Privacy Policy

Effective date: September 20, 2026 · Applies to the BeaTris mobile application and related services.

BeaTris rounds up your everyday purchases to the next dollar and turns that spare change into steady giving for your congregation or community organization. This policy explains exactly what we collect, why, who touches it, and the controls you hold. It is written to be read, not skimmed past.

1. What we collect, and the single purpose of each item

• Email address: to create and secure your account, and to send required giving disclosures (for example, notice before any charge).
• Display name (optional): how you appear to your own organization's community feed, if you choose to appear at all.
• Transaction amounts, dates, and merchant names (read-only, via Plaid): solely to compute your roundups. This connection cannot move money.
• Giving activity inside BeaTris (roundup balance, donation history, participation streaks, milestones): so you can see your own impact.
• Organization affiliation: which congregation or partner organization your giving supports.

That is the whole list. We collect nothing beyond what the service needs to operate.

2. What we never see or store

We do not sell your data. We do not share it with advertisers or data brokers. There is no advertising in BeaTris.

3. Who processes your data

Five service providers process data on our behalf, each doing one job:

• Plaid: connects your bank in read-only mode and supplies the transaction data used to compute roundups (Plaid's privacy policy).
• Stripe: processes donations and moves 100% of your gift to your organization's account (Stripe's privacy policy).
• Supabase: hosts our database and authentication with row-level isolation (Supabase's privacy policy).
• Resend: delivers the emails we are required to send you, such as notice before any charge. It receives your email address and the contents of that notice (Resend's privacy policy).
• Google (Gemini): writes the short impact narrative you see after a gift settles. It receives only your organization's name, your charity's name, and how many months you have participated. Never your name, your email, or any dollar amount (Google's privacy policy).

No other third party receives your personal data.

4. What your community sees

Giving at BeaTris is about showing up, not showing off. Community feeds show participation, such as "Someone gave to First Baptist Food Pantry," and never dollar amounts. In the app-wide feed you are always anonymous and only the receiving organization is named; you can opt out of appearing there entirely. In your own organization's feed you are anonymous by default and choose what to reveal. Your individual giving amounts are visible only to you.

5. How your data is protected

• Bank-connection tokens are encrypted at rest (AES-256-GCM) and exist only on our servers, never on your phone.
• Every member's records are isolated at the database level (row-level security): one member's data is technically unreadable from any other account.
• Linking a bank requires multi-factor authentication.
• Financial records can be written only by our audited server functions, never directly by an app or browser.
• The app pins our server's certificate chain to resist interception.

6. Your controls

• Pause giving at any time, set a monthly cap, and set your own charge threshold.
• Advance notice before every charge, with time to pause or adjust before any money moves.
• Unlink your bank at any time. Unlinking permanently deletes the stored bank-connection tokens.
• Delete your account at any time, in the app: Profile → "Delete my account." This unlinks your bank at Plaid, deletes your Stripe payment profile, and permanently erases your account and giving history from BeaTris. You can also request deletion by emailing the address below.

7. Data retention

We keep your data only while your account exists. When you delete your account, your records are erased immediately. Records of completed donations may persist at Stripe (the regulated payment processor) and with the receiving organization, as required for financial and tax recordkeeping; those records are governed by their policies.

8. Children

BeaTris requires a bank account and is not directed to children. You must be at least 18 (or the age of majority where you live) to create an account. We do not knowingly collect data from children under 13; if you believe a child has created an account, contact us and we will delete it.

9. Changes to this policy

If this policy changes in any material way, we will notify you by email and in the app before the change takes effect. The effective date at the top always reflects the current version.