Privacy Policy

This policy explains what Stateful collects, why it is used, where it is processed, and the choices available to Early Access users.

Effective August 14, 2026 · Last updated October 13, 2026

Scope

Stateful is accounting software for real-estate investors. This policy applies to the Stateful web application, the Stateful iPhone and Android companion apps, and Founder Early Access. Stateful is not a bank, property manager, bookkeeping service, tax adviser, or financial adviser.

Information we process

• Account and profile data: email address, authentication identifiers, organization membership, role, and multi-factor authentication status. Authenticator secrets and credentials are managed by Supabase Auth; Stateful does not display your password.
• Property, entity, and ownership data: property details, legal entities, owners, economic interests, loans, fixed assets, and accounting configuration.
• Financial data: account metadata, balances, transaction dates, amounts, merchant and description data, categories, reconciliations, journals, and audit events.
• Plaid-connected data: institution and account identifiers, account names/types, balances, transaction and merchant data, sync state, and error state. Plaid access tokens are encrypted by Stateful before database storage. Stateful does not receive or store online-banking passwords.
• Documents: files you upload and extracted data created to support accounting workflows.
• Technical and security data: authentication events, request metadata, error codes, and limited diagnostic records. Telemetry is designed to avoid secrets, access tokens, full documents, and transaction descriptions.

How we use information

We use data to authenticate users, enforce organization boundaries, connect financial accounts, stage and code transactions, produce accounting records and reports, reconcile accounts, provide audit history, troubleshoot failures, secure Stateful, process account billing, and improve Early Access.

Mobile mileage, motion, and maps

With your permission, the iPhone app uses location to record trips and motion activity to identify potential drives. Optional automatic tracking uses background location. You can stop tracking or change location and motion permissions in iPhone Settings. Motion classification and detailed recorded GPS route points are processed on your device and are excluded from the normal workspace sync.

Trip dates, times, distance, business or personal classification, purpose, property assignment, and saved place or destination text can sync with your workspace. Place text may include a precise property address inferred from arrival at a saved property. These records are associated with your account and workspace. Apple Maps processes map, address lookup, and route-estimate requests under Apple’s privacy practices.

Android mileage and local storage

The Android app uses precise location when you start a GPS trip or explicitly enable optional drive detection. Both run as a foreground service with an ongoing notification and can continue when you switch to another app. Drive detection uses location and speed on the device to suggest trips for your review; it does not determine business purpose or tax treatment. Stop your trip and turn off drive detection in Stateful to end location tracking. Detection must be enabled again after the app process restarts. The Android app does not request Android’s background-location permission. You can manage location and notification permissions in Android Settings. Detailed GPS route points stay on your device during normal workspace sync; completed mileage records, including dates, distance, purpose, and property assignment, can sync with your workspace.

Android account sessions, local workspace records, and files received through Android sharing use Android Keystore-backed encryption. Shared files stay in a local inbox until you choose a signed-in workspace and save them; receiving a share does not automatically upload it. Optional app lock uses your device credential. Task reminders and mileage alerts are local notifications. Opening Google Maps sends the selected place or route addresses to Google under Google’s privacy practices. Automatic Android backup is disabled. User-created CSV, PDF, and ZIP exports are not encrypted by Stateful; ZIP backups can include original documents and route data. Choose a private destination and protect exported files.

Android text recognition and diagnostics

Android image text recognition uses Google ML Kit and processes recognition images and text on the device. ML Kit also sends technical information, performance and error events, API usage information, and per-installation identifiers to Google over HTTPS for diagnostics and usage analytics. This SDK processing is separate from uploading the receipt files you choose to sync with Stateful. See Google’s ML Kit data disclosure for details.

Mobile receipts, files, and notifications

The app uses camera or photo access only when you choose to capture or import a document. Text recognition runs on the device. Original receipt and invoice files, expense drafts, recognized text suggestions, and the details you confirm can be uploaded to private workspace storage. Imported originals are preserved and may contain embedded metadata, including location metadata supplied by the original file. Saved vendor contacts, including names, phone numbers, and email addresses, can also sync with your workspace. Authorized workspace users can access synced records.

Mileage and reminder notifications are generated locally on your device when enabled. You can manage notification permissions in your device settings. The native app does not use advertising identifiers or advertising-tracking SDKs. Website pages opened from the app follow the website practices described below.

Website analytics

We use Google Analytics on our public website to understand visits and traffic sources. Google Analytics may use cookies and process technical information about your browser and visit. We limit page URLs to public paths, remove query strings and fragments, and disable Google signals and advertising personalization in our tag configuration. The Google tag is not loaded on login or accounting pages. The iPhone email-verification page does not show an analytics prompt or initialize website analytics. We also use PostHog for limited page analytics. We do not use website analytics to track people across other companies’ apps or websites for advertising. We do not intentionally send accounting records, transaction descriptions, or authentication tokens to these analytics services. Browser privacy settings and content blockers can restrict analytics collection.

Analytics cookies are off until you accept them in the banner shown on your first visit. Your choice is stored on your device; declining changes nothing about how the site works. To change your choice later, clear site data for withstateful.com and the banner will appear again.

AI-assisted features

If an AI feature is enabled, Stateful may send only the content needed for the requested feature to OpenAI. AI output is assistive and cannot bypass deterministic posting, approval, RLS, or period-lock controls. AI features may be disabled by configuration. Do not upload material you are not authorized to process.

Billing

Stripe processes payment-card and billing information for an organization-level subscription through Stripe-hosted Checkout and its customer portal. Stateful stores Stripe customer, subscription, price, and status identifiers—not full card numbers. Promotion codes are handled by Stripe.

Service providers

Stateful currently relies on Vercel for application hosting, Supabase for database/authentication/storage, Plaid for financial-account connectivity, Stripe for subscription billing, GitHub for source control and deployment integration, and configured email delivery. Cloudflare Turnstile may be used for bot protection. OpenAI is used only when AI features are enabled. We limit the information given to each provider to what its service needs. We require providers acting on our behalf to protect user data to at least the level described in this policy through their applicable terms and safeguards. Providers that also have a direct relationship with you, such as Plaid, Stripe, and Apple Maps, provide their own privacy notices for those services.

Sharing

Stateful does not sell personal information. Data is shared with service providers only to operate the product, with organization members you or an administrator authorize, when legally required, or to protect users and the service.

Retention and deletion

Accounting records are retained while an organization is active and may need to be preserved for legal, tax, audit, fraud-prevention, or dispute purposes. Plaid connections can be disconnected and access tokens deleted. Account or organization deletion requests are handled as a controlled process so records are not accidentally destroyed. Backups may retain deleted records until the applicable backup-retention window expires.

Security

Stateful uses encrypted HTTPS connections, Supabase row-level security, role-based access, deterministic posting controls, audit events, encryption of Plaid access tokens before storage, and provider-managed encryption at rest. No system is perfectly secure. See the Security page for current controls and candid limitations.

Your choices and data deletion

You may request access, correction, export, disconnection, or deletion of your data, subject to identity verification and accounting/legal retention requirements. Administrators can deactivate organization access. For access, correction, export, or deletion requests, email support@withstateful.com or use our contact page. We may verify your identity and authority over affected records before processing a request. Removing saved GPS routes on your phone does not delete separately synced mileage records; logging out does not delete your account or your retained local work.

Changes

We will update the effective date when this policy changes materially and will provide an appropriate notice to active users when required.