Privacy

What Stonehand collects, where it is kept, how long it stays, and how to get it back or have it removed.

Version 2.0 · draft of 28 August 2026 · not yet reviewed by counsel

Stonehand is a private ledger for a household and the businesses it keeps. Anyone can sign up and their books are their own: separate from every other household, visible only to the people they invite. This policy describes what happens to that information.

Stonehand does not sell data, does not serve advertising, and runs no advertising or profiling analytics. There is no third-party analytics script on the application, no advertising identifier, and no behavioural profile. Nothing here is monetised by being looked at. Stonehand is paid for by subscription, and that is the whole of the business model.

Your financial data is never used to train an AI model — not ours, and not anybody else's.

What is collected

What you give us

Your account. Email address, display name, and the password or passkey held by our authentication provider. Stonehand never sees or stores your password.
Your household. Its name, the entities in it — people, companies, trusts — and the roles of anyone you invite.
What you record. Accounts, balances, transactions, categories, budgets, goals, bills, debts, property, equipment, inventory and valuations.
Documents you upload. Statements, receipts, deeds, tax forms.
Dates of birth, where you record them, which are used for a person's age and for the date a custodial account hands over. Nothing else.

What your bank gives us, with your permission

Bank connections are made through Plaid. When you connect an institution, Plaid returns account names, balances, transactions and — where the institution provides them — liability terms and investment holdings. Stonehand stores an encrypted access token for that connection.

Every bank connection is read-only. Stonehand cannot move money, cannot make a payment, and is not built to. There is no code path in the product that initiates a transfer.

Plaid handles your bank credentials directly; Stonehand never receives them. Plaid's own handling is governed by Plaid's end-user privacy policy.

What the service records on its own

An audit trail. Who changed what, and when. It is append-only and cannot be edited or deleted from inside the application. Bank tokens, tax identifiers and payment references are redacted before they are written to it.
Operational logs. Request paths, status codes and errors, kept to run the service. They are not joined to a profile.
Nothing else. No device fingerprint, no advertising identifier, no cross-site tracking, no session replay.

How it is used

To show you your own money — the whole of the product.
To categorise transactions and suggest rules, which happens on our own servers against your own history.
To read documents you upload. Text extraction runs inside the service; the file is not sent to a third-party document service.
To answer questions you ask in Ask Stone, and to answer an assistant you have connected. See Assistants and AI below.
To send the emails you have asked for: an invitation, a weekly summary, an alert you configured.
To take payment for a subscription, through Stripe.

Legal bases, where the GDPR applies: performance of the contract for the first six; consent for bank connections and marketing email; and legitimate interests for security, fraud prevention and keeping the service running.

Assistants and AI

Stonehand can be connected to an AI assistant — Claude, ChatGPT and anything else that speaks the Model Context Protocol. That connection is entirely under your control:

You approve it once, on a screen that lists what it will be able to read. The list is generated from the same table that decides what the token actually receives, so it cannot say one thing and grant another.
It creates a token you can see and revoke in Settings. Revoking it disconnects the assistant immediately.
A connected assistant can read; it cannot move money. Nothing connected to Stonehand can, because Stonehand cannot.
What you send to an assistant is governed by that assistant's own policy. When you ask Claude about your budget, your budget goes to Anthropic under Anthropic's terms. Stonehand cannot control what a third party does with what you choose to send it.

Inside Stonehand, Ask Stone answers from a fixed set of named queries against your own data. It does not write free-form database queries, and your figures are not sent to a third-party model to produce them.

Nothing in Stonehand is financial, tax, investment or legal advice. It shows you your own figures and does arithmetic on them. An answer from Ask Stone or from a connected assistant is a reading of your books, not a recommendation, and it is not a substitute for a professional who knows your circumstances.

Cookies

Stonehand sets four cookies and none of them is for tracking. There is no advertising cookie, no analytics cookie and no third-party cookie, which is why there is no consent banner asking you to accept any.

Cookie	What it does	Lasts
Clerk session	Keeps you signed in	Until you sign out
`sh_household`	Which household you are looking at, if you belong to more than one	1 year
`sh_mode`, `sh_scope`	Which side and which entity the screens are showing	1 year
`sh_mine`	Whether you have asked to see only your own things	7 days

The last three are view preferences. None of them is an identity: what you are permitted to see is decided from your membership every time, never from a cookie.

Who else touches it

These are our sub-processors. Each one is used for the single purpose named, and none of them is permitted to use your data for their own ends.

Who	What for	Where
Plaid	Bank connections, read-only	United States
Clerk	Sign-in, passwords, multi-factor	United States
Railway	Hosting and the database	United States
Cloudflare	Document storage, DNS	United States
Stripe	Subscription payments	United States
Resend	Transactional email	United States

Stonehand does not share your data with anyone else, other than where the law requires it — a subpoena, a court order, or a legal obligation we cannot lawfully refuse. If that happens and we are permitted to tell you, we will.

Children

A household may keep books for a child of any age: a custodial account, a savings goal, a page of their own. That is a parent recording their own family's money, and it is what Stonehand is for.

A child under 13 cannot be given a login. Stonehand does not create accounts for children under 13 and does not knowingly collect personal information from them. The control that grants a child their own sign-in refuses below that age, and refuses when no date of birth has been recorded.

A child aged 13 or over may be given a login by a parent. It is read-only and narrowed to that child: their own accounts, their own goals, their own history, and nothing else in the household.

If you believe a child under 13 has an account, write to privacy@stonehand.family and it will be removed.

How long it is kept

What	Kept
Your books — accounts, transactions, budgets, documents	Until you delete them, or 30 days after you close your household
Bank access tokens	Until you disconnect the institution, then immediately
Assistant tokens	Until you revoke them — they do not expire on their own
Authorization codes (during a connection)	60 seconds
Audit trail	7 years, then deleted
Operational logs	30 days
Invoices and payment records	7 years, as tax law requires
Backups	35 days, then overwritten

When you close a household, it is scheduled for deletion and removed after 30 days. The delay is a safety net against a mistaken deletion, not a retention period — say so and it goes immediately.

Your rights

See it. Everything about you is on the screens you already use.
Take it. Export your books as CSV or a spreadsheet, at any time, without asking. There is no export fee and no export queue.
Correct it. Every figure is editable by the people you have given the right role.
Delete it. Delete a record, a household, or your account.
Object, or withdraw consent. Disconnect a bank, revoke an assistant, or turn off an email — each is a control in the product rather than a request to us.

If you are in California, the CCPA gives you rights to know, delete, correct and opt out of sale or sharing. Stonehand does not sell or share personal information as those terms are defined, and has not in the preceding twelve months. Exercising these rights will never get you a worse service or a worse price.

If you are in the EEA or the UK, you have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your supervisory authority.

Write to privacy@stonehand.family. We answer within 30 days.

Where it is kept, and how

Data is stored and processed in the United States. If you are outside it, using Stonehand means your data is transferred there. Transfers from the EEA or UK rely on the Standard Contractual Clauses.
Everything travels over TLS.
Bank access tokens and authorization codes are encrypted at rest with a key held separately from the database.
Every query is scoped to your household in the data layer, not in the interface — a bug in a screen cannot show you somebody else's money.
Sign-in is handled by Clerk, and multi-factor is available. We strongly recommend it.

No system is perfectly secure, and anybody who tells you otherwise is selling something. If there is a breach affecting your data, you will be told without undue delay and in any case within 72 hours of us becoming aware.

Changes

If this policy changes materially, the people using Stonehand are told directly — by email and in the application — rather than being left to notice a new date on a page. The version and date at the top always say which one is in force.

Contact

Privacy questions, an export, or an erasure request: privacy@stonehand.family.
Anything else: contact@stonehand.family.

Stonehand is operated by Torinagi LLC, Virginia, United States.