Your data

Where it lives, who else touches it and what each of them sees. Then how to take all of it with you, and how to have it deleted.

Who processes it.

Ten rows. Seven of them only apply if you switch that thing on.

Services that process your data, when, what they see and how you control it
Who	When	What they see	Your control
Supabase Database, sign-in and file storage	Always. It is where Clementine keeps your records.	Your email address and a scrambled (hashed) copy of your password Everything you enter or import: transactions, categories and limits, bills, goals, invoices and clients, tax records, settings Receipt photos you attach to deductions The keys that connect your bank feed, Gmail and AI, each one encrypted before it is stored	Download all of it whenever you like. Ask for it to be deleted and it is.
PocketSmith Bank feed	Only if you connect a bank feed. Today that means connecting your own PocketSmith account.	Your bank connections, balances and transactions, which you set up with PocketSmith directly Requests from Clementine, made with a key you paste in, to read those transactions and to ask a feed to refresh Clementine never sees or stores your bank login.	Disconnect under Account, Connections. What was already imported stays in Clementine until you remove it. Switching one account off deletes its imported transactions.
Google Gemini AI sorting	Unless you switch AI off under Account, AI. Today AI sorting uses a Google Gemini key you supply. With the next app release, Plus, Sole Trader and the trial use Clementine’s own key within a daily allowance; your own key stays an option on any plan, and AI can be switched off.	The public name of a business you paid, such as a supermarket or a streaming service The names of your categories, so it can choose one Never amounts, dates, account names, reference numbers or the bank’s own description. Payments to people, transfers, PayID and BPAY lines are not sent at all.	Switch AI off, or choose your own key, under Account, AI. Categories already chosen stay.
Google Gemini Ask Clementine (answers to your questions)	Only when you ask a question.	Your question The figures and dates that answer it, worked out by Clementine first, with your category names Never your transactions or account details. The names of people and businesses are replaced before anything is sent, and any amount in the reply must match Clementine’s own figures or it is not shown.	Switch AI off under Account, AI, which turns Ask off too. Conversations are kept only in your browser.
Google Gemini AI subscription finding (optional, off unless you switch it on)	Only if you turn it on as well as AI sorting.	From billing emails the ordinary rules could not read: the sender’s domain, the subject and a short excerpt of the billing sentences, including the service name and price From repeating bank charges: the merchant’s name, how often it repeats, the amount rounded to whole dollars and how many times it has been charged Names, addresses, email addresses, links, card endings and long numbers are removed before anything is sent.	Leave it off, or turn it off again, under Account, AI.
Google Gmail Payslips, subscriptions and sending invoices	Only if you connect Gmail. Read access and permission to send are asked for separately.	A payslip scan, when you start one, searches the senders you name for payslip PDFs Subscription scanning, once you turn it on, looks for billing emails and repeats in the background until you turn it off Invoices you send go out from your own address Clementine searches for those emails only, and it does not send anything you did not ask it to.	Turn subscription scanning off, or disconnect Gmail, under Account, Connections. Disconnecting withdraws the permission at Google.
Stripe Payments	Only if you pay for a plan.	Your email address, the plan you chose and the card details you type on Stripe’s own page Clementine never sees or stores your card number. It keeps a customer reference and which plan you are on.	Receipts, card changes and cancelling are on your account page, in two clicks.
Apple, Google or Mozilla Reminders on your phone or computer	Only if you turn reminders on for a device.	A short notice passed through your browser’s own notification service. The text on the lock screen is generic Names and amounts stay in Clementine.	Turn reminders off under Account, Notifications, or in your browser.
Your calendar app Calendar sync	Only if you switch on the calendar feed and add its private address to a calendar.	Names and due dates of bills, renewals, invoices and goal deadlines No amounts.	Switch the feed off under Account, Calendar and its address stops working.
DuckDuckGo and Google icon services Company logos	When the app shows a logo beside a business or a bank that does not come with Clementine. DuckDuckGo is asked first; Google only if DuckDuckGo has no icon.	The website address of that business, asked for by your browser, along with your internet address as any website sees it Nothing about your account, your transactions or your amounts. The request carries no cookies and no referrer.	None in today’s app: if no logo is found it shows initials instead. The next app release adds a "Show merchant logos" switch that stops these requests.
Wikidata Finding a company’s website	Only when you press "Find company website" while editing a subscription.	The company name you typed, asked for by your browser, along with your internet address Nothing about your account, your transactions or your amounts.	Don’t press it: type the website yourself, or leave it blank.

What Clementine does not do with it

It does not sell it, rent it or share it for marketing.
It does not use it to pick loan, card or insurance offers for you, and it takes no payment from anyone who would.
It does not hand your transaction list to an AI model. AI sorting works from a business’s public name and your category names. The optional subscription finding sends a little more, set out in the table, and stays off unless you turn it on.

Independent and staying that way

Export everything

In the app, open Account, then Your data, and choose Download everything. You get one zip file with:

a spreadsheet (CSV) for each kind of record: transactions and their split lines, categories, accounts and balances, bills, subscriptions, goals and buckets, invoices and clients, tax income, deductions and settings;
one JSON file with everything exactly as it is stored, for moving to other software;
a guide to what each file and column means, and how to check the totals against the app;
your receipt photos, unless you untick them for a smaller download.

The zip is put together on your own device. It is free on every plan and still works after a plan ends. Passwords and the keys that connect your bank, Gmail and AI are never included. A guide to the export

Delete your account

There is no delete button in the app yet, so deletion is done by hand, by a person. Email [contact address to be confirmed by Will] from the address on your account and ask for it to be deleted. We reply to that address to confirm it is you. Then, in this order: we cancel any paid plan so nothing more is charged, delete your receipt photos from file storage, and delete your account. That last step removes your sign-in and every record stored under it in Clementine’s database (transactions, splits, plans, goals, invoices, tax records, imports and the encrypted keys for your connections) as one change: it all goes, or nothing does. We email you when it is done.

If you set up a shared household, it closes with your account: your partner stops seeing your money and goes back to their own view, and nothing of theirs is deleted. If you joined someone else’s household, you simply leave it.

The database’s automatic backups are not edited by hand; your data drops out of them as they expire, after [backup retention period to be confirmed by Will].

Download your export first: deletion cannot be undone. Records we are required by law to keep, such as the receipts for payments you made to us, are kept for as long as the law requires and no longer.

Deleting your Clementine account does not close your PocketSmith, Google or Stripe accounts. Disconnect them in the app first, or with those services directly.

Questions

The privacy policy is the formal version of this page. For anything it does not answer, write to [contact address to be confirmed by Will].

Join the founding list

Sign-ups are not open yet. Leave your email and we will write once, when founding places open. Founding members pay A$59 a year for Plus or A$129 for Sole Trader, fixed for life.

Not open yet. The founding list opens shortly. Until then this form is switched off, and nothing typed here is sent or stored.

That did not go through. Check the email address and tick the consent box, then try again. If you have tried several times, wait a minute first.

You are on the list.

We will write when founding places open. Nothing else will arrive before then, and you can unsubscribe from that email.