, and bundled insight features are deferred.

Billing Data (via Stripe)

Stripe customer ID and subscription ID
Subscription status (active, past_due, canceled, unpaid, trialing)
Plan type
Payment card details are never stored by Pane. All payment processing is handled by Stripe.

API Keys (for MCP Access)

Bcrypt-hashed key (cost factor 13, never stored in plaintext)
Display identifier with the fixed pane_sk_live text and only the key's final four random characters
User-defined label
Creation, last-used, and revocation timestamps

How We Use Your Information

To provide the Pane service (connecting financial data to AI tools via MCP)
To authenticate your identity and maintain sessions
To sync and display your financial data from linked institutions
To process fixed-tier subscription billing and determine access
To enforce privacy scope settings you configure (full, balances_only, balances_and_redacted, hidden)
To provide account and transaction views, stored-balance Net Worth, and annotations
To provide privacy-filtered MCP access and consent-gated Pane Chat

Privacy Controls

Each financial account has an authoritative privacy scope that controls the supported model-facing reads. Institution-level edits update the linked accounts together:

Full

Permitted account and transaction details are visible to AI tools; credentials and provider metadata are excluded.

Balances only

Only account balance information; no transactions or merchant details

Balances and redacted

Balances and transactions visible, but merchant names replaced with "Redacted"

Hidden

Account completely hidden from MCP and not visible to any AI tool (still visible to you in the web dashboard)

You can change privacy scope at any time via the web dashboard. Privacy filtering is enforced in the services layer before any data reaches MCP clients.

Third-Party Services

Plaid (Financial Data)

Plaid connects to your financial institutions and provides transaction and account-balance data. New links request the transactions product only, without optional products. We do NOT request auth (account/routing numbers) or identity (SSN, address, phone).

Plaid's privacy policy applies to data they collect: https://plaid.com/legal

Unlinking first confirms Plaid revocation (or a recognized already-removed item) before removing the linked source, its accounts, and dependent records from the live database. A failed provider request retains local records so you can retry.

OpenRouter (AI Chat)

When you enable AI data sharing, Pane uses OpenRouter to generate chat responses and personalized suggestions. Chat prompts, model responses, and selected privacy-filtered financial data may be sent to OpenRouter and its configured model providers for this processing.

Statement imports and file uploads are retired. Wallet/crypto features, new FinanceKit linking, and new outbound webhook delivery are also retired. Previously stored data can remain subject to the retention policy. You can revoke AI data-sharing consent in Settings.

OpenRouter's privacy policy: https://openrouter.ai/privacy

Stripe (Billing)

Stripe processes all payments. We store only your Stripe customer ID and subscription ID. We never store your payment card details.

Stripe's privacy policy: https://stripe.com/privacy

Crisp (Customer Support Chat)

Crisp is not mounted in the current application. Historical provider-held messages and browser state are not erased by removing the integration.

Crisp's privacy policy: https://crisp.chat/en/privacy/

PostHog (Analytics, Optional)

With analytics consent, PostHog receives minimized page views and explicit usage events. User ID and email may be associated after account and consent checks. Automatic capture and session recording are disabled. PostHog can use localStorage and cookies for identity/session state. Remote feature-flag evaluation is retired.

PostHog's privacy policy: https://posthog.com/privacy

Sentry (Error Monitoring, Optional)

When enabled, Sentry receives bounded operational error metadata and sanitized stack-frame identifiers. Request bodies, URLs, user identity, free-text error values, and breadcrumbs are removed from the standard event body. Performance tracing, profiling, and Replay are disabled. Provider network and envelope metadata are separate from this event-body filtering.

Sentry's privacy policy: https://sentry.io/privacy

Resend (Email)

Magic link authentication emails are sent via Resend from noreply@pane.money. Resend processes your email address to deliver authentication emails.

Resend's privacy policy: https://resend.com/legal/privacy-policy

Google (OAuth)

If you sign in with Google, we receive your email, name, and profile picture. We store Google OAuth tokens to maintain your sign-in session.

Google's privacy policy: https://policies.google.com/privacy

Data Security

Plaid access tokens encrypted at rest with AES-256-GCM (unique IV and auth tag per token)
Encryption master key stored in environment variables, never in source code
Session tokens encrypted as JWE (AES-256-CBC with HMAC-SHA512) using HKDF-derived keys
API keys hashed with bcrypt (cost factor 13) with plaintext never stored
Public application traffic uses HTTPS; Cloudflare provides customer-zone DNS and Render provides the managed application edge
The deployment configuration uses internal database and cache connections
Redis-backed rate limits apply to authenticated API, MCP, and other sensitive operations; limits depend on the operation and plan
Structured logging with PII redaction (Pino)

Data Breach Notification

In the event of a data breach that compromises the security, confidentiality, or integrity of your personal or financial data, we will:

Investigate and take steps to contain the breach as quickly as possible
Notify affected users via email without unreasonable delay, and no later than as required by applicable law
Provide information about the nature of the breach, the types of data affected, steps we are taking to address it, and recommended actions you can take to protect yourself
Report the breach to relevant regulatory authorities as required by applicable law

Data Sharing

We do NOT sell your personal or financial data
Financial data is shared with AI tools through your personal MCP endpoint according to your privacy scope settings, and with OpenRouter for chat and personalized suggestions only after AI data-sharing consent
We share data with third parties only as described in the Third-Party Services section
We may disclose data if required by law, legal process, or to protect our rights

Data Location and Transfers

Pane's infrastructure, including our database and application servers, is hosted in the United States. By using Pane, you consent to the transfer and processing of your data in the United States. Third-party services (Plaid, Stripe, PostHog, Sentry, Crisp, Resend) may process data in their own data centers, which may be located outside your country of residence. Please review their respective privacy policies for details on their data handling locations.

Your Rights

Access

View all your data in the Pane web dashboard

Correction

Update your account information at any time

Deletion

Request support-assisted deletion at support@pane.money. Support verifies the account before cleanup. If you have an Apple subscription, cancel it in the App Store first; deletion waits until it is no longer active. Public API and MCP deletion are not available. See the Data Retention policy)

Portability

Settings provides a bounded JSON export of supported database records, once per hour. It includes allowlisted profile, source, account, transaction, stored recurring, annotation, consent, audit, and API-key metadata. It excludes credentials, uploaded files, provider payloads, and some retained records; it is not a complete account archive or a single database snapshot. Contact privacy@pane.money for a broader access request.

Privacy Controls

Configure per-account privacy scopes

Revocation

Revoke API keys instantly; unlink financial institutions at any time

For privacy inquiries, contact privacy@pane.money

State-Specific Privacy Rights (United States)

California (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and California Privacy Rights Act:

Right to know: You may request the categories and specific pieces of personal information we have collected about you, the categories of sources, our business purpose for collecting it, and the categories of third parties with whom we share it
Right to delete: You may request deletion of your personal information. Account deletion requests can be started through the support link in Settings or by contacting privacy@pane.money.
Right to correct: You may request correction of inaccurate personal information
Right to opt out of sale or sharing: We do not sell or share your personal information for cross-context behavioral advertising. There is no need to opt out because no sale or sharing occurs.
Right to non-discrimination: We will not discriminate against you for exercising any of these rights

Categories of personal information collected: Identifiers (email, name), financial data (account balances, transactions), internet activity (analytics, error logs), inferences (spending summaries, categorization).

To exercise these rights, contact privacy@pane.money. We will verify your identity before processing any request. We aim to respond within 45 days.

Virginia, Colorado, Connecticut, and Other States

Residents of states with comprehensive privacy laws (including Virginia VCDPA, Colorado CPA, Connecticut CTDPA, and others) have similar rights to access, correct, delete, and port their personal data. We do not sell personal data or use it for targeted advertising. To exercise any state privacy rights, contact privacy@pane.money.

Canadian Privacy Rights (PIPEDA)

If you are a Canadian resident, the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws provide you with additional privacy rights.

Meaningful Consent

We obtain your meaningful consent before collecting, using, or disclosing your personal information. By creating a Pane account and linking your financial institutions, you consent to the collection and use of your data as described in this policy. You may withdraw consent at any time by deleting your account.

Purpose Limitation

We collect and use your personal information only for the purposes identified in this policy: providing the Pane service, processing payments, maintaining security, and improving our service through optional analytics.

Access and Correction

You have the right to access and correct your personal information. You can view your data through the Pane dashboard and update your account information at any time. For additional access requests, contact privacy@pane.money.

Retention

We retain your personal information only as long as necessary to fulfill the purposes for which it was collected. When you delete your account through support, cleanup removes the supported live records and owned storage objects. Provider retention, recovery copies, and other exceptions are described in our Data Retention policy.

Accountability

Our privacy officer is responsible for our compliance with PIPEDA. For privacy inquiries or complaints, contact privacy@pane.money. If your concern is not resolved to your satisfaction, you may file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

Cookies and Tracking

__Secure-authjs.session-token: JWE-encrypted session cookie. HTTP-only, Secure. Essential for authentication.
PostHog cookies (when analytics enabled): Used for anonymous usage tracking. Can be blocked without affecting core functionality.
Google Analytics and X Ads: These integrations are retired and are not mounted.
Crisp: This integration is retired and is not mounted. Historical browser/provider data may remain.

PostHog is the current optional browser analytics integration. It requires consent and account checks. Withdrawal blocks local collection and resets known browser state; changes made on another device are checked on focus and periodically. Pane does not respond to Do Not Track (DNT) browser signals as there is no industry standard for compliance. However, you can control tracking through the consent banner and privacy controls described above.

Children's Privacy

Pane is not intended for users under 18. We do not knowingly collect data from minors. If we learn that we have collected personal information from a child under 18, we will take steps to delete that information as soon as possible. If you believe we have collected information from a minor, please contact privacy@pane.money.

Changes to This Policy

We may update this policy from time to time. Material changes will be communicated through the Service or via email at least 14 days before they take effect. Changes will be posted at this URL with an updated "Last updated" date. Your continued use of Pane after changes take effect constitutes acceptance of the updated policy.

Contact

Real Design, Inc.

Email: privacy@pane.money